Examkin

Soru

Zorluk: OrtaVirtualization and Containerization Security

A security administrator is hardening a container runtime environment hosting third-party microservices on a shared host node. To minimize the blast radius of a potential container exploit, the administrator needs to enforce strict privilege boundary controls on container processes. Which TWO of the following security configurations should be implemented to meet these requirements? (Select TWO.)

  1. Drop unnecessary Linux kernel capabilities, such as CAP_SYS_ADMIN, from the container execution profile.Cevap
  2. Configure the container root filesystem to mount as read-only and direct writable operations to volatile memory mounts.Cevap
  3. C
    Rely on hardware-level hypervisor isolation to separate container processes sharing the underlying host kernel.
  4. D
    Bypass internal microsegmentation policies for container traffic moving across the host's virtual network bridge.

Cevap

The correct security configurations are dropping unnecessary Linux kernel capabilities (such as CAP_SYS_ADMIN) from the container runtime profile, and configuring the container root filesystem to mount as read-only while directing transient write operations to volatile memory mounts.
Dropping unneeded Linux kernel capabilities restricts system calls available to containerized processes, preventing a compromised process from carrying out administrative operations on the shared host kernel. Additionally, setting container root filesystems to read-only ensures immutability during runtime, blocking malicious file modifications and restricting necessary transient writes to temporary memory mounts.

Adım Adım Çözüm

1
Evaluate container privilege restrictions on the shared host kernel.
Identify that removing unneeded Linux capabilities (e.g., CAP_SYS_ADMIN) restricts containerized process rights and reduces host attack surface.
Containers share the underlying host OS kernel, so limiting kernel capabilities prevents container processes from performing unauthorized administrative actions on the host.
2
Assess storage immutability controls for runtime containers.
Determine that mounting the root filesystem as read-only prevents file tampering and persistence of exploit payloads.
Enforcing a read-only root filesystem creates immutable container instances where temporary write operations are isolated to temporary memory mounts (tmpfs).
3
Verify and discard incorrect container isolation and network assumptions.
Recognize that standard containers do not use hypervisor hardware isolation and internal container traffic requires continuous microsegmentation.
Containers utilize kernel features (namespaces and control groups) rather than virtual machine hypervisors, and Zero Trust dictates that internal bridge traffic must not bypass security checks.

Anahtar Kavram

Container Runtime Hardening and Privilege Boundary Controls
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru