A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user's access to data files?

The VM monitor (hypervisor) audit logs track hypervisor-level events such as VM creation, deletion, and resource allocation, not user-level file access within individual guest operating systems.

Guest OS access controls define permissions and policies for who can access files, but they do not provide an audit trail or log of actual access events that have already occurred.

Host VM access controls govern who can manage the hypervisor and virtual machine configurations, not who accessed data files within a specific guest OS.

In a virtualized environment with strong isolation, each guest OS operates independently and maintains its own audit logs for file and resource access. Since data files live within the guest OS filesystem, only the guest OS audit logs capture user-level file access events such as reads, writes, and permission changes. The hypervisor has no visibility into file-level operations occurring inside the guest.