ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Containerization (for example, using Docker or other OCI-compliant runtimes) relies on operating-system features such as namespaces and control groups to give each container its own process, network and file-system view while all containers still share the host's kernel. This yields very fast start-up and lower memory and CPU overhead compared with full virtualization, which has to emulate hardware and run separate guest kernels under a hypervisor. Application sandboxing confines a single program rather than packaging an entire service with its dependencies, and it does not necessarily provide the deployment portability required. Provisioning dedicated virtual private servers on separate physical machines offers strong isolation but the highest cost and longest provisioning time, which conflicts with the rapid, lightweight requirement. Therefore, containerization is the most suitable choice.