Examkin

Soru

Zorluk: OrtaVirtualization and Containerization Security

An enterprise security analyst is designing an isolation architecture for a multi-tenant physical host. The system will process sensitive financial transactions alongside untrusted third-party code. The security policy mandates that a vulnerability exploited in one workload must not allow memory access or host execution privileges over co-located workload instances on the same server. Which of the following isolation strategies best fulfills this requirement?

  1. Deploying the workloads in separate Virtual Machines managed by a Type 1 hypervisor to leverage hardware-assisted memory protection and virtualization boundaries.Cevap
  2. B
    Encapsulating each workload in standard application containers on a shared Linux host OS, relying on kernel namespaces and control groups for complete hardware memory isolation.
  3. C
    Placing all workload containers within a dedicated internal virtual network segment behind a perimeter firewall to block inter-process memory exposure.
  4. D
    Installing an Endpoint Detection and Response (EDR) agent on the host OS to serve as a preventive hardware barrier between containerized processes.

Cevap

Deploying the workloads in separate Virtual Machines managed by a Type 1 hypervisor to leverage hardware-assisted memory protection and virtualization boundaries.
Virtual machines (VMs) managed by a Type 1 (bare-metal) hypervisor instantiate dedicated guest virtual hardware environments. By leveraging hardware virtualization features embedded in CPU architecture, the hypervisor enforces strict hardware-level memory paging and execution abstraction, ensuring untrusted code in one guest OS cannot inspect or compromise co-located workloads.

Adım Adım Çözüm

1
Evaluate the architectural isolation requirement.
The requirement demands strong hardware-enforced memory separation between co-located workloads handling untrusted code.
Software-level process separation on a shared host OS kernel does not prevent cross-workload memory access if kernel-level vulnerabilities exist.
2
Compare container-based OS isolation against hypervisor-based hardware virtualization.
Virtual Machines (VMs) present virtualized hardware abstractions to guest operating systems, whereas containers share a single host OS kernel.
Hardware-assisted CPU virtualization enforced by a Type 1 hypervisor ensures memory paging and execution states remain isolated per guest VM.
3
Identify the option offering hypervisor-level hardware isolation.
Type 1 hypervisor deployment satisfies the requirement by preventing guest-to-guest and guest-to-host memory leaks.
This strategy aligns with enterprise security principles for high-assurance multi-tenant workload isolation.

Anahtar Kavram

Hypervisor vs. Container Isolation Boundaries
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru