CISSP Security Architecture and Engineering Practice Question
A cloud service provider uses a Type 1 hypervisor to host multiple virtual machines (VMs) for different customers. Which of the following is a primary security concern specific to this architecture?
⚠ Common exam trap
CISSP often tests the difference between security and operational concerns; candidates may pick performance or patching issues, but the question asks for a primary security concern specific to Type 1 hypervisor architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual machine escape from one guest to the hypervisor or other guests
A Type 1 hypervisor runs directly on the host hardware, and a VM escape vulnerability allows an attacker in a guest VM to break out and access the hypervisor or other guests, compromising the entire host. This is a primary security concern because it breaks the isolation boundary that multi-tenancy relies on.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Virtual machine escape from one guest to the hypervisor or other guests
Why this is correct
Virtual machine escape is a critical security vulnerability where an attacker breaks out of the confines of a guest operating system to gain unauthorized access to the hypervisor or other virtual machines. This breach compromises the fundamental isolation provided by the hypervisor, potentially allowing an attacker to control the host system or access sensitive data across multiple tenants. It represents a severe failure of the hypervisor's security mechanisms, making it a top concern for cloud providers.
- ✗
Inability to patch the hypervisor without downtime
Why it's wrong here
The inability to patch a Type 1 hypervisor without incurring downtime is primarily an operational and availability challenge, not a direct security vulnerability itself. While unpatched systems can certainly lead to security risks, the *process* of patching requiring a reboot impacts service continuity rather than directly compromising confidentiality or integrity. This concern focuses on system availability and maintenance windows, distinguishing it from direct security exploits.
- ✗
Performance degradation due to resource sharing
Why it's wrong here
Performance degradation stemming from resource sharing is an operational management concern focused on quality of service and user experience, rather than a direct security threat. While poor performance can indirectly impact availability by making services unusable, it does not inherently lead to unauthorized access, data breaches, or system compromise. This issue is typically addressed through resource allocation policies, monitoring, and capacity planning.
- ✗
Lack of support for legacy operating systems
Why it's wrong here
The lack of support for legacy operating systems is not a primary security concern or an inherent limitation specific to Type 1 hypervisors. Many modern hypervisors are designed to support a wide range of guest operating systems, including older versions, for compatibility purposes. This issue, when it arises, is more often related to the specific guest OS's own vulnerabilities or the end-of-life status of the software, rather than a fundamental security flaw in the hypervisor architecture itself.
Go deeper
Related to this question
Learn chapter
Security Architecture and Models
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.