CAS-001 · Question #24
Which of the following precautions should be taken to harden network devices in case of VMEscape?
The correct answer is C. Virtual servers should only be on the same physical server as others in their network segment. VM escape is a hypervisor vulnerability where an attacker breaks out of a virtual machine and gains access to the host or other VMs on the same physical server. Keeping virtual machines from different network segments on the same physical host reduces the blast radius of such…
Question
Which of the following precautions should be taken to harden network devices in case of VMEscape?
Options
- ADatabase servers should be on the same virtual server as web servers in the DMZ network segment.
- BWeb servers should be on the same physical server as database servers in the network segment.
- CVirtual servers should only be on the same physical server as others in their network segment.
- DPhysical servers should only be on the same WAN as other physical servers in their network.
How the community answered
(24 responses)- A21% (5)
- B13% (3)
- C58% (14)
- D8% (2)
Why each option
VM escape is a hypervisor vulnerability where an attacker breaks out of a virtual machine and gains access to the host or other VMs on the same physical server. Keeping virtual machines from different network segments on the same physical host reduces the blast radius of such an exploit.
Placing database servers and web servers together in the DMZ on the same virtual host violates network segmentation principles and increases attack surface rather than hardening against VM escape.
Co-locating web servers and database servers on the same physical machine collapses security zones and directly contradicts the principle of separating systems with different trust levels.
If virtual servers from different network segments (such as DMZ and internal) share the same physical host, a successful VM escape attack could allow an attacker to move laterally across trust boundaries, so ensuring that only VMs belonging to the same network segment reside on the same physical server limits the scope of damage from a VM escape.
Physical server placement on the same WAN is a network topology statement and is unrelated to hypervisor-level VM escape containment strategies.
Concept tested: VM escape risk mitigation through network segment isolation
Source: https://csrc.nist.gov/publications/detail/sp/800-125/final
Topics
Community Discussion
No community discussion yet for this question.