MENU
John is a senior network security administrator working at a multinational company. He wants to block specific syscalls from being used by container binaries. Which Linux kernel feature restricts actions
within the container?
Suggested Answer: A
Get Premium 312-38 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The topology that the network designer will propose is known as a screened subnet. This topology involves the use of two or more firewalls to create a network segment referred to as a demilitarized zone (DMZ). The DMZ acts as a buffer zone between the public internet and the internal network. It contains the public-facing servers, such as the web portal mentioned, which is isolated from the internal network for added security. The screened subnet topology typically includes a firewall at the network's edge connected to the internet, another firewall separating the DMZ from the internal network, and the DMZ itself. This setup allows for strict control of traffic between the internet, the DMZ, and the internal network, providing an additional layer of security.
38 comments · newest first
LU
Luisa
11 months ago
Userns is about user namespaces, not syscall restrictions.
LA
Lazaro
11 months ago
Wait, can Seccomp really block syscalls? Sounds too good to be true!
JA
James
11 months ago
Cgroups are for resource limits, not syscall blocking.
IO
Iola
12 months ago
I thought it was LSMs, but Seccomp makes more sense.
BE
Bette
12 months ago
It's definitely Seccomp that does this!
RO
Rose
1 year ago
Cgroups seem more about resource management, so I don’t think they would be the answer here.
TO
Torie
1 year ago
I practiced a similar question about container security, and I think Seccomp was mentioned as a way to restrict actions.
MU
Murray
1 year ago
I’m not entirely sure, but I feel like LSMs might be related to security modules, not specifically for blocking syscalls.
KY
Kyoko
1 year ago
I remember studying about syscall filtering, and I think Seccomp is the right choice for blocking specific syscalls in containers.
PR
Princess
1 year ago
This seems like a good opportunity to apply my knowledge of container security best practices. I'll focus on the container context and go with the LSM option.
LI
Linsey
1 year ago
I'm a bit confused by the wording of the question. Is it asking about restricting actions within the container, or just in general? I'll need to re-read it carefully.
MI
Mila
1 year ago
Okay, I remember learning about Seccomp in my Linux security course. I think that's the feature that allows restricting syscalls, so I'll go with that.
RA
Raul
1 year ago
Hmm, I'm a bit unsure about the differences between these kernel features. I'll need to think through the details of each one.
LA
Lacresha
1 year ago
This looks like a straightforward question on Linux kernel features. I'm pretty confident I can figure this out.
AN
Anthony
1 year ago
I heard Seccomp is like a force field for your container. It's the Chuck Norris of Linux kernel features!
LA
Lavera
1 year ago
Seccomp all the way! It's like a bouncer for your container, keeping the troublemakers out. John's going to have a secure container party with this one.
PA
Pamella
1 year ago
Cgroups, LSMs, and Userns are important too, but Seccomp is the star here.
MI
Mila
1 year ago
John will have a secure container party with Seccomp in place.
AS
Ashton
1 year ago
LSMs are important for enforcing access control policies in the kernel.
JA
Jacqueline
1 year ago
I agree, it's like having a bouncer for your container.
LU
Ludivina
1 year ago
Cgroups can help with resource management within the container.
BR
Brianne
1 year ago
Seccomp is definitely the way to go for blocking specific syscalls in container binaries.
AL
Alethea
1 year ago
Seccomp is definitely the way to go for blocking those syscalls.
SH
Shantay
2 years ago
Userns? Nah, that's for user namespaces, not restricting syscalls. I'm going with LSMs - they can do some pretty advanced security stuff, right?
CA
Carla
1 year ago
Seccomp is actually the Linux kernel feature that restricts syscalls. Good choice!
BO
Boris
1 year ago
I think Cgroups can also restrict actions within the container.
DE
Dexter
1 year ago
Yes, LSMs can indeed do some advanced security configurations.
KR
Kristine
2 years ago
Hmm, Cgroups are great for resource management, but I don't think they're the right tool for blocking specific syscalls. I'd go with Seccomp on this one.
CA
Carin
1 year ago
LSMs and Userns are not typically used for blocking syscalls like Seccomp.
LA
Lajuana
1 year ago
Seccomp filters system calls at the kernel level, making it a good choice.
CA
Carli
1 year ago
Cgroups are more for resource management, not syscall blocking.
HE
Herminia
1 year ago
I agree, Seccomp is the way to go for blocking specific syscalls.
NI
Nicolette
2 years ago
Seccomp sounds like the way to go here. I remember reading about how it can restrict system calls in a container. Seems like the best choice for John's needs.
RO
Rosalind
1 year ago
I agree, Seccomp is a powerful feature for restricting actions within containers.
CL
Clay
1 year ago
Seccomp is definitely the way to go for blocking specific syscalls in containers.
MO
Mona
2 years ago
I'm not sure, but I think Cgroups could also be a possible answer.
FR
Francoise
2 years ago
I agree with Olene, Seccomp restricts actions within the container.
OL
Olene
2 years ago
I think the answer is C) Seccomp.