Examkin

Soru

Zorluk: ZorVirtualization and Containerization Security

An enterprise security architect is refining the workload protection matrix for a multi-tenant cloud environment hosting both legacy virtualized infrastructure and microservice containers. Match each virtualization or containerization security control on the left to its corresponding isolation property or policy enforcement mechanism on the right.

  • Control Groups (cgroups)Enforces resource utilization quotas (CPU, memory, I/O bandwidth) to prevent resource exhaustion and noisy neighbor denial-of-service.
  • Linux NamespacesProvides segregated operational views of system resources, restricting process, network, and mount visibility between workloads.
  • Type-1 Hypervisor IsolationProvides dedicated hardware-enforced abstraction executing directly on physical host processors without relying on a host operating system.
  • CNI MicrosegmentationImplements granular packet filtering rules directly at the virtual network layer to isolate intra-cluster East-West microservice traffic.

Cevap

Control Groups (cgroups) matches with enforcing resource utilization quotas; Linux Namespaces matches with providing segregated operational views of system resources; Type-1 Hypervisor Isolation matches with providing dedicated hardware-enforced abstraction directly on physical host processors; CNI Microsegmentation matches with implementing granular packet filtering rules at the virtual network layer.
Each security control aligns directly with its primary system level: cgroups manage hardware resource quotas (CPU/RAM/IO), namespaces isolate kernel object visibility (PID/NET/MNT), Type-1 hypervisors manage bare-metal hardware abstraction for full VM execution isolation, and CNI microsegmentation manages granular software-defined network traffic controls across pods.

Adım Adım Çözüm

1
Analyze resource governing mechanisms for OS-level virtualization.
Control Groups (cgroups) strictly manage resource boundaries such as CPU limits, memory quotas, and block I/O rates to stop noisy-neighbor resource exhaustion.
cgroups provide hardware resource allocation control rather than structural visibility isolation.
2
Evaluate process and environment isolation primitives in container engines.
Linux Namespaces provide discrete visibility domains (PID, NET, IPC, MNT, UTS, USER) preventing one container from inspecting or interacting with system objects of another.
Namespaces abstract what a process can see rather than limiting how much CPU or RAM it consumes.
3
Examine hypervisor architectural models and hardware separation boundaries.
Type-1 (bare-metal) hypervisors run directly on underlying physical hardware host chips to enforce VM memory and CPU execution isolation without depending on a general-purpose host OS.
This establishes hardware ring isolation distinct from container kernel-sharing.
4
Determine modern network isolation methods within container orchestration systems.
CNI Microsegmentation utilizes eBPF or iptables at the virtual interface layer to enforce Zero Trust security rules on East-West traffic between container endpoints.
Microsegmentation protects pod-to-pod network pathways rather than host compute resources.

Anahtar Kavram

Virtualization and Containerization Security Mechanisms
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru