Examkin

Soru

Zorluk: OrtaVirtualization and Containerization Security

A security architect is designing a multi-tenant enterprise environment hosted on shared physical hardware. The corporate compliance policy requires strict hardware-enforced memory separation and workload isolation between high-risk third-party microservices and sensitive internal data systems to prevent kernel-level privilege escalation attacks. Which of the following deployment architectures BEST satisfies this security requirement?

  1. A
    Deploying application workloads inside standard Linux containers using host kernel namespaces and control groups (cgroups).
  2. Deploying workloads into separate virtual machines running on a bare-metal Type-1 hypervisor.Cevap
  3. C
    Implementing API network microsegmentation and firewall ingress policy rules around single-host container pods.
  4. D
    Applying role-based access control (RBAC) and mutual TLS (mTLS) to secure microservice communications.

Cevap

Deploying workloads into separate virtual machines running on a bare-metal Type-1 hypervisor.
Deploying workloads into distinct virtual machines managed by a bare-metal Type-1 hypervisor provides robust, hardware-assisted abstraction. Each virtual machine executes its own independent operating system kernel. Physical CPU and memory management features enforce hardware boundaries, ensuring that exploits targeting one virtual machine cannot access host memory or compromise neighboring workloads.

Adım Adım Çözüm

1
Analyze the core isolation requirement stated in the enterprise policy.
Identified the need for hardware-enforced memory separation and independent kernel boundaries between multi-tenant workloads.
The requirement specifically calls for protection against cross-tenant kernel exploits on shared hardware.
2
Evaluate container architecture against virtual machine architecture.
Containers share the host operating system kernel, whereas Virtual Machines (VMs) run separate guest operating systems on virtualized hardware abstraction layers.
OS-level container isolation is vulnerable to kernel escape exploits if a container breaks namespace boundaries.
3
Select the technology that provides bare-metal hardware abstraction and memory boundaries.
Type-1 (bare-metal) hypervisors leverage hardware-assisted virtualization mechanisms (like Intel VT-x / AMD-V) to enforce absolute memory partition boundaries between VMs.
This guarantees that a compromised tenant VM cannot access memory or compromise the kernel of adjacent tenant VMs.

Anahtar Kavram

Hardware-enforced VM isolation versus OS-level shared-kernel container isolation
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru