An organization has deployed an environment that simulates hardware-level isolation for sensitive cryptographic operations. The security team believes advanced threats might gain control at the hypervisor layer and access secrets. Which measure is most effective in preventing unauthorized access to those secrets?
Deploy an extra guest to monitor hypervisor processes for anomalies
Track cryptographic events using a remote log of hypervisor activities
Keep secret material in a shared folder restricted to local administrators
Use specialized CPU extensions that store data in protected memory regions
Storing secret material in a specialized memory region that leverages CPU-based isolation keeps data out of reach of compromised hypervisor processes. Remote logging alone does not prevent direct access to secrets. Restricting keys in a shared folder is insufficient if the hypervisor is compromised. A secondary guest-based watchdog does not guarantee detection or prevention of threats at the management layer.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are CPU extensions, and how do they protect sensitive data?
Open an interactive chat with Bash
How does a hypervisor compromise threaten sensitive data?
Open an interactive chat with Bash
Why are remote logging and guest-based monitoring insufficient to protect secrets?