Which of the following has MOST likely occurred?

A company provides on-demand virtual computing for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for access to sensitive data. The security administrator at the company has uncovered a breach in data confidentiality. Sensitive data was found on a hidden directory within the hypervisor.

Which of the following has MOST likely occurred?
A . A stolen two factor token and a memory mapping RAM exploit were used to move data from one virtual guest to an unauthorized similar token.
B . An employee with administrative access to the virtual guests was able to dump the guest memory onto their mapped disk.
C . A host server was left un-patched and an attacker was able to use a VMEscape attack to gain unauthorized access.
D . A virtual guest was left un-patched and an attacker was able to use a privilege escalation attack to gain unauthorized access.

View Answer

Answer: C