nerdexam
CompTIA

CAS-002 · Question #828

A company provides on-demand cloud computing resources for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for…

The correct answer is A. Both VMs were left unsecured and an attacker was able to exploit network vulnerabilities to. In a multi-tenant virtualized environment, VMs lacking proper network isolation allow an attacker to exploit shared network access and move data between customer environments.

Technical Integration of Enterprise Components

Question

A company provides on-demand cloud computing resources for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for customer access to the administrative website. The security administrator at the company has uncovered a breach in data confidentiality. Sensitive data from customer A was found on a hidden directory within the VM of company B. Company B is not in the same industry as company A and the two are not competitors. Which of the following has MOST likely occurred?

Options

  • ABoth VMs were left unsecured and an attacker was able to exploit network vulnerabilities to
  • BA stolen two factor token was used to move data from one virtual guest to another host on the
  • CA hypervisor server was left un-patched and an attacker was able to use a resource exhaustion
  • DAn employee with administrative access to the virtual guests was able to dump the guest memory

How the community answered

(51 responses)
  • A
    67% (34)
  • B
    10% (5)
  • C
    20% (10)
  • D
    4% (2)

Why each option

In a multi-tenant virtualized environment, VMs lacking proper network isolation allow an attacker to exploit shared network access and move data between customer environments.

ABoth VMs were left unsecured and an attacker was able to exploit network vulnerabilities toCorrect

When virtual machines are left unsecured without proper network segmentation or access controls, they share virtual network infrastructure that an attacker can exploit to access one tenant's data and write it to another tenant's VM directory. This is a classic multi-tenant cloud isolation failure where the absence of intra-host network controls enables unauthorized lateral data movement between unrelated customers.

BA stolen two factor token was used to move data from one virtual guest to another host on the

A stolen two-factor token grants access to the administrative website interface, not the ability to directly traverse VM filesystems or write data into another tenant's hidden directory at the hypervisor level.

CA hypervisor server was left un-patched and an attacker was able to use a resource exhaustion

A resource exhaustion attack on an unpatched hypervisor degrades availability and performance for all tenants, but it does not cause data from one tenant's VM to appear in an organized hidden directory within a separate tenant's VM.

DAn employee with administrative access to the virtual guests was able to dump the guest memory

An insider with admin access dumping guest memory is plausible but would produce raw binary memory artifacts, not neatly placed data in a hidden directory, and would require deliberate targeting of specific customers rather than opportunistic discovery.

Concept tested: VM isolation and multi-tenant cloud data confidentiality

Source: https://csrc.nist.gov/publications/detail/sp/800-125/final

Topics

#virtualization security#VM isolation#hypervisor attacks#cloud security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice