A provider discloses a vulnerability in its hypervisor that could allow code running in one guest virtual machine to read the memory of another tenant's guest on the same host. What is the core risk, and what is the primary safeguard?
Select an answer to reveal the explanation.
Short Explanation
Think of the hypervisor as the walls between hotel rooms; a crack lets one guest peek into the next room. That's a VM escape, and you fix the wall, not the door locks inside each room. The trap is guest-level controls like MFA, which can't stop someone climbing through the wall.
Full Explanation
The hypervisor enforces isolation between virtual machines on a shared host, so a flaw that lets one guest read another guest's memory is a VM escape or cross-tenant isolation failure. The impact can be severe because an attacker who rents a guest on the same host could reach other tenants' secrets without ever authenticating to their systems. The primary safeguard is at the layer where the flaw sits: prompt patching of the hypervisor, minimal and hardened hypervisor configuration, and monitoring for anomalous guest behavior. In public cloud the provider performs this work, and customers verify it through disclosures, attestations and contractual commitments. Account hijacking involves stolen credentials and is mitigated by multifactor authentication, but an isolation flaw bypasses authentication entirely. Data remanence concerns residual data on storage after deletion, which crypto-shredding addresses, whereas this flaw exposes live memory. Denial of service between tenants is the noisy-neighbor problem handled by resource quotas, which do not stop memory disclosure. Exam caveat: hardware side-channel flaws can produce similar cross-tenant exposure and are mitigated through firmware, microcode and scheduling changes. Operational check: confirm the provider's advisory states remediation is complete for the affected hosts and record the evidence in the risk register.