Examkin

Question

Difficulty: Very hardVirtualization Security Considerations and Network Configurations

A security analyst is building a virtualized malware analysis sandbox on a hypervisor host. The guest virtual machine (VM) must communicate strictly with a dedicated internal forensic logging server VM running on the same hypervisor host. The sandbox VM must be completely isolated from the host's physical network adapter, the host operating system, and the external internet to prevent malware spread or out-of-band data exfiltration. Which of the following virtual network adapter configurations and hypervisor security controls should the analyst implement?

  1. Configure the virtual network adapter to Internal/Private mode bound to a virtual switch restricted to guest VMs, and disable hypervisor guest integration features like shared folders and clipboard sharing.Answer
  2. B
    Configure the virtual network adapter to Host-Only mode, relying on the automatically assigned 169.254.x.x APIPA address to block outbound packet routing across physical network switches.
  3. C
    Configure the virtual network adapter to NAT mode with port forwarding redirected to port 443 on the hypervisor host to encrypt guest-to-server traffic.
  4. D
    Configure the virtual network adapter to Bridged mode connected to an unmanaged Layer 2 switch segment to restrict Layer 3 IP subnet traversal.

Answer

Configure the virtual network adapter to Internal/Private mode bound to a virtual switch restricted to guest VMs, and disable hypervisor guest integration features like shared folders and clipboard sharing.
Internal or Private networking mode creates a virtual switch that is completely isolated from the host operating system's network stack and physical network interface cards. Guest VMs connected to this internal switch can communicate with each other (allowing communication with the logging server VM) while remaining completely isolated from the external network and host OS. Furthermore, disabling guest integration services (like shared folders and copy-paste buffers) mitigates VM escape risks.

Step-by-Step Solution

1
Analyze network isolation requirements for malware sandboxing.
Identified that the guest VM requires inter-VM communication (to the forensic server VM) but zero access to the host OS, physical network, or internet.
Preventing malware exfiltration and host infection requires complete physical and host OS network stack isolation.
2
Evaluate hypervisor virtual networking modes.
Internal/Private virtual network mode permits packet exchange only between guest VMs on the same virtual switch, whereas Host-Only connects to the host OS, and Bridged/NAT connect to the physical network.
Internal/Private mode is the only vNIC configuration that isolates traffic completely from both the host system interface and physical network interface.
3
Evaluate hypervisor host-guest security controls.
Disabling hypervisor guest integration tools (e.g., drag-and-drop, shared folders, clipboard sharing) closes non-network VM escape channels.
Malware can leverage guest integration services to write files directly to the host storage system or memory.

Key Concept

Virtualization Network Modes and Hypervisor Isolation Security
Rate this question

Topics

Virtualization Security Considerations and Network Configurations

More questions from this topic