16.4 Operate and Maintain Secure Virtual Environments

Why virtual-environment operations are a Domain 7 skill

Knowledge area 7.5 is Operate and maintain secure virtual environments. The outline's bullets are hypervisor (Type 1, bare metal; Type 2, software), virtual appliances, containers, continuity and resilience, storage management (data domain), and threats, attacks, and countermeasures (brute-force attack, virtual machine (VM) escape, threat hunting). Domain 7 is still 15% of the SSCP. Knowledge area 7.4 already used hypervisor and virtual private cloud (VPC) in the cloud consumption sense. This section is how you run the virtualization layer — on-premises or in IaaS — without turning one compromised guest into every guest.

Type 1 versus Type 2 versus containers

A hypervisor multiplexes a physical host into virtual machines, each with its own kernel. Type 1 (bare metal) is the hypervisor as the host's primary operating environment: VMware ESXi, Microsoft Hyper-V Server, Xen, and kernel-based virtual machine (KVM) deployments used as the host. Type 2 (hosted / software) is a hypervisor application on a general-purpose operating system: VMware Workstation, Oracle VirtualBox, Parallels. Production server farms use Type 1. Analyst laptops and labs often use Type 2. A Type 2 stack inherits every vulnerability of the underlying desktop operating system plus the hypervisor.

Containers (Docker, containerd, Kubernetes pods) package processes with namespaces and control groups (cgroups). They share the host kernel. That is the exam distinction.

You can run containers inside VMs. That is common and does not turn the container into Type 1. If the stem needs strong isolation between untrusted tenants, answer VMs on a Type 1 host (and do not mix those tenants on one host). If the stem is deploy twelve copies of the same service with less overhead, answer containers — then still harden the shared kernel.

Virtual appliances

A virtual appliance is a pre-built virtual machine (often an Open Virtualization Appliance (OVA) or vendor image) that delivers a function: firewall, web application firewall (WAF), security information and event management (SIEM) collector, load balancer, backup proxy. Treat it as an appliance, not as a pet Linux box:

• Change default credentials on first boot. Internet-facing appliances with vendor defaults are brute-force bait.
• Patch on the vendor's cadence. An unpatched virtual firewall is a virtual hole.
• Place it on the correct virtual network / security groups. A SIEM collector with a management interface on the user VLAN is a gift.
• Do not turn a firewall appliance into a jump box, file share, or developer sandbox. Extra packages expand the attack surface the vendor did not test.
• Clock, certificates, and logging must match the rest of the estate or the appliance becomes a blind spot.

Continuity, resilience, and storage management (data domain)

Continuity and resilience for virtual environments are high availability, live migration, clustered hosts, and tested recovery — the Domain 4 metrics (recovery time objective (RTO), recovery point objective (RPO)) still apply.

• Host high availability restarts a VM on another host after hardware failure. That is not a backup. It will happily restart a ransomware-encrypted guest.
• Live migration and stretched clusters need management-plane authentication and encrypted vMotion-class channels. An attacker on the migration network is an integrity problem.
• Snapshots are rollback points, not backups. They usually live on the same datastore, they bloat, and they are deleted by the same administrator role that the attacker just stole.

Storage management (data domain) means grouping storage by purpose and trust, not dumping every virtual disk on one logical unit number (LUN):

A dedicated backup appliance (including products historically branded Data Domain) is one implementation of a backup data domain. The exam cares that backup storage is a different domain with different credentials, replication, and immutability — not the brand name.

Thin provisioning, datastore overcommit, and snapshot chains are availability risks as well as storage risks. Monitor capacity so a snapshot storm does not take production offline.

Threats, attacks, and countermeasures

The outline's examples are brute-force attack, virtual machine escape, and threat hunting.

Scenario (VM escape on a shared host). You operate a Type 1 cluster. A lab VM used for malware detonation sits on the same host as the EHR application server because capacity was tight. EDR in the lab VM is chaotic; hypervisor logs then show a process on the host that should not exist, and a sibling VM's virtual NIC counters spike. Treat this as VM escape (or a serious hypervisor integrity event), not as a noisy lab guest:

1. Isolate the physical host (and therefore every guest on it). Maintenance mode, disconnect from production networks, preserve memory and logs. Rebooting only the lab VM is not containment.
2. Assume every guest on that host is in-scope — including the EHR server. Rotate credentials those guests could reach. This is why mixed-trust collocation is an exam wrong answer.
3. Patch and harden the hypervisor; disable the extra virtual hardware the lab needed (USB passthrough, nested virtualization) on production hosts.
4. Threat hunt the rest of the cluster for the same hypervisor process, unexpected snapshots, and cloned disks leaving the backup domain.
5. Rebuild lab detonation on isolated hosts that never share a hypervisor with production. Density is not a reason to collocate unlike trust.

Threat hunting in 7.5 is the virtualization-specific hunt: management API anomalies, new resource pools, disabled logging, privileged Kubernetes workloads, and backup-domain deletions. It uses the same behavior analytics idea as knowledge area 7.1, aimed at the hypervisor and control plane rather than a user's mailbox.

Exam traps. Calling Type 2 appropriate for multi-tenant production because the laptop is patched. Calling containers a Type 1 hypervisor. Treating snapshots as backups. Collocating a malware lab with production and then rebooting only the lab VM after escape. Exposing vCenter to the internet and calling MFA optional because the hypervisor is Type 1.

When a CAT item names 7.5, pick the boundary the stem actually broke: Type 1 versus Type 2 versus shared kernel, appliance hygiene, a separate backup data domain, or isolate-the-host after VM escape.