A university consortium operates a private cloud in its own data centre for research workloads classified as confidential. A risk assessment identifies that multiple research teams share a single management network with the hypervisor management interfaces, so a compromised research host could reach those interfaces directly. Which control best reduces the attack vector the assessment describes?
- ASegregate the hypervisor management interfaces onto an isolated management network separated from tenant workload traffic Correct
- BEnable full-disk encryption on every research host so a compromised host cannot expose stored data
- CRequire multi-factor authentication for researchers logging in to the workload virtual machines
- DDeploy a host-based intrusion detection agent on each hypervisor to alert on suspicious management commands
Why A is correct: Placing management interfaces on a dedicated, isolated network removes the lateral path from a compromised workload host to the control plane, directly addressing the stated vector.
Why B is wrong: Full-disk encryption protects data at rest, but it does nothing to stop a live compromised host from reaching management interfaces over a shared network.
Why C is wrong: Stronger workload authentication is worthwhile, but the risk is a compromised host reaching the control plane, and MFA on the workload does not sever that network path.
Why D is wrong: Detection on the hypervisor may raise an alert after the fact, but it neither removes the reachable network path nor prevents the lateral movement the assessment found.