Question

An engineer is assisting with the design of a new virtualized environment that will house critical company services and reduce the datacenter's physical footprint. The company has expressed concern about the integrity of operating systems and wants to ensure a vulnerability exploited in one datacenter segment would not lead to the compromise of all others.

Which of the following design objectives should the engineer complete to BEST mitigate the company's concerns? (Choose two.)

A. Deploy virtual desktop infrastructure with an OOB management network
B. Employ the use of vTPM with boot attestation
C. Leverage separate physical hardware for sensitive services and data
D. Use a community CSP with independently managed security services
E. Deploy to a private cloud with hosted hypervisors on each physical machine

Answer 1

To mitigate concerns about system integrity and vulnerability spread, the engineer should employ vTPM with boot attestation and leverage separate physical hardware for sensitive services, providing security at both the virtual and physical levels. so, option B and C are the correct options.

Step-by-step explanation:

To best mitigate the company's concerns about ensuring the integrity of operating systems and preventing the spread of vulnerabilities across datacenter segments, the engineer should focus on two key design objectives:

1. Employ the use of vTPM (Virtual Trusted Platform Module) with boot attestation - This technology provides hardware-level security for virtual machines. By using vTPM, each virtual machine has its own unique, encrypted keys, which helps in protecting the VMs from unauthorized access and ensures a secure boot process. Boot attestation further ensures that the VM starts in a trustworthy state, making it more difficult for an attacker to compromise the system.
2. Leverage separate physical hardware for sensitive services and data - While virtualization optimizes physical space and resource utilization, there can be risks if all services are on shared hardware. By dedicating separate hardware to sensitive services, the engineer can create physical isolation, thus effectively providing an additional layer of security and mitigating the risk of a single point of failure or a widespread compromise due to a single vulnerability.

Options such as deploying a virtual desktop infrastructure or using a community CSP with separately managed security services may have benefits, but they do not directly address the concern of keeping critical services and data segregated to the extent that the above options do. Deploying to a private cloud with hosted hypervisors does provide some isolation but may not fully prevent a compromised system from affecting others on the same physical hardware.