Which threat is greatest to an organization's entire virtual infrastructure?

Why the Answer Is Correct

The virtual machine image is the reusable baseline for creating guests. When the image is not standardized, every VM may be built with inconsistent security settings, patch levels, or applications, so a single weak image can propagate risk across all systems. In CISA's virtual-infrastructure view, this is an infrastructure-wide control failure, not just a guest-level issue. Standardizing a golden image is a foundational audit expectation, making this the greatest threat among the options.

Why the Other Options Are Wrong

Inefficient change management processes (A) create operational and audit risk, but 'inefficient' does not necessarily mean controls are absent or that the entire infrastructure is exposed. Pushing changes during business hours (B) is mainly an availability and scheduling concern, not a security threat to the whole virtual stack. Using local authentication for guest systems (C) weakens identity management at the guest OS level, yet it does not by itself expose the hypervisor or all virtual machines. These risks are narrower than leaving VM images unstandardized.

Community Comment Notes

One participant, Sibsankar, initially questioned the D key with 'D is wrong, C is correct answer,' but later apologised and confirmed D. Another commenter reinforced D by pointing out that lack of image standardization has 'wide-ranging implications for security, reliability, and operational efficiency.' The discussion therefore supports the image-control rationale, while showing why guest authentication is an easy but incorrect pick.