Examkin

Soru

Zorluk: OrtaVirtualization and Containerization Security

A software development team is deploying a microservice application using containerization on a shared Linux host operating system. To mitigate the risk of a compromised container issuing malicious system calls directly to the host OS kernel, the security administrator needs to restrict syscall availability for the container runtime environment. Which of the following is the most effective security control to achieve this requirement?

  1. Implementing a custom Secure Computing Mode (seccomp) profile for the container runtimeCevap
  2. B
    Configuring control groups (cgroups) to provide hardware-level hypervisor boundary isolation
  3. C
    Establishing network perimeter firewalls to trust inter-container communications within the cluster subnet
  4. D
    Assigning role-based user access controls to verify container identity before permitting kernel execution

Cevap

Implementing a custom Secure Computing Mode (seccomp) profile for the container runtime
Seccomp (Secure Computing Mode) is a security feature in the Linux kernel that allows an administrator to filter the system calls a container process can issue. By applying a restrictive seccomp profile, malicious or unnecessary syscalls are blocked before reaching the host kernel.

Adım Adım Çözüm

1
Identify the primary threat vector in the scenario
A compromised process in a container invoking unauthorized host kernel system calls (syscalls).
Containers share the host operating system kernel, making kernel syscall exploitation a major privilege escalation vector.
2
Evaluate technical controls for limiting syscall access
Seccomp profiles allow administrators to define specific syscall whitelist/blacklist rules for processes.
Restricting syscalls via seccomp minimizes the attack surface against kernel-level vulnerabilities.
3
Differentiate seccomp from other container management mechanisms
cgroups limit resource allocation, namespaces isolate visibility, while seccomp restricts syscall capability.
Choosing the precise kernel restriction tool directly addresses system call privilege containment.

Anahtar Kavram

Container Hardening via System Call Filtering (Seccomp)
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru