Study Guide
Virtual Machines
Using software-based computers as repeatable environments for learning and testing.
Lesson 4.4 Network & Infrastructure Security
Security learning often needs a computer you can experiment on, break and rebuild without risking the one you rely on. This lesson works out what such a computer would need to be, how its network connection decides what it can reach, and why separating it from the real computer is useful but never absolute.
Stage: Think
A computer to break
Think it through
You want to practise on a computer you can break and rebuild freely, but you have only the laptop you use every day. What would you need?
- Hint 1: Could a computer exist as a program?
Show what happens
A second computer that exists only as software inside the laptop, with its own operating system, which you can wipe or restore without touching the real one.
Think it through
Show the answer
Answer: B. From the laptop they run on.
From the laptop: every virtual computer shares the host’s real processor and memory, so giving one more leaves less for the others.
Stage: Explain
The idea
Think of a building divided into flats. There is one building, with one supply of water and electricity. Each flat has its own front door, and each tenant lives as if the flat were a house of their own. A caretaker shares out the water and power and keeps the tenants out of each other’s flats.
A virtual machine works the same way.
- The host is the building: the real, physical computer, with its processor, memory, storage and network connection.
- A virtual machine (VM) is a flat: a complete computer that exists only as software inside the host. It has its own operating system, called the guest operating system, which behaves as if it had a computer to itself.
- The hypervisor is the caretaker: the software that creates the virtual machines, shares the host’s real resources between them and keeps them apart.
So a Windows laptop can run a Linux virtual machine in a window, without Windows being replaced or changed. The Linux guest sees what looks like its own disk and its own network card. In reality its “disk” is a large file on the laptop, and its network card is provided by the hypervisor.
The building has only so much water. Giving a VM four processors’ worth of work or eight gigabytes of memory does not create any: every guest is sharing what the host really has.
Think it through
Walls between flats are solid. What might open a door between a virtual machine and its host?
- Hint 1: How might you move a file from the guest to the host?
Show what happens
Anything set up to connect them: a shared folder, a shared clipboard or a network path. The separation is made of software, and it can be deliberately opened.
Where the comparison stops. Walls between flats are solid. The separation between a VM and its host is made of software, and it can be deliberately opened, for example by sharing a folder between them. The step on the limits of isolation returns to this.
Host, hypervisor and guest
Original conceptual illustration of hosted virtualisation: each layer runs on the one below it, down to the physical resources. This is not an installation record or an exact product architecture.
Guest: Linux and its applications
The learner works inside Linux. It sees a virtual processor, memory, disk and network card, rather than owning the entire laptop.
runs on
Hosted virtualisation: hypervisor and host OS
The virtualisation platform manages the guest and works with the Windows host operating system and its services to use physical resources.
runs on
Physical host: laptop hardware
The processor (CPU), memory (RAM), storage and network hardware support both the host workload and the guest. They remain finite, shared resources.
Check your understanding
Show the answer
Answer: C. The hypervisor.
The hypervisor: it shares out the host’s resources and keeps the guests apart.
Hypervisors come in two kinds.
- A Type 1 hypervisor runs directly on the computer’s hardware, with no ordinary operating system underneath it. It is what data centres use.
- A Type 2 hypervisor is a program installed on an ordinary operating system such as Windows, like any other application. It is what a learner uses on a laptop, and it is the kind shown in the stack diagram.
The two types are a useful first sorting. Some real products blur the line.
Stage: Predict
Why it is useful for learning
VMs are environments for practising Linux, testing tools and running authorised learning activities. A VM can often be rebuilt or restored more easily than a physical machine, making experiments more repeatable. A snapshot, where supported, can capture a state to return to, but is not a substitute for an independent backup: losing the host storage may lose both the VM and its snapshots.
Check your understanding
Show the answer
Answer: B. The host’s disk failing.
A failure of the host’s storage, where the VM and its snapshots usually both live. A backup needs to be independent.
Fictional learning scenario: planning a Linux environment
Think it through
A laptop has 16 GB of memory. How much would you give a practice VM, and what happens if you give it 14 GB?
- Hint 1: What does the host still need to run?
Show what happens
Something modest, such as 4 GB, leaving most for the host. With 14 GB the host would be starved, and both would become unusable. The scenario that follows plans this and five other decisions.
Maya is a fictional learner. She has a Windows laptop with 16 GB of memory and wants to practise basic Linux commands without changing Windows. She plans the virtual machine before creating anything.
- Decide what it is for. Moving around folders and creating, copying and deleting practice files. Nothing she cares about will be stored in it, and she will not connect it to anyone else’s systems.
- Check what the laptop can spare. With 16 GB of memory, she gives the guest 4 GB and leaves 12 GB for Windows. Giving the guest 14 GB would starve Windows and make both unusable. She also checks that there is 25 GB of free disk space for the guest’s virtual disk.
- Choose the software and the installer. She picks a Type 2 hypervisor, and downloads the Linux installer from the Linux distribution’s own website, not from a file-sharing site.
- Create the machine, then install Linux in it. Creating a virtual machine gives an empty computer. Linux still has to be installed on its virtual disk, exactly as it would on a real one.
- Decide on networking deliberately. Practising file commands needs no network at all, so she could leave the virtual network card disconnected. She wants to install updates, so she chooses a mode that lets the guest reach the internet without being reachable from it. The next section explains the modes.
- Take a snapshot before experimenting. A snapshot records the machine’s state at that moment, so that a mistake can be undone by going back to it.
The result: a Linux computer she can break and rebuild in minutes, sharing a laptop that still runs Windows normally. Each decision followed from the purpose in step 1, which is why the purpose comes first.
Separation from the main operating system is useful, but it is not a guarantee that an experiment cannot affect anything else.
Stage: Predict
Networking modes and their consequences
Think it through
Show the answer
Answer: B. What must it reach?
What the guest must reach for the activity. The mode should give it that and no more.
A virtual NIC connects the guest to a virtual network. Its mode affects reachability; it does not decide whether an activity is authorised. The following are common patterns, with precise behaviour depending on the platform, host and configuration.
On narrow screens, focus the table and use the arrow keys or swipe to read across.
| Mode | Typical communication | Decision and limitation |
|---|---|---|
| NAT | The guest uses a virtual private network with outbound traffic translated through the host’s connectivity. | Often convenient for updates. It does not automatically make the guest safe: permitted outbound connections can still reach other systems, and inbound forwarding may be configured. |
| Bridged | The guest participates on the host’s connected LAN, subject to the platform and network configuration. | Useful when direct LAN communication is intended. The guest may be reachable by other LAN devices and needs appropriate patching, firewall rules and authorisation. |
| Host-only | A restricted virtual network commonly connects the host and guests, without an external route by default. | Useful for a local exercise, but not isolation from the host or other attached guests. Routing, additional NICs or host configuration can change its reach. |
| Disconnected NIC | The virtual NIC has no active network connection. | Useful for offline practice. Shared folders, clipboard integration or other channels can still connect host and guest. |
For the address translation mechanism, see IP forwarding and NAT/PAT. For VLANs, see Switch Ports, VLANs and 802.1Q Trunks. A virtual network mode is not the same thing as an Ethernet VLAN or a complete security policy; Firewalls, Traffic Filtering and Segmentation explains what enforces a policy.
Think it through
Show the answer
Answer: C. Bridged.
Bridged: the guest joins the home network as a device of its own, so it then needs the same care as any other device there.
Maya, the fictional learner from the planning scenario, plans three different activities:
- Practising file commands offline. No network is needed, so a disconnected virtual NIC is the simplest choice.
- Installing updates. The guest needs to reach the internet. NAT mode usually provides that without placing the guest directly on the home network.
- Testing a web server that another home device must reach. Bridged mode would make the guest a device on the home LAN. It would then need the same care as any other device there: patching, a host firewall and only the services that are needed.
Each choice gives the guest the reach it needs and no more, the same idea as least privilege applied to network paths.
Stage: Predict
A two-VM security lab
Network modes matter most when one VM is meant to examine another. Consider a small VirtualBox lab with two machines:
Think it through
You need a testing machine that can get updates and reach a deliberately vulnerable target, and the target must never reach the internet. How many network adapters would each machine need, and in which modes?
- Hint 1: Which machine has two jobs?
Show what happens
The testing machine needs two, one with internet access and one on a private lab network; the target needs only the private one. This lab is built that way.
- Kali Linux, the security-testing machine, with Adapter 1 set to NAT, to give it internet access, and Adapter 2 set to Host-only Adapter, to let it communicate with the lab target.
- Metasploitable, a deliberately vulnerable target, with one adapter set to Host-only Adapter and nothing else.
The adapter settings of the two machines. Addresses are deliberately not shown.
Internet
Reached through the host computer’s own connection
- NAT (outbound, translated by VirtualBox)
Kali Linux VM
Security-testing machine
- Adapter 1NATInternet access
- Adapter 2Host-onlyReaches the lab network
- Adapter 2 · host-only
Host-only network
The isolated local lab network: the host and the VMs attached to it
- Adapter 1 · host-only
Metasploitable VM
Deliberately vulnerable target
No NAT or bridged adapter, so no direct path to the internet
- Adapter 1Host-onlyLab network only
Kali is attached to two networks, but it is not a router between them unless forwarding is deliberately enabled and configured.
NAT and host-only in this lab
In VirtualBox, a NAT adapter lets a VM start connections out to the internet through the host’s own connection, with VirtualBox translating the VM’s traffic. Systems on the internet do not normally get a direct inbound path to that VM just because NAT is enabled; port-forwarding rules, if someone adds them, change that.
A host-only network is a virtual network intended for communication between the host and the VMs attached to it. It does not provide ordinary internet access by itself. That is why Metasploitable, with only a host-only adapter, can talk to Kali but has no direct route to the internet.
Why this topology is sensible
- Kali has two jobs. It may need the internet for legitimate reasons, such as updates and documentation, and it needs to reach the lab target. One adapter serves each job.
- Metasploitable must stay contained. It is deliberately vulnerable. It should never be exposed to the public internet, to an untrusted LAN, such as a shared or public network, or to a production network, where its weaknesses could be found and used by someone else, or used as a stepping stone to other systems.
- The shared network is small and known. Only the host and the lab VMs are on it, so testing traffic stays inside the lab.
Two adapters do not make a router
A machine connected to two networks does not automatically pass traffic between them. Forwarding packets from one interface to another, as a router does, has to be enabled and configured deliberately. Kali having a NAT adapter and a host-only adapter therefore does not, by itself, give Metasploitable a path to the internet.
Host-only also has limits. It reduces what can reach Metasploitable, but the host and any other VM attached to the same host-only network can still reach it, and adding another adapter, enabling forwarding or changing the host’s settings can widen its reach. Check the adapters of every VM before starting a session, not just the target’s.
The host and other VMs on the same host-only network can reach it. Host-only limits reach; it does not remove every path.
For how to inspect each machine’s interfaces in this lab, see Linux: ifconfig. What the lab is used for next is covered in Service Discovery and Vulnerability Research, and the guided lab turns this topology into instructional steps for future practice.
Stage: Predict
Isolation has limits
Think it through
Show the answer
Answer: B. Paths and flaws can let it out.
Shared folders, clipboard integration, network access and flaws in the hypervisor can all connect the guest to other systems.
A guest has a separate operating environment, but shared folders and clipboard integration can move data between it and the host. Bridging can expose the guest to a real LAN. Even a NAT-connected guest may communicate with reachable systems; NAT and firewall controls serve different purposes.
Guest tools, the hypervisor and the host are software that may contain vulnerabilities. Misconfiguration or a vulnerability can undermine intended separation. Keep relevant software maintained, enable only the integrations needed for the exercise and review network access before starting. An unknown or malicious programme is not automatically safe to run merely because it is inside a VM.
Controls should match the activity and its risk. Use least privilege for accounts and defence in depth across host, guest and network. Back up important host data independently, avoid unnecessary sensitive information in the guest and keep exercises within explicitly authorised systems.
Stage: Explain
Platforms and learning context
A learner meets virtual machines in two ways.
- Run on your own computer. VirtualBox, VMware Workstation and Hyper-V are common hypervisors for a desktop or laptop. You create and look after the virtual machines yourself, as Maya did.
- Run for you by a training website. Services such as TryHackMe start a ready-made virtual machine on their own computers and let you use it through a web browser. Nothing is installed on your computer, and the target machines are ones you are permitted to practise on.
Either way the ideas in this lesson apply: there is a host, a hypervisor and a guest, and the network mode decides what the guest can reach.
Before starting an exercise in a VM, check three things: which network mode it is using, which host integrations such as shared folders and clipboard are switched on, and whether the activity is within what you are authorised to do. Switching off anything the exercise does not need is quicker than dealing with an unintended path afterwards.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: B. Strangers could reach the target.
It would put a deliberately vulnerable machine on a public network, where strangers could find and use its weaknesses. It must stay on a contained network.
Apply it
Show the answer
Answer: B. They share the same four.
They compete for the same four real cores, so all three slow down.
Apply it
Show the answer
Answer: A. Shared folders and clipboard.
Shared folders and clipboard integration, which move data between guest and host; and any network access the exercise does not need.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: The laptop supplies physical resources, the hypervisor manages virtual machines and Linux is the guest OS.
The host supplies finite resources. The hypervisor mediates their use and exposes virtual hardware to the guest; virtual allocation does not create physical capacity.
Revision sources: Virtual Machines (Supplementary Study Guide explanation)
Show answer
Answer: False
NAT commonly permits outbound connectivity, and shared folders or clipboard integration may connect host and guest. Configuration and vulnerabilities matter; NAT is not a guarantee of isolation.
Revision sources: Virtual Machines (Supplementary Study Guide explanation)
Show answer
Answer: Consider a disconnected virtual NIC and review unnecessary host integrations.
An offline task may not require networking. Disconnection reduces network paths but does not remove shared-folder, clipboard or software risks; planning is not completion.
Revision sources: Virtual Machines (Supplementary Study Guide explanation)
Show answer
Answer: NAT provides external connectivity; Host-only provides access to the isolated lab network.
The two adapters have different purposes: NAT gives Kali internet access, and the Host-only Adapter connects it to the lab network that holds the Metasploitable target. A host-only network connects the host and the VMs attached to it without ordinary internet access by itself, so it cannot be Kali’s internet route and does not hide Kali from the host. A VM with both adapters does not forward traffic between them unless forwarding is deliberately enabled and configured.
Revision sources: Session 6: Networking Fundamentals — Part 2 (Classroom session record) · Virtual Machines (Supplementary Study Guide explanation)
Show answer
Answer: To keep a deliberately vulnerable target away from ordinary internet and untrusted-network exposure.
A VirtualBox VM can have more than one adapter, as Kali does here, so giving the target only one is a choice. Metasploitable is deliberately vulnerable, and such a VM is kept off the internet and untrusted networks so that its weaknesses cannot be reached from outside the lab. Host-only keeps the exercise on the local lab network, but it limits reach rather than giving complete isolation, so it does not make the target immune.
Revision sources: Session 6: Networking Fundamentals — Part 2 (Classroom session record) · Virtual Machines (Supplementary Study Guide explanation)
Show answer
Answer: False
False. Having interfaces on two networks does not by itself mean the operating system forwards traffic between them: a VM with a NAT adapter and a host-only adapter does not forward traffic between the two networks unless forwarding is deliberately enabled and configured. The two adapters give Kali a connection to each network, not a routing role, so they do not create a path from the host-only network to the internet.
Revision sources: Virtual Machines (Supplementary Study Guide explanation)
Study and revision
Practise selected concepts through the topic overview, quiz and flashcards. The approved explanations now support course-backed learning-only revision. Use the All topics track to include it; fictional scenarios are not practical evidence, and no new examination alignment is claimed. The lab-topology questions and flashcards cover the two-VM lab’s adapter settings and this lesson’s supplementary explanation of them, which their explanations name. They are learning-only and do not record that the lab was built.
Stage: Consolidate
Revision takeaway
The host supplies physical resources, the hypervisor manages virtual machines, and the guest runs its own operating system using virtual hardware. Network mode and integration settings determine important communication paths. A VM provides a manageable environment for future authorised practice; understanding its purpose is distinct from building, securing or testing one.
What to remember
- A VM is a complete computer in software; the hypervisor shares the host’s real, finite hardware between guests.
- Type 1 hypervisors run on the hardware; Type 2 run on an ordinary operating system.
- A snapshot is a point to return to, not a backup.
- The network mode decides what a guest can reach: choose NAT, bridged, host-only or disconnected by what it needs.
- Isolation has limits: shared folders, clipboard, network paths and software flaws can all connect a guest to other systems.
Key terms
- Virtual machine (VM)
A software-defined computer with virtual hardware and its own guest operating system, running on resources supplied by a physical host.
- Hypervisor
Software that creates and manages virtual machines and their use of the physical host’s resources.
- Snapshot
A saved state of a virtual machine that it can later be returned to.
- Host-only network
A virtual network that connects a host computer and the virtual machines attached to it, without providing ordinary internet access by itself.
Common misunderstandings
Shared folders, clipboard integration, network access and software vulnerabilities can all connect a guest to its host or other systems.
NAT affects how the guest is addressed. The guest can still make outbound connections, and port forwarding can expose it.
Snapshots usually live on the same host storage as the VM. Losing that storage can lose both.
Virtual resources are backed by the host’s finite hardware. Several guests still compete for it.
Lesson sources and acknowledgements
Sources and scope
- From the Study Buddy session on 9 September (see the entry): virtual machines as environments for practising Linux, testing tools, running security labs and isolating experiments, which can be reset or rebuilt more easily than physical machines; VMware, VirtualBox and Hyper-V as platforms mentioned or relevant. The session was supplementary to the course, not a numbered classroom session.
- Taught in Session 6 (see the Session 6 Learning Log): the tutor’s VirtualBox demonstration of Kali Linux with a NAT adapter for internet access and a host-only adapter for the lab, and Metasploitable with a single host-only adapter.
- Supplementary explanation: the building-and-flats comparison, the host, hypervisor and guest diagram, hypervisor types, the learning scenario (Maya, her laptop and its figures are invented), the two ways a learner meets virtual machines, network modes, the mode-choice walkthrough, the limits of isolation, the practical note and the misunderstandings. In the two-VM section, the NAT and host-only detail, the reasons the topology is sensible, the point that two adapters do not make a router, and the limits of host-only are also supplementary.
- Original diagram: the two-VM lab diagram is my own illustration of the adapter settings, not the tutor’s screenshots.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening questions about a computer to break, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. The scenarios and diagrams are educational illustrations, not evidence that I installed or configured a VM or built the Session 6 lab. VirtualBox, VMware and Hyper-V are named as examples, not as tools installed or configured for this portfolio. TryHackMe was recommended separately as a learning resource; no completed rooms or VM labs are implied.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
The standard way devices on a wired local network send data to each other, in units called frames that carry the MAC address of the sender and of the intended receiver.
A control that allows or blocks network traffic according to configured rules.
An entry in a firewall policy that combines conditions, such as source, destination, protocol and port, with an action: allow or deny.
An endpoint that sends or receives data on a network. Hosts are nodes, but not every node is an end host.
A virtual network that connects a host computer and the virtual machines attached to it, without providing ordinary internet access by itself.
Software that creates and manages virtual machines and their use of the physical host’s resources.
A network covering a local area such as a home, office or building. Network scopes are general descriptions, not fixed distance limits.
Granting users, processes and systems only the access necessary to perform their authorised functions.
Translating IP addresses as traffic passes a device, commonly so that devices with private addresses can use a public-facing address.
Hardware that connects a device to a network medium and provides Physical and Data Link layer functions.
The software that runs a computer and lets other programs use it. Windows, macOS, Linux, Android and iOS are operating systems.
The unit of data at the Network layer, such as an IP packet. It carries source and destination IP addresses between networks.
Applying updates from a software vendor that fix known vulnerabilities or other flaws.
A document that sets organisational rules and expectations, defining what is and is not permitted.
A device that forwards traffic between networks, for example between a private local network and the internet.
A saved state of a virtual machine that it can later be returned to.
A software-defined computer with virtual hardware and its own guest operating system, running on resources supplied by a physical host.
A separate network created inside a switch, or a group of linked switches, by assigning each port to a numbered group. Devices in the same VLAN reach each other directly; devices in different VLANs can communicate only through a router.
A protected connection across a network that is not trusted, usually the internet. Organisations use one to let a computer outside the building reach the internal network as if it were inside.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.