Eccouncil 312-38 Exam - Topic 4 Question 97 Discussion

Actual exam question for Eccouncil's 312-38 exam

Question #: 97
Topic #: 4

John is a senior network security administrator working at a multinational company. He wants to block specific syscalls from being used by container binaries. Which Linux kernel feature restricts actions

within the container?

ACgroups

BLSMs

CSeccomp

DUserns

Show Suggested Answer

Suggested Answer: A

The topology that the network designer will propose is known as a screened subnet. This topology involves the use of two or more firewalls to create a network segment referred to as a demilitarized zone (DMZ). The DMZ acts as a buffer zone between the public internet and the internal network. It contains the public-facing servers, such as the web portal mentioned, which is isolated from the internal network for added security. The screened subnet topology typically includes a firewall at the network's edge connected to the internet, another firewall separating the DMZ from the internal network, and the DMZ itself. This setup allows for strict control of traffic between the internet, the DMZ, and the internal network, providing an additional layer of security.

by Wava at Oct 22, 2024, 05:42 AM

Limited Time Offer

25%

Off

Get Premium 312-38 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Luisa

6 months ago

Userns is about user namespaces, not syscall restrictions.

upvoted 0 times

...

Lazaro

6 months ago

Wait, can Seccomp really block syscalls? Sounds too good to be true!

upvoted 0 times

...

James

6 months ago

Cgroups are for resource limits, not syscall blocking.

upvoted 0 times

...

Iola

7 months ago

I thought it was LSMs, but Seccomp makes more sense.

upvoted 0 times

...

Bette

7 months ago

It's definitely Seccomp that does this!

upvoted 0 times

...

Rose

7 months ago

Cgroups seem more about resource management, so I don’t think they would be the answer here.

upvoted 0 times

...

Torie

7 months ago

I practiced a similar question about container security, and I think Seccomp was mentioned as a way to restrict actions.

upvoted 0 times

...

Murray

7 months ago

I’m not entirely sure, but I feel like LSMs might be related to security modules, not specifically for blocking syscalls.

upvoted 0 times

...

Kyoko

8 months ago

I remember studying about syscall filtering, and I think Seccomp is the right choice for blocking specific syscalls in containers.

upvoted 0 times

...

Princess

8 months ago

This seems like a good opportunity to apply my knowledge of container security best practices. I'll focus on the container context and go with the LSM option.

upvoted 0 times

...

Linsey

8 months ago

I'm a bit confused by the wording of the question. Is it asking about restricting actions within the container, or just in general? I'll need to re-read it carefully.

upvoted 0 times

...

Mila

8 months ago

Okay, I remember learning about Seccomp in my Linux security course. I think that's the feature that allows restricting syscalls, so I'll go with that.

upvoted 0 times

...

Raul

8 months ago

Hmm, I'm a bit unsure about the differences between these kernel features. I'll need to think through the details of each one.

upvoted 0 times

...

Lacresha

8 months ago

This looks like a straightforward question on Linux kernel features. I'm pretty confident I can figure this out.

upvoted 0 times

...

Anthony

1 year ago

I heard Seccomp is like a force field for your container. It's the Chuck Norris of Linux kernel features!

upvoted 0 times

...

Lavera

1 year ago

Seccomp all the way! It's like a bouncer for your container, keeping the troublemakers out. John's going to have a secure container party with this one.

upvoted 0 times

Pamella

11 months ago

Cgroups, LSMs, and Userns are important too, but Seccomp is the star here.

upvoted 0 times

...

Mila

11 months ago

John will have a secure container party with Seccomp in place.

upvoted 0 times

...

Ashton

11 months ago

LSMs are important for enforcing access control policies in the kernel.

upvoted 0 times

...

Jacqueline

11 months ago

I agree, it's like having a bouncer for your container.

upvoted 0 times

...

Ludivina

12 months ago

Cgroups can help with resource management within the container.

upvoted 0 times

...

Brianne

12 months ago

Seccomp is definitely the way to go for blocking specific syscalls in container binaries.

upvoted 0 times

...

Alethea

12 months ago

Seccomp is definitely the way to go for blocking those syscalls.

upvoted 0 times

...

Shantay

1 year ago

Userns? Nah, that's for user namespaces, not restricting syscalls. I'm going with LSMs - they can do some pretty advanced security stuff, right?

upvoted 0 times

Carla

12 months ago

Seccomp is actually the Linux kernel feature that restricts syscalls. Good choice!

upvoted 0 times

...

Boris

12 months ago

I think Cgroups can also restrict actions within the container.

upvoted 0 times

...

Dexter

12 months ago

Yes, LSMs can indeed do some advanced security configurations.

upvoted 0 times

...

Kristine

1 year ago

Hmm, Cgroups are great for resource management, but I don't think they're the right tool for blocking specific syscalls. I'd go with Seccomp on this one.

upvoted 0 times

Carin

12 months ago

LSMs and Userns are not typically used for blocking syscalls like Seccomp.

upvoted 0 times

...

Lajuana

12 months ago

Seccomp filters system calls at the kernel level, making it a good choice.

upvoted 0 times

...

Carli

1 year ago

Cgroups are more for resource management, not syscall blocking.

upvoted 0 times

...

Herminia

1 year ago

I agree, Seccomp is the way to go for blocking specific syscalls.

upvoted 0 times

...

Nicolette

1 year ago

Seccomp sounds like the way to go here. I remember reading about how it can restrict system calls in a container. Seems like the best choice for John's needs.

upvoted 0 times