Certopolis

CompTIA A+ Core 1

Type 1 vs Type 2 hypervisors and VM snapshots for A+

A Type 1 hypervisor installs directly on the hardware; a Type 2 hypervisor runs on top of a host operating system. Most bare-metal hypervisors have their own management access controls, while hosted ones rarely do. Either way, the processor's hardware virtualization support has to be turned on in BIOS or UEFI.

Bare metal vs hosted

NIST SP 800-125A says a hypervisor can be installed directly on the hardware, or bare metal (Type 1), or on top of a full conventional operating system called the host OS (Type 2).

NIST SP 800-125 says servers are most often virtualized with bare-metal hypervisors and desktops with hosted ones. Hosted virtualization lets users run ordinary applications such as browsers alongside the hypervisor. Bare-metal systems run applications only inside guests.

Access control differs. NIST says most bare-metal hypervisors have access controls, typically a username and password for the management interface, sometimes with different levels of authorization. Hosted products rarely have hypervisor access controls: anyone who can launch an application on the host OS can run the hypervisor, so the only control is who can log on to the host.

Firmware settings a hypervisor needs

Microsoft's Hyper-V requirements include a 64-bit processor with second-level address translation (SLAT) and virtualization support turned on in the BIOS or UEFI.

That means hardware-assisted virtualization, Intel VT or AMD-V, plus hardware-enforced Data Execution Prevention (the XD bit on Intel, the NX bit on AMD).

A processor that supports virtualization will still fail the hypervisor's hardware check if the firmware setting is off.

Disk images and snapshots

A disk image is a file on the host that looks to the guest like an entire disk drive. Under hosted virtualization it appears in the host OS as a file or folder and can be copied like any other file.

A snapshot records the state of a running guest, usually as the differences between the image and the current state, including virtual storage and memory. Take one before a risky change so you can return the guest to that state.

Snapshots can hold the contents of RAM at the time they were taken, so NIST warns they may contain sensitive data.

Where the exam catches people

  • Believing a capable CPU is enough to install a hypervisor: virtualization support must also be turned on in the BIOS or UEFI.
  • Believing a Type 2 hypervisor protects guests from other users of the desktop: anyone who can log on to the host can run it.
  • Believing cloning the host's physical drive is the way to back up one guest: the guest's drive is a disk image file on the host.
  • Believing a snapshot holds only disk contents: it can include virtual memory and other state.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. Several staff share a desktop whose guest OSs run on a hypervisor installed as an application. Anyone who can log on to the desktop can start, change or delete the guests. The organization wants a hypervisor with its own management access controls. Which of the following should it use?

    Right. In the game that’s Renown for your Virtualization and Cloud Computing building.

    Not that one: B is right. In the game your Virtualization and Cloud Computing building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Most bare metal (Type 1) hypervisors do have access controls to their management interface, sometimes with different levels of authorization.

    Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-125.pdf

  2. A technician tries to add a hypervisor to a new desktop whose processor model is documented as able to host one. Setup reports that the computer does not meet the hypervisor's hardware requirements. Which of the following BIOS/UEFI settings should the technician check?

    Right. In the game that’s Renown for your Virtualization and Cloud Computing building.

    Not that one: C is right. In the game your Virtualization and Cloud Computing building would lose a little Renown, and this question would come back later.

    Written from learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/host-hardware-requirements

  3. A technician must install an untested driver update on a guest operating system and wants to be able to return the guest to its exact current state if the update causes problems. Which of the following should the technician do first?

    Right. In the game that’s Renown for your Virtualization and Cloud Computing building.

    Not that one: C is right. In the game your Virtualization and Cloud Computing building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Taking one before the update lets the technician revert the guest to the captured state if the driver causes problems.

    Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-125.pdf