CISSP Security Architecture and Engineering Practice Question
An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disabling all unnecessary hypervisor services and applying security patches
Keeping the hypervisor patched and minimized reduces attack surface and addresses known vulnerabilities that could be exploited for VM escape.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disabling all unnecessary hypervisor services and applying security patches
Why this is correct
Disabling unnecessary hypervisor services significantly reduces the attack surface by removing potential entry points and unneeded code that could harbor vulnerabilities. Concurrently, applying security patches promptly addresses known flaws and exploits, preventing attackers from leveraging publicly disclosed weaknesses in the hypervisor software. This proactive combination of hardening and continuous vulnerability management is critical for maintaining the integrity and security of the virtualization layer, directly mitigating risks like VM escape.
- ✗
Using Type 2 hypervisor only
Why it's wrong here
Type 2 hypervisors, also known as hosted hypervisors, run as an application on top of a conventional operating system, such as Windows or Linux. This architecture inherently increases the attack surface because both the host OS and the hypervisor itself become potential targets for compromise. A vulnerability in the underlying host operating system could directly impact the security of all hosted virtual machines, making Type 2 hypervisors generally less secure for critical production environments compared to bare-metal Type 1 hypervisors.
- ✗
Using VLANs to isolate VM traffic
Why it's wrong here
VLANs provide network segmentation by logically separating traffic within a physical network, which is crucial for isolating different virtual machine networks from each other and controlling inter-VM communication. However, VLANs operate at Layer 2 of the OSI model and are primarily a network control mechanism. They do not offer protection against vulnerabilities within the hypervisor itself or prevent a successful VM escape attack, where a compromised VM could break out to the hypervisor layer or other VMs on the same host.
- ✗
Enabling VM snapshots for quick recovery
Why it's wrong here
VM snapshots are a valuable operational tool for creating point-in-time backups, enabling quick recovery or rollback of a virtual machine to a previous state in case of data corruption or misconfiguration. While useful for disaster recovery and testing, snapshots are a reactive measure that do not prevent security incidents like a VM escape from occurring in the first place. They do not address the underlying vulnerabilities in the hypervisor or guest operating system that could lead to a compromise or an attack.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.