CISSP Security Architecture and Engineering Practice Question
An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?
⚠ Common exam trap
CISSP often tests the distinction between preventive controls that address the root cause (hypervisor hardening/patching) and compensating or detective controls (VLANs, snapshots) that candidates mistakenly select as 'most effective' for VM escape.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disabling all unnecessary hypervisor services and applying security patches
Disabling unnecessary hypervisor services reduces the attack surface available to a guest attempting VM escape, and applying hypervisor security patches closes known vulnerabilities (e.g., VENOM, CVE-2015-3456) that allow guest-to-host breakout. Since the hypervisor is the isolation boundary between VMs and the host, hardening and patching it directly addresses the escape vector. This is the most effective preventive control because it targets the root cause rather than the symptoms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disabling all unnecessary hypervisor services and applying security patches
Why this is correct
Disabling unnecessary hypervisor services significantly reduces the attack surface by removing potential entry points and unneeded code that could harbor vulnerabilities. Concurrently, applying security patches promptly addresses known flaws and exploits, preventing attackers from leveraging publicly disclosed weaknesses in the hypervisor software. This proactive combination of hardening and continuous vulnerability management is critical for maintaining the integrity and security of the virtualization layer, directly mitigating risks like VM escape.
- ✗
Using Type 2 hypervisor only
Why it's wrong here
Type 2 hypervisors, also known as hosted hypervisors, run as an application on top of a conventional operating system, such as Windows or Linux. This architecture inherently increases the attack surface because both the host OS and the hypervisor itself become potential targets for compromise. A vulnerability in the underlying host operating system could directly impact the security of all hosted virtual machines, making Type 2 hypervisors generally less secure for critical production environments compared to bare-metal Type 1 hypervisors.
- ✗
Using VLANs to isolate VM traffic
Why it's wrong here
VLANs provide network segmentation by logically separating traffic within a physical network, which is crucial for isolating different virtual machine networks from each other and controlling inter-VM communication. However, VLANs operate at Layer 2 of the OSI model and are primarily a network control mechanism. They do not offer protection against vulnerabilities within the hypervisor itself or prevent a successful VM escape attack, where a compromised VM could break out to the hypervisor layer or other VMs on the same host.
- ✗
Enabling VM snapshots for quick recovery
Why it's wrong here
VM snapshots are a valuable operational tool for creating point-in-time backups, enabling quick recovery or rollback of a virtual machine to a previous state in case of data corruption or misconfiguration. While useful for disaster recovery and testing, snapshots are a reactive measure that do not prevent security incidents like a VM escape from occurring in the first place. They do not address the underlying vulnerabilities in the hypervisor or guest operating system that could lead to a compromise or an attack.
Go deeper
Related to this question
Learn chapter
Access Control Models and Mechanisms
Key term
Preventive control
A preventive control is a security measure designed to stop unauthorized access, attacks, or errors before they can occur.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.