CISSP · Question #846
If compromised, which of the following would lead to the exploitation of multiple virtual machines?
The correct answer is B. Virtual machine monitor. The Virtual Machine Monitor (VMM), also known as a hypervisor, manages all virtual machines on a host, making its compromise catastrophic across all hosted VMs.
Question
If compromised, which of the following would lead to the exploitation of multiple virtual machines?
Options
- AVirtual device drivers
- BVirtual machine monitor
- CVirtual machine instance
- DVirtual machine file system
How the community answered
(26 responses)- B92% (24)
- C4% (1)
- D4% (1)
Why each option
The Virtual Machine Monitor (VMM), also known as a hypervisor, manages all virtual machines on a host, making its compromise catastrophic across all hosted VMs.
Virtual device drivers operate within individual VMs or at the host level for specific devices, and their compromise would typically affect only the specific device or VM they serve, not all VMs simultaneously.
The Virtual Machine Monitor (VMM) or hypervisor sits between the physical hardware and all virtual machines, controlling and managing every VM on the host. If compromised, an attacker gains privileged access to all VMs running on that hypervisor, enabling VM escape attacks, data theft, and full control over the entire virtualized environment. This single point of control makes the VMM the highest-impact target in a virtualized infrastructure.
A virtual machine instance is a single, isolated VM, so compromising it would affect only that specific instance rather than providing access to multiple other VMs on the host.
A virtual machine file system stores the disk image of a single VM, and its compromise would impact only the data within that one VM's file system, not other VMs on the same host.
Concept tested: Hypervisor security and VM escape risk
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/hypervisor
Topics
Community Discussion
No community discussion yet for this question.