Which of the following BEST constitutes the basis for protecting VMs from attacks from other VMs hosted on the same physical platform?

VM-to-VM attacks such as VM escape rely on known, exploitable vulnerabilities in the hypervisor software or the guest operating systems running on the shared platform. Aggressive patch management on both the host hypervisor and all guest OSs closes these known vulnerabilities at their source, directly reducing the attack surface for lateral movement between VMs on the same hardware.

Host-based IDS sensors on guest OSs can detect intrusion attempts after exploitation begins but do not prevent the underlying hypervisor vulnerabilities that enable VM-to-VM attacks.

Using different antivirus products between host and guest does not address the hypervisor-level or OS-level vulnerabilities that are exploited in VM escape and inter-VM attack scenarios.

Unique NIC assignment per guest OS improves network traffic isolation but does not protect against VM escape attacks that target the hypervisor layer rather than the network path.