Examkin

Soru

Zorluk: KolayVirtualization and Containerization Security

A security administrator is configuring host-level hardening for an application running in a Linux container environment. Which of the following security mechanisms directly restrict container resource usage and limit accessible host kernel system calls? (Select TWO.)

  1. Control groups (cgroups)Cevap
  2. Secure Computing Mode (seccomp) profilesCevap
  3. C
    Hardware-level Type-1 hypervisor abstraction
  4. D
    Perimeter network firewall rules

Cevap

Control groups (cgroups) and Secure Computing Mode (seccomp) profiles are the correct choices.
Control groups (cgroups) provide resource metering and limiting (CPU, memory, storage I/O) for containerized processes on the host. Secure Computing Mode (seccomp) restricts the system call interface exposed by the host kernel to the container, minimizing potential kernel exploitation vectors.

Adım Adım Çözüm

1
Identify the host-level mechanism that restricts hardware resource allocation for containers.
Control groups (cgroups) manage and limit resources like memory, CPU, and disk I/O per container.
Prevents a single container from consuming all host resources.
2
Identify the mechanism that restricts process interactions with the host kernel interface.
Seccomp restricts system call privileges available to containerized processes.
Reduces kernel attack surface by blocking unnecessary system calls.

Anahtar Kavram

Linux kernel mechanisms for container resource governance and system call filtering
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru