Which of the following feature/function sets is used to implement IBM Z Secure Service Container (SSC)?

Question

Options

• AKVM, Linux Unified Key Setup (LUKS), and CPACF
• BCrypto Express, z/VM, and RedHat Linux (RHEL)
• Cz/VM, SubSystem Interface (SSI), and RACF
• DzAware, GDPS, and RACF

• A
  92% (23)
• B
  4% (1)
• D
  4% (1)

Explanation

Option A is correct because IBM Z Secure Service Container uses KVM as its lightweight hypervisor to create isolated partitions, LUKS to encrypt the container's disk/storage so that even privileged administrators cannot access workload data at rest, and CPACF (Central Processor Assist for Cryptographic Functions) to provide hardware-accelerated encryption operations - together forming SSC's core security architecture.

Why the others are wrong:

• B is wrong because SSC does not use z/VM (IBM's traditional mainframe hypervisor) - it specifically avoids z/VM to eliminate the privileged sysadmin attack surface. Crypto Express and RHEL are also not SSC implementation pillars.
• C is wrong because z/VM, SSI (a z/VM clustering feature), and RACF (an access control product) belong to classic z/VM administration, not SSC's design philosophy.
• D is wrong because zAware (anomaly detection), GDPS (disaster recovery), and RACF are operational/HA tools with no role in SSC's isolation or encryption model.

Memory tip: Think "KLC - Keep it Locked Cryptographically" - KVM isolates it, LUKS locks the data, CPACF handles the crypto. SSC's whole point is keeping workloads sealed away from admins, so picture a locked KVM box with hardware crypto glued to it.

No community discussion yet for this question.