CISSP Security Architecture and Engineering Practice Question
A company is deploying a hypervisor to run multiple virtual servers. To minimize the risk of VM escape attacks, which type of hypervisor should they choose and what hardening measure is most effective?
⚠ Common exam trap
CISSP often tests the assumption that 'patching alone' or 'a firewall' mitigates VM escape — candidates miss that the hypervisor type and attack-surface reduction are the primary controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Type 1 hypervisor with minimal services and regular patching
A Type 1 (bare-metal) hypervisor runs directly on the hardware with a much smaller attack surface than a Type 2 hypervisor, which sits atop a general-purpose host OS full of exploitable services. Minimizing installed services and applying regular patches further shrinks the attack surface and closes known VM-escape vulnerabilities. Together, these are the most effective mitigations for VM escape risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Type 1 hypervisor with minimal services and regular patching
Why this is correct
A Type 1 hypervisor, also known as a bare-metal hypervisor, runs directly on the host hardware, significantly reducing the attack surface by eliminating the need for an underlying general-purpose operating system. Implementing minimal services further restricts potential entry points for attackers. Regular patching is critical to address known vulnerabilities, including hypervisor escape flaws, ensuring the integrity and isolation of virtual machines.
- ✗
Type 2 hypervisor with regular patching
Why it's wrong here
A Type 2 hypervisor operates as an application atop a full host operating system, which inherently introduces a substantially larger attack surface compared to a Type 1 hypervisor. Even with diligent regular patching, the underlying host OS, its drivers, and other installed applications present numerous additional vectors for compromise. An attacker could exploit vulnerabilities in the host OS to gain control, potentially impacting the hypervisor and its guest virtual machines.
- ✗
Type 2 hypervisor with host-based firewall
Why it's wrong here
While a host-based firewall can restrict network access to the Type 2 hypervisor's underlying operating system, it does not address the fundamental security weakness of its architecture. A Type 2 hypervisor's reliance on a full host OS means that vulnerabilities within the OS itself, its applications, or local exploits remain potential attack vectors. The firewall provides perimeter defense but cannot mitigate internal OS compromises or hypervisor escape attempts originating from a compromised host.
- ✗
Type 1 hypervisor with no additional hardening
Why it's wrong here
Deploying a Type 1 hypervisor without any additional hardening measures leaves it susceptible to various security risks, despite its inherently smaller attack surface. Default configurations often include unnecessary services, weak authentication settings, or unoptimized security parameters that can be exploited. Without proper hardening, such as disabling unused ports, implementing strong access controls, or configuring secure boot, the system remains vulnerable to targeted attacks, including hypervisor escape.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.