easyMultiple Choice
350-401 Practice Question: A network team is planning to migrate from a Type…
A network team is planning to migrate from a Type 2 hypervisor to a Type 1 hypervisor for their production VMs. They need to understand the architectural impact. Which statement correctly describes a key difference between Type 1 and Type 2 hypervisors?
⚠ Common exam trap
Cisco often tests the misconception that Type 2 hypervisors are more secure due to an additional OS layer, but the trap here is that the extra layer actually increases the attack surface and reduces security isolation compared to a Type 1 hypervisor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.
Type 1 hypervisors (bare-metal) run directly on the physical hardware without an underlying operating system, providing direct access to hardware resources and better performance. Type 2 hypervisors (hosted) run as an application on top of a host operating system, which introduces additional overhead and resource contention. This architectural difference is fundamental to understanding virtualization performance and isolation in production environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.
Why this is correct
Type 1 hypervisors, also known as bare-metal hypervisors, run directly on the host hardware without an underlying operating system; the hypervisor itself acts as the resource manager and scheduler. Type 2 hypervisors, by contrast, are applications installed on top of a general-purpose host OS, which mediates all hardware access. This fundamental split drives most other differences in performance, security, and management.
- ✗
Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.
Why it's wrong here
This statement reverses the reality of hypervisor driver architecture. Type 1 hypervisors include their own built-in drivers or rely on a small, dedicated partition (such as the Service VM in VMware ESXi) to interact with physical devices without needing a full host OS. Type 2 hypervisors, such as Oracle VirtualBox or VMware Workstation, depend entirely on the host OS device drivers to access hardware like NICs and storage controllers, so the claim that Type 1 requires a host OS for drivers is false.
- ✗
Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.
Why it's wrong here
The extra OS layer in a Type 2 hypervisor actually broadens the attack surface: a compromise of the host OS can expose all guest VMs, and the host OS must be patched and hardened separately. Type 1 hypervisors run directly on hardware with a much smaller code base and no general-purpose OS beneath, which often reduces exploitable vectors and is a reason they are preferred in multi-tenant data centers. Therefore, stating Type 2 is 'always more secure' is not only unsupported but generally the opposite in practice.
- ✗
Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.
Why it's wrong here
Hardware passthrough, such as SR-IOV for NICs and GPU passthrough via VT-d/AMD-Vi, is supported by both Type 1 and Type 2 hypervisors. However, Type 1 hypervisors can perform direct device assignment with very low overhead because there is no intervening host OS to interrupt the I/O path, while Type 2 hypervisors must coordinate with the host OS, adding latency and complexity. This makes the claim that only Type 2 can support passthrough incorrect; Type 1 typically handles it more efficiently.
Go deeper
Related to this question
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.