A user on a virtual machine downloads a large file using a popular peer-to-peer torrent program. The user is unable to execute the program on their VM. A security administrator scans the VM and…

Question

Options

• AThe hypervisor host does not have hardware acceleration enabled and does not allow DEP.
• BThe virus scanner on the VM changes file extensions of all programs downloaded via P2P to
• CThe virtual machine is configured to require administrator rights to execute all programs.
• DThe virus is trying to access a virtual device which the hypervisor is configured to restrict.

• A
  3% (1)
• B
  13% (5)
• C
  5% (2)
• D
  79% (30)

Explanation

The correct answer is D. The key clue is that the hypervisor logs show access attempts correlated with the virus execution. Viruses on virtual machines sometimes attempt VM escape by accessing virtual devices (e.g., virtual network adapters, shared folders, or clipboard) to reach the hypervisor or host OS. When the hypervisor is configured to restrict access to these virtual devices, it blocks the attempts and logs them. This explains both observations: the program fails to execute its payload fully, and the hypervisor logs show repeated blocked access attempts. Option A (DEP/hardware acceleration) would affect execution prevention but not hypervisor log entries. Option B is implausible as a virus behavior. Option C (admin rights requirement) would block execution but would not generate hypervisor-level access attempt logs.

No community discussion yet for this question.