nerdexam
CompTIA

CAS-002 · Question #557

A company provides on-demand virtual computing for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for access to…

The correct answer is C. A host server was left un-patched and an attacker was able to use a VMEscape attack to. A VM Escape attack exploits a vulnerability in the hypervisor to allow a malicious guest VM to break out of its isolation boundary and access the underlying host system.

Enterprise Security

Question

A company provides on-demand virtual computing for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for access to sensitive data. The security administrator at the company has uncovered a breach in data confidentiality. Sensitive data was found on a hidden directory within the hypervisor. Which of the following has MOST likely occurred?

Options

  • AA stolen two factor token and a memory mapping RAM exploit were used to move data from
  • BAn employee with administrative access to the virtual guests was able to dump the guest
  • CA host server was left un-patched and an attacker was able to use a VMEscape attack to
  • DA virtual guest was left un-patched and an attacker was able to use a privilege escalation

How the community answered

(48 responses)
  • A
    13% (6)
  • B
    23% (11)
  • C
    56% (27)
  • D
    8% (4)

Why each option

A VM Escape attack exploits a vulnerability in the hypervisor to allow a malicious guest VM to break out of its isolation boundary and access the underlying host system.

AA stolen two factor token and a memory mapping RAM exploit were used to move data from

A stolen two-factor token combined with a RAM exploit would grant an attacker access within a virtual guest session, but would not by itself explain data appearing in a hidden directory on the hypervisor layer outside any guest.

BAn employee with administrative access to the virtual guests was able to dump the guest

Administrative access to virtual guests allows management of guest VMs such as snapshots or configuration changes, but does not grant the ability to write data into hidden directories on the hypervisor host itself.

CA host server was left un-patched and an attacker was able to use a VMEscape attack toCorrect

VM Escape is an attack class where malicious code running inside a virtual guest exploits a flaw in the hypervisor's emulation or management layer to execute code on the host. An unpatched host server leaves known hypervisor vulnerabilities open, and a successful VM Escape would explain how sensitive guest data ended up in a hidden directory directly on the hypervisor filesystem, bypassing all guest-level access controls.

DA virtual guest was left un-patched and an attacker was able to use a privilege escalation

A privilege escalation attack on an unpatched guest elevates access within the guest OS boundary but remains confined to that guest and cannot place data directly onto the hypervisor without a separate escape mechanism.

Concept tested: VM Escape attack against unpatched hypervisor

Source: https://csrc.nist.gov/publications/detail/sp/800-125a/final

Topics

#VMEscape#hypervisor security#virtualization breach#data confidentiality

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice