Examkin

Soru

Zorluk: OrtaVirtualization and Containerization Security

A system administrator is configuring isolation controls on a host operating system running multiple production application containers. Which of the following security mechanisms directly restrict containerized processes from escalating privileges on the host kernel and limiting system calls? (Select TWO.)

  1. Configuring Secure Computing Mode (seccomp) profiles for container runtime environmentsCevap
  2. Enabling user namespaces to map container root users to non-root host accountsCevap
  3. C
    Deploying a Type 1 bare-metal hypervisor to manage execution partitions for each container process
  4. D
    Relying exclusively on enterprise perimeter firewalls to filter inter-container network traffic

Cevap

The correct mechanisms are configuring Secure Computing Mode (seccomp) profiles and enabling user namespaces.
Seccomp restricts the syscall boundary exposed by the host kernel to containerized workloads, while user namespaces isolate administrative privileges by ensuring a container's root user does not map to root authority on the underlying host operating system.

Adım Adım Çözüm

1
Analyze container kernel isolation requirements
Identify controls that limit kernel attack surfaces and host account exposure.
Containers share the underlying host OS kernel, making system call filtering critical.
2
Evaluate system call restriction mechanisms
Seccomp profiles restrict syscall access per container process.
Restricting syscalls prevents compromised containers from executing dangerous kernel routines.
3
Evaluate identity and privilege boundary controls
User namespaces map container UID 0 (root) to an unprivileged host UID.
This prevents container escapes from granting root privileges on the underlying host machine.

Anahtar Kavram

Container Host Isolation and Kernel Hardening Mechanisms
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru