Examkin

Soru

Zorluk: ZorVirtualization and Containerization Security

During a security incident investigation on an enterprise server host, security analysts discover that an attacker exploited a vulnerability within a containerized application process to inject a malicious kernel module. This kernel module allowed the attacker to escape the application environment, gain full root control over the underlying host operating system, and access data across all neighboring tenant applications on that physical node. Which of the following fundamental architectural weaknesses enabled this cross-tenant host compromise, and what control provides the required isolation boundary?

  1. Containers share the host operating system kernel, meaning a kernel exploit compromises the host; executing workloads inside virtual machines with dedicated guest kernels provides hypervisor-enforced hardware isolation.Cevap
  2. B
    Containers lack network perimeter segmentation; deploying a perimeter firewall between virtual container network interfaces would have prevented host kernel driver modification.
  3. C
    Container runtimes enforce authentication instead of authorization; requiring multi-factor authentication for internal process execution would have blocked kernel driver loading.
  4. D
    Containers rely on control groups (cgroups) for workload separation, which inherently provide hypervisor-equivalent hardware isolation when configured to limit system resource consumption.

Cevap

Containers share the host operating system kernel, meaning a kernel exploit compromises the host; executing workloads inside virtual machines with dedicated guest kernels provides hypervisor-enforced hardware isolation.
The correct answer highlights the core architectural difference between containerization and hardware virtualization. Standard containers run as isolated user-space processes on top of a single shared host kernel. If a containerized process successfully executes a kernel exploit or loads a malicious kernel driver, it compromises the shared kernel, granting the attacker host-level access across all co-located containers. Virtual machines prevent this by using a hypervisor (Type 1 or Type 2) to allocate dedicated virtual hardware and separate guest OS kernels for each workload.

Adım Adım Çözüm

1
Analyze the incident details
The attacker executed a kernel-level exploit from inside a containerized application to compromise the host OS.
Identifying that the kernel itself was exploited points to shared-kernel architecture as the primary attack vector.
2
Evaluate container vs. virtual machine security boundaries
Containers share the underlying host kernel via namespaces and cgroups, whereas VMs run isolated guest operating systems managed by a hypervisor.
If an attacker achieves arbitrary kernel module loading within a standard container, the shared kernel boundary fails entirely.
3
Determine the effective remediation mechanism
Migrating sensitive multi-tenant workloads to virtual machines (or hypervisor-backed micro-VM runtimes) establishes dedicated kernel boundaries.
Hypervisors abstract physical hardware, isolating memory and execution states so that a guest kernel compromise does not grant access to the hypervisor host or adjacent VMs.

Anahtar Kavram

Virtualization vs. Containerization Isolation Boundaries
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru