A security administrator has finished building a Linux server which will host multiple virtual machines through hypervisor technology. Management of the Linux server, including monitoring server…

A chroot environment changes the apparent root directory for a process, preventing it from accessing files outside the designated directory tree even if the application is fully compromised. This means a successful attacker exploiting a vulnerability in the web management application would be contained within the chroot jail and unable to traverse the filesystem to reach VM disk images or hypervisor configuration files. This directly addresses the risk of web application vulnerabilities exposing data stored on the virtual machines.

A software firewall controls network traffic between interfaces but does not restrict a compromised local process from accessing files on the same host filesystem.

Anti-virus software detects known malware signatures and behaviors but does not sandbox or restrict the filesystem access of a legitimate but vulnerable web management application.

Data exfiltration detection on the perimeter firewall monitors outbound network traffic but does not prevent an attacker with local access via the compromised web app from reading VM data before it leaves the network.