CCSP Cloud Platform and Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Regularly patching and updating the hypervisor

  Why this is correct

  VM escape exploits abuse hypervisor vulnerabilities, so regularly patching and updating the hypervisor removes the flaws an attacker needs to break out of a guest. This directly mitigates the escape vector in a multi-tenant environment where one flaw could expose co-resident tenants.

• ✗

  Using host-based intrusion detection on each VM

  Why it's wrong here

  Host-based intrusion detection monitors activity inside the guest, so it cannot see hypervisor-level escapes that bypass the guest entirely. It suits detecting in-guest compromise such as rootkits or suspicious processes. Preventing VM escape requires hypervisor isolation controls, patched virtualisation layers and hardware-assisted isolation between tenants.

• ✗

  Implementing network segmentation between VMs

  Why it's wrong here

  Network segmentation separates traffic flows between VMs but does not constrain the hypervisor boundary where an escape occurs; a successful escape can reach the host regardless of subnet rules. Segmentation is the right control for limiting lateral movement after compromise, not for preventing hypervisor breakout.

• ✗

  Enforcing strong passwords on guest OS accounts

  Why it's wrong here

  Strong guest passwords protect against credential-based login to the VM's operating system, which is irrelevant once an attacker exploits a hypervisor vulnerability to break out. Password policy is appropriate for reducing brute-force and credential theft risk on guest accounts, not for containing virtualisation-layer escapes.

Go deeper

Related to this question