nerdexam
CompTIA

CAS-001 · Question #185

A company provides on-demand virtual computing for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for access to…

The correct answer is C. A host server was left un-patched and an attacker was able to use a VMEscape attack to gain. A VMEscape attack occurs when an attacker exploits a vulnerability in an unpatched hypervisor or host to break out of a virtual machine and gain unauthorized access to the hypervisor itself.

Technical Integration of Enterprise Components

Question

A company provides on-demand virtual computing for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for access to sensitive data. The security administrator at the company has uncovered a breach in data confidentiality. Sensitive data was found on a hidden directory within the hypervisor. Which of the following has MOST likely occurred?

Options

  • AA stolen two factor token and a memory mapping RAM exploit were used to move data from one
  • BAn employee with administrative access to the virtual guests was able to dump the guest memory
  • CA host server was left un-patched and an attacker was able to use a VMEscape attack to gain
  • DA virtual guest was left un-patched and an attacker was able to use a privilege escalation attack

How the community answered

(45 responses)
  • A
    7% (3)
  • B
    11% (5)
  • C
    51% (23)
  • D
    31% (14)

Why each option

A VMEscape attack occurs when an attacker exploits a vulnerability in an unpatched hypervisor or host to break out of a virtual machine and gain unauthorized access to the hypervisor itself.

AA stolen two factor token and a memory mapping RAM exploit were used to move data from one

A stolen two-factor token with a RAM exploit would allow access to an authenticated session, but would not typically result in data appearing in a hidden directory on the hypervisor itself.

BAn employee with administrative access to the virtual guests was able to dump the guest memory

An administrative employee dumping guest memory would be an insider threat action, but would not require hypervisor-level directory access and would be attributable via admin logs.

CA host server was left un-patched and an attacker was able to use a VMEscape attack to gainCorrect

VMEscape is a class of attack where malicious code running inside a virtual guest exploits a flaw in the hypervisor layer to execute code or access memory on the host system, bypassing the isolation boundary. Finding sensitive data in a hidden directory on the hypervisor is the direct result of an attacker who has successfully escaped a VM and gained hypervisor-level access. An unpatched host server is the most likely enabler, as hypervisor CVEs are well-known attack vectors.

DA virtual guest was left un-patched and an attacker was able to use a privilege escalation attack

A privilege escalation within a virtual guest elevates access inside the guest OS but does not cross the hypervisor boundary needed to place data on the host hypervisor.

Concept tested: VMEscape attack bypassing hypervisor isolation boundary

Source: https://www.tenable.com/blog/vm-escape-attacks-what-they-are-and-how-to-prevent-them

Topics

#VM escape#hypervisor security#virtualization#privilege escalation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-001 Practice