Examkin

Soru

Zorluk: OrtaVirtualization and Containerization Security

A security engineer is evaluating an enterprise microservices platform where multiple application containers share the underlying Linux host kernel. The engineer needs to enforce a control that restricts containerized application processes from issuing unauthorized or risky system calls (syscalls) directly to the host kernel. Which of the following mechanisms best satisfies this security requirement?

  1. Applying secure computing mode (seccomp) profiles to restrict allowable kernel system callsCevap
  2. B
    Deploying container images inside Type 2 hypervisors to provide container-level hardware kernel separation
  3. C
    Configuring network perimeter firewalls to inspect and drop malicious kernel system call payloads
  4. D
    Implementing file integrity monitoring (FIM) as a preventive inline control to intercept system calls

Cevap

Applying secure computing mode (seccomp) profiles to restrict allowable kernel system calls
Secure computing mode (seccomp) allows administrators to restrict which system calls a containerized process can execute on the host kernel, significantly reducing the surface area for kernel vulnerabilities and container escape attacks.

Adım Adım Çözüm

1
Identify the threat and architecture model
Containers run as isolated process sets sharing a single underlying host kernel.
Because containers share the host kernel, malicious or compromised process execution can leverage unnecessary system calls to achieve host kernel compromise or container escape.
2
Evaluate technical controls for system call filtering
Seccomp (Secure Computing Mode) defines syscall white-lists/black-lists enforced directly by the Linux kernel.
Restricting process syscall access via seccomp profiles effectively minimizes the attack surface against the shared kernel.

Anahtar Kavram

Container System Call Filtering via Seccomp
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru