nerdexam
CompTIA

CAS-002 · Question #204

The security administrator is reviewing the business continuity plan which consists of virtual infrastructures at corporate headquarters and at the backup site. The administrator is concerned that…

The correct answer is C. Passwords are stored unencrypted in memory, which are then transported across the MPLS. Live VM migration transfers the entire memory state of a running virtual machine in cleartext, exposing in-memory passwords and credentials to anyone monitoring the MPLS network.

Technical Integration of Enterprise Components

Question

The security administrator is reviewing the business continuity plan which consists of virtual infrastructures at corporate headquarters and at the backup site. The administrator is concerned that the VLAN used to perform live migrations of virtual machines to the backup site is across the network provider's MPLS network. This is a concern due to which of the following?

Options

  • AThe hypervisor virtual switches only support Q-in-Q VLANS, not MPLS.
  • BVLANs are not compatible with MPLS, which may cause intermittent failures while performing
  • CPasswords are stored unencrypted in memory, which are then transported across the MPLS
  • DTransport encryption is being used during the live migration of virtual machines which will

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    24% (6)
  • C
    60% (15)
  • D
    12% (3)

Why each option

Live VM migration transfers the entire memory state of a running virtual machine in cleartext, exposing in-memory passwords and credentials to anyone monitoring the MPLS network.

AThe hypervisor virtual switches only support Q-in-Q VLANS, not MPLS.

Hypervisor virtual switches support standard 802.1Q VLANs natively; Q-in-Q support is not a requirement for MPLS compatibility, and MPLS operates at the provider layer independently of virtual switch VLAN capabilities.

BVLANs are not compatible with MPLS, which may cause intermittent failures while performing

VLANs and MPLS are complementary and widely deployed together; MPLS is designed to transport VLAN-tagged traffic and does not cause compatibility failures or intermittent errors with standard VLAN configurations.

CPasswords are stored unencrypted in memory, which are then transported across the MPLSCorrect

Technologies such as VMware vMotion and Hyper-V Live Migration copy the complete RAM contents of a running VM across the network to the destination host, and this transfer is unencrypted by default. Any sensitive data held in memory at migration time - including plaintext passwords, session tokens, and encryption keys - is included in this transfer. Sending this data across a third-party MPLS network without transport encryption creates a significant confidentiality risk, as the provider or an attacker with network access could intercept the memory stream.

DTransport encryption is being used during the live migration of virtual machines which will

The presence of transport encryption would mitigate the risk rather than create it; the concern is precisely that transport encryption is absent during live migration, exposing memory contents in transit.

Concept tested: Live VM migration memory exposure over untrusted provider networks

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-125B.pdf

Topics

#VM live migration#VLAN#MPLS#memory credential exposure

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice