Question

During a security review of an IaaS environment, an analyst discovers dozens of running virtual machines that no team claims ownership of. Several are missing from the configuration management database, are running outdated OS images, and have no assigned patching schedule. The security team is concerned about the risk these systems pose. Which infrastructure risk does this situation MOST directly represent, and what is the primary security consequence?

Accepted Answer

VM sprawl, which expands the attack surface with unmanaged, unpatched instances that evade normal security controls

Answer

Resource pooling failure, which causes noisy-neighbor performance degradation across tenants

Answer

Hypervisor escape, which allows an attacker to break out of a guest VM into the host

Answer

Vendor lock-in, which prevents the organization from migrating workloads to another provider