Question

A cloud administrator receives reports that a physical server is having issues with its virtualized guest machines. There is a possibility that a threat actor has been successful with an attack. Which problem types does the administrator investigate?

a) VM sprawl

b) VM escape

c) VM template

d) VM monitor

Answer 1

A cloud administrator should investigate the possibility of a VM escape when virtualized guest machines on a physical server are suspected to be compromised by a threat actor, as this refers to an attacker breaching the hypervisor to gain unauthorized access.

Step-by-step explanation:

When a cloud administrator receives reports of issues with virtualized guest machines on a physical server, and there is a suspicion of a successful attack by a threat actor, the administrator should investigate several potential problems. Out of the options provided, VM escape is the most relevant concern.

A VM escape is a security breach that occurs when a hacker exploits vulnerabilities in the virtual machine monitor (VMM) or hypervisor to gain access to the host machine or other virtual machines on the same host. Such an attack could lead to unauthorized access to data and resources that are beyond the confines of the affected virtual machine.

While VM sprawl refers to the unchecked growth of VMs within a network which can lead to resource depletion, it is not directly associated with a security breach.

VM template issues typically relate to problems arising from creating multiple VMs from a single image that might have inherent flaws, but it's not in itself an exploitation technique by threat actors. Lastly, VM monitor usually pertains to the software overseeing the VMs, also known as the hypervisor or VMM, and while security issues can arise here, the term doesn't specifically describe an attack scenario like VM escape does.