Examkin

Soru

Zorluk: KolayVirtualization and Containerization Security

A system administrator is hardening container instances operating on a shared host. Which TWO of the following mechanisms directly enforce kernel-level isolation and resource boundaries for container processes?

  1. Linux namespaces and control groups (cgroups)Cevap
  2. Seccomp profiles restricting allowed system callsCevap
  3. C
    Perimeter network firewalls surrounding the host server
  4. D
    Type-1 hypervisor hardware isolation for each container

Cevap

Linux namespaces and control groups (cgroups), alongside seccomp profiles restricting allowed system calls, provide direct kernel-level process isolation and resource boundary enforcement for containerized environments.
Containers rely on kernel-level primitives. Linux namespaces isolate system resources (such as process trees, mount points, and network stacks), cgroups constrain resource consumption, and seccomp restricts the system calls available to containerized processes.

Adım Adım Çözüm

1
Identify container isolation mechanisms operating at the host kernel layer.
Linux namespaces provide process boundary separation, cgroups limit hardware resource allocation, and seccomp limits system call access.
Containers share the host operating system kernel, requiring kernel-level security features to restrict process permissions and resource access.
2
Evaluate and eliminate non-container isolation mechanisms.
Perimeter firewalls filter network traffic rather than host processes, and Type-1 hypervisors provide full VM hardware isolation rather than standard container isolation.
External network controls and hypervisor virtualization do not provide standard process isolation inside a shared OS container environment.

Anahtar Kavram

Kernel-level container isolation mechanisms
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru