nerdexam
CSA

CCSK · Question #116

Why do blind spots occur in a virtualized environment, where network-based security controls may not be able to monitor certain types of traffic?

The correct answer is D. Virtual machines may communicate with each other over a virtual network all on the same host. In virtualized environments, VM-to-VM traffic on the same physical host travels over a virtual network and never crosses the physical network, making it invisible to traditional network-based security controls.

Virtualization and Containers

Question

Why do blind spots occur in a virtualized environment, where network-based security controls may not be able to monitor certain types of traffic?

Options

  • AThe network stack is out of alignment
  • BClouds do not occur in networked environments
  • CTraffic is undetectable in virtual machines
  • DVirtual machines may communicate with each other over a virtual network all on the same host
  • ENone of the above

How the community answered

(52 responses)
  • A
    10% (5)
  • B
    4% (2)
  • D
    85% (44)
  • E
    2% (1)

Why each option

In virtualized environments, VM-to-VM traffic on the same physical host travels over a virtual network and never crosses the physical network, making it invisible to traditional network-based security controls.

AThe network stack is out of alignment

Network stack misalignment is not a recognized or documented cause of security monitoring blind spots in virtualized environments.

BClouds do not occur in networked environments

Cloud environments do operate within networked infrastructure; this statement is factually incorrect and irrelevant to the concept of virtualization blind spots.

CTraffic is undetectable in virtual machines

Traffic between virtual machines is not inherently undetectable; the specific issue is that it bypasses physical network security controls when it stays within the same host, not that it is fundamentally invisible.

DVirtual machines may communicate with each other over a virtual network all on the same hostCorrect

When virtual machines on the same physical host communicate via a virtual switch or internal virtual network segment, the traffic is processed entirely within the hypervisor and never reaches the physical NIC. Traditional network security controls such as IDS/IPS sensors and hardware firewalls only inspect traffic traversing physical network segments, so intra-host inter-VM communication creates a blind spot that those tools cannot monitor.

ENone of the above

Incorrect because option D accurately describes a well-documented security challenge specific to hypervisor-based virtualization.

Concept tested: VM-to-VM traffic blind spots bypassing network controls

Source: https://csrc.nist.gov/publications/detail/sp/800-125/final

Topics

#virtualization blind spots#east-west traffic#virtual networking#network monitoring

Community Discussion

No community discussion yet for this question.

Full CCSK Practice