A new vulnerability has been announced which affects several critical VM guests, but no patch is available. Which of the following can the administrator perform to mitigate this risk prior to a patch

Installing and updating antivirus software on workstations is a general security measure for endpoints, not a direct mitigation strategy for a server-side VM guest vulnerability.

Even if a specific patch for the new vulnerability is not yet available, applying all other existing and available software patches to both VM guests and their underlying hosts is a critical security best practice. This action helps to eliminate other known vulnerabilities, harden the systems, and reduce the overall attack surface, making it more difficult for attackers to exploit the new, unpatched vulnerability.

Disabling the affected service is a valid mitigation strategy if the service is unnecessary, but applying other available patches (Option B) is a broader, more fundamental security measure that should always be performed as a general hardening step.

Clustering VM guests and implementing resource pooling are primarily for high availability and resource management, not direct mitigation for a software vulnerability.