CCSK · Question #116
Why do blind spots occur in a virtualized environment, where network-based security controls may not be able to monitor certain types of traffic?
The correct answer is D. Virtual machines may communicate with each other over a virtual network all on the same host. In virtualized environments, VM-to-VM traffic on the same physical host travels over a virtual network and never crosses the physical network, making it invisible to traditional network-based security controls.
Question
Why do blind spots occur in a virtualized environment, where network-based security controls may not be able to monitor certain types of traffic?
Options
- AThe network stack is out of alignment
- BClouds do not occur in networked environments
- CTraffic is undetectable in virtual machines
- DVirtual machines may communicate with each other over a virtual network all on the same host
- ENone of the above
How the community answered
(52 responses)- A10% (5)
- B4% (2)
- D85% (44)
- E2% (1)
Why each option
In virtualized environments, VM-to-VM traffic on the same physical host travels over a virtual network and never crosses the physical network, making it invisible to traditional network-based security controls.
Network stack misalignment is not a recognized or documented cause of security monitoring blind spots in virtualized environments.
Cloud environments do operate within networked infrastructure; this statement is factually incorrect and irrelevant to the concept of virtualization blind spots.
Traffic between virtual machines is not inherently undetectable; the specific issue is that it bypasses physical network security controls when it stays within the same host, not that it is fundamentally invisible.
When virtual machines on the same physical host communicate via a virtual switch or internal virtual network segment, the traffic is processed entirely within the hypervisor and never reaches the physical NIC. Traditional network security controls such as IDS/IPS sensors and hardware firewalls only inspect traffic traversing physical network segments, so intra-host inter-VM communication creates a blind spot that those tools cannot monitor.
Incorrect because option D accurately describes a well-documented security challenge specific to hypervisor-based virtualization.
Concept tested: VM-to-VM traffic blind spots bypassing network controls
Source: https://csrc.nist.gov/publications/detail/sp/800-125/final
Topics
Community Discussion
No community discussion yet for this question.