A team installs a virtualization management console on a server with a public IP address so administrators can manage hosts from home. The console still uses the vendor's default administrator account. What should the cloud security professional recommend?
Select an answer to reveal the explanation.
Short Explanation
The management console is the master key cabinet for every host you run, so you don't hang it on the street. Lock it inside a private management network, change the factory combination, and require a second factor. Moving the port or adding TLS is just repainting the cabinet door.
Full Explanation
Management plane tools control every host, virtual network and workload beneath them, so a compromise there is a compromise of the whole environment. Secure installation means placing the console on a dedicated management network that is not reachable from the internet or from tenant networks, allowing access only through a VPN or hardened bastion host, removing or disabling vendor default accounts, binding administrator access to individual named identities, and requiring multifactor authentication with logging of every session. A nonstandard port is security through obscurity; internet-wide scanners probe all ports, and the console still accepts the default account from anywhere. Enabling TLS protects the confidentiality of sessions in transit, but it does nothing about exposure or the default credentials that attackers try first. Placing the console on a tenant workload subnet merges the management plane with the very workloads it administers, so a compromised tenant VM gains a path to the hypervisor controls; management and tenant traffic should be separated, not combined. Exam caveat: the outline frames this as installation and configuration of management plane tools, so default accounts and placement are fair game. Operational check: confirm from an external network that the console is unreachable, that the vendor default account is disabled, and that each administrator sign-in requires MFA and appears in centralized logs.