SY0-701 Question 95
Single answerVirtualization: Virtual machine (VM) escape , Resource reuseA cloud operations team hosts multiple customers on the same virtualization cluster. After a security review, the team identifies two risks: a vulnerable hypervisor could allow a compromised guest VM to interact with the host, and decommissioned VMs might expose residual customer data when storage is reassigned to new tenants. Which action would BEST address both risks?
- A
Keep tenant VMs on separate VLANs and enable port security on the virtual switches
- B
Apply hypervisor security patches promptly and sanitize VM storage before reallocation
- C
Increase CPU and memory reservations for sensitive VMs and disable dynamic resource scheduling
- D
Install host-based antivirus inside each guest VM and require full-disk encryption for user files
Show answer and explanation
Correct answer: B
Explanation
The scenario combines two distinct virtualization risks. VM escape occurs when a process in a guest VM exploits the virtualization layer to access the host or other guests. The most effective mitigation is to harden and patch the hypervisor and associated management plane, following vendor guidance and established vulnerability management practices. Resource reuse refers to the risk of data remanence when storage, memory, or other resources are reassigned without proper clearing. In practice, organizations address this with secure sanitization procedures for deprovisioned virtual disks, snapshots, and underlying storage before reassignment. This aligns with common best practices from virtualization vendors and NIST guidance on media sanitization, such as NIST SP 800-88, as well as general platform-hardening recommendations for hypervisors and cloud environments.
- A. Incorrect.
This is incorrect. VLAN separation and port security help reduce network-based attacks between systems, but they do not directly mitigate VM escape caused by a vulnerable hypervisor. They also do not address resource reuse, which involves residual data remaining on virtual disks or storage blocks after a VM is decommissioned.
- B. Correct.
This is correct. VM escape is primarily mitigated by maintaining a secure, fully patched hypervisor and limiting exposure to known hypervisor vulnerabilities. Resource reuse is addressed by sanitizing or securely wiping virtual storage before it is reassigned, preventing a new tenant from recovering residual data. These are the most direct controls for the two risks described.
- C. Incorrect.
This is incorrect. CPU and memory reservations are performance and availability controls, not primary security controls for VM escape or data remanence. Disabling dynamic resource scheduling may change workload placement, but it does not prevent a guest from exploiting a hypervisor flaw or stop residual data exposure when storage is reused.
- D. Incorrect.
This is incorrect. Antivirus inside guest VMs may detect some malware, but it does not protect the hypervisor itself from escape vulnerabilities. Full-disk encryption for user files can reduce data exposure in some cases, but it does not replace proper media sanitization when virtual disks or storage are reallocated, especially if the platform reuses storage blocks or snapshots improperly.