Isolation Techniques KCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why do virtual machines provide stronger isolation than containers?

   • AThey use fewer resources than containers.
   • BThey are faster to start than containers.
   • CThey use a separate kernel for each VM.
   • DThey are easier to manage than containers.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security engineer is troubleshooting a containerized application that can see the host's network interfaces and modify the host's iptables rules. The container was started with `--network=host`. The engineer needs to explain why this is a security risk and recommend a fix. Which explanation and fix is correct?

   • AThe container lacks a PID namespace, so it can see host processes; add a PID namespace.
   • BThe container shares the host's network namespace, so it can see and modify host network configuration; use a bridge network instead.
   • CThe container is running as root; run it as a non-root user.
   • DThe container lacks a mount namespace, so it can modify host files; add a mount namespace.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of isolating secrets and identity management?

   • ATo speed up authentication processes.
   • BTo prevent cross-tenant access to sensitive credentials and authentication data.
   • CTo reduce the number of secrets needed in the environment.
   • DTo make secrets easier to remember.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary function of control groups (cgroups) in container isolation?

   • ATo encrypt data at rest for container storage
   • BTo limit and monitor resource usage such as CPU, memory, and I/O
   • CTo isolate the container's view of the filesystem
   • DTo provide each container with its own network stack
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a microVM?

   • AA container that runs without a kernel.
   • BA sandboxing technique that uses a separate user space for each process.
   • CA lightweight VM designed for high-density, secure workload isolation.
   • DA type of hypervisor that only supports one VM.
   Reveal Solution Discussion Select an answer first