nerdexam
CompTIA

CAS-002 · Question #575

A security administrator has finished building a Linux server which will host multiple virtual machines through hypervisor technology. Management of the Linux server, including monitoring server…

The correct answer is A. The security administrator must install the third party web enabled application in a chroot. A chroot jail isolates a vulnerable web application so that even if it is compromised, the attacker cannot access files or data outside the jailed directory, including virtual machine data.

Technical Integration of Enterprise Components

Question

A security administrator has finished building a Linux server which will host multiple virtual machines through hypervisor technology. Management of the Linux server, including monitoring server performance, is achieved through a third party web enabled application installed on the Linux server. The security administrator is concerned about vulnerabilities in the web application that may allow an attacker to retrieve data from the virtual machines. Which of the following will BEST protect the data on the virtual machines from an attack?

Options

  • AThe security administrator must install the third party web enabled application in a chroot
  • BThe security administrator must install a software firewall on both the Linux server and the
  • CThe security administrator must install anti-virus software on both the Linux server and the
  • DThe security administrator must install the data exfiltration detection software on the

How the community answered

(61 responses)
  • A
    66% (40)
  • B
    23% (14)
  • C
    8% (5)
  • D
    3% (2)

Why each option

A chroot jail isolates a vulnerable web application so that even if it is compromised, the attacker cannot access files or data outside the jailed directory, including virtual machine data.

AThe security administrator must install the third party web enabled application in a chrootCorrect

A chroot jail changes the apparent root directory for the running process, confining it to a restricted filesystem subtree. This means a successful exploit of the web application cannot traverse the filesystem to reach hypervisor data or VM disk images, directly addressing the described threat of data retrieval from virtual machines via a web app vulnerability.

BThe security administrator must install a software firewall on both the Linux server and the

A software firewall controls network-level traffic but does not restrict filesystem access, so a locally exploited web application can still read VM data on the same host.

CThe security administrator must install anti-virus software on both the Linux server and the

Anti-virus software detects known malware signatures but does not prevent an attacker from leveraging a legitimate web application vulnerability to read files from the filesystem.

DThe security administrator must install the data exfiltration detection software on the

Data exfiltration detection is a reactive control that alerts after data has already been accessed or transmitted, and does not prevent the initial unauthorized data retrieval.

Concept tested: chroot jail for application isolation and containment

Source: https://man7.org/linux/man-pages/man2/chroot.2.html

Topics

#virtualization security#chroot jail#hypervisor#web application vulnerability

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice