Virtual Machines

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 59

Learners work out what they would need to practise on a computer they can break, and where three virtual computers get their hardware, before the flats comparison names host, hypervisor and guest. Predictions then precede what opens a door between guest and host, how much memory to give, what to decide before choosing a network mode, how to design a two-VM lab and whether a VM makes anything safe; checks follow the caretaker comparison and snapshots. The habit to build: decide what a guest needs to reach, then give it no more. This is a conceptual lesson: nothing in it records a lab being built.

Objectives

• Describe the host, hypervisor and guest, and the two types of hypervisor
• Explain why VMs help learning, and why a snapshot is not a backup
• Choose a network mode by what a guest needs to reach
• Explain the adapter design of a two-VM security lab
• Recognise the limits of VM isolation

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the IP forwarding and Firewalls lessons first.
• If you show a hypervisor, show only its settings screens; the lesson claims no lab work.
• The lesson takes about 59 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe the host, hypervisor and guest, and the two types of hypervisor
   • Explain why VMs help learning, and why a snapshot is not a backup
   • Choose a network mode by what a guest needs to reach
   • Explain the adapter design of a two-VM security lab
   • Recognise the limits of VM isolation

   Purpose: Learners work out what they would need to practise on a computer they can break, and where three virtual computers get their hardware, before the flats comparison names host, hypervisor and guest. Predictions then precede what opens a door between guest and host, how much memory to give, what to decide before choosing a network mode, how to design a two-VM lab and whether a VM makes anything safe; checks follow the caretaker comparison and snapshots. The habit to build: decide what a guest needs to reach, then give it no more. This is a conceptual lesson: nothing in it records a lab being built.

2. 1. A computer to break Think 5 min

   Purpose: Raise the need for a disposable computer, and shared hardware.

   Ask

   • Ask what they would need.
   • Where do the resources come from?

   Responses to expect

   • “A second laptop” is common; steer towards software.
   • On screen in turns: the opening question, its answer; then the question on where the hardware comes from, and its answer.

   Discussion pause: Let learners describe the computer they would want before naming it.

   In the lesson window

   • Think it through: You want to practise on a computer you can break and rebuild freely, but you have only the laptop you use every day. What would you need?
   • Think it through: If one laptop runs three such computers at once, where do their processors and memory come from?

3. 2. The idea Explain 9 min

   Purpose: Introduce host, hypervisor and guest with the flats, and the two hypervisor types.

   Ask

   • What could open a door between guest and host?
   • Who is the caretaker?

   Responses to expect

   • Shared folders come up quickly.
   • Diagram: the stack is built from the hardware up; before each layer appears, ask what has to sit on the one below.
   • On screen in turns: the opening; then host, virtual machine and hypervisor, starting with the host; the virtual machine; the hypervisor; a Linux guest on a Windows laptop; the building has only so much water, and its answer; where the comparison stops; the stack, from the hardware up; the hypervisor and host operating system; the guest; the check question on the caretaker, and its answer; two kinds of hypervisor, starting with Type 1; Type 2; the types blur in practice.

   Misconceptions to challenge

   • A learner may believe: “Giving a VM more virtual CPUs adds capacity.” Respond: Every virtual processor is backed by the host’s real, limited hardware.

   In the lesson window

   • Think it through: Walls between flats are solid. What might open a door between a virtual machine and its host?
   • Check your understanding: In the flats comparison, which part of a virtualised system is the caretaker?

4. 3. Why it is useful for learning Predict 7 min

   Purpose: Explain repeatability, snapshots and planning, through the fictional scenario.

   Ask

   • What could lose both VM and snapshots?
   • How much memory would you give?

   Responses to expect

   • Many treat snapshots as backups.
   • On screen in turns: the opening; then the check question on snapshots as backups, and its answer; the question on how much memory to give, and its answer; Maya’s plan, starting with its purpose; what the laptop can spare; the software and the installer; creating the machine; networking; the snapshot; the result; separation is not a guarantee.

   Misconceptions to challenge

   • A learner may believe: “A snapshot is a backup.” Respond: It usually lives on the same storage as the VM.

   In the lesson window

   • Check your understanding: A learner keeps snapshots of a VM and calls them backups. What could lose both the VM and its snapshots at once?
   • Think it through: A laptop has 16 GB of memory. How much would you give a practice VM, and what happens if you give it 14 GB?

5. 4. Networking modes and their consequences Predict 8 min

   Purpose: Compare the four modes and choose by what the guest needs to reach.

   Ask

   • What should you decide first?
   • Which mode lets a phone open the guest’s page?

   Responses to expect

   • Learners often choose by convenience.
   • On screen in turns: the opening question, its answer; then the virtual NIC and its mode; four network modes, with their limitations held back; the decision and limitation for each mode; where NAT and VLANs are taught; the question on reaching a guest from a phone, and its answer; choosing a mode for three activities, starting offline; installing updates; testing a web server; least privilege for network paths.

   Misconceptions to challenge

   • A learner may believe: “NAT mode isolates the VM.” Respond: The guest can still connect out, and forwarding can expose it.

   Discussion pause: The limitations column is held back: for each mode, ask what it would expose or fail to protect before revealing it.

   In the lesson window

   • Think it through: Before choosing how a VM connects to a network, what should you decide first?
   • Think it through: A guest runs a web page that a phone on the same home network must open. Which mode makes that possible?

6. 5. A two-VM security lab Predict 9 min

   Purpose: Explain the adapter design of the two-VM lab and why it is sensible.

   Ask

   • How many adapters does each machine need?

   Responses to expect

   • Two for the testing machine, one for the target comes with a hint about its two jobs.
   • On screen in turns: the opening; then the question on designing the lab, and its answer; the two machines and their adapters; the lab, drawn; NAT and host-only in this lab; why this topology is sensible, starting with Kali’s two jobs; containing Metasploitable; a small, known network; two adapters do not make a router; the misunderstanding about host-only; where the lab is used next.

   Misconceptions to challenge

   • A learner may believe: “Host-only means nothing can reach the VM.” Respond: The host and other VMs on that network still can.

   If the explanation does not land: Draw the two machines and two networks, and let learners draw the links.

   To go further

   • What would have to be changed for the testing machine to route traffic between its two networks, and why would you not want it?

   In the lesson window

   • Think it through: You need a testing machine that can get updates and reach a deliberately vulnerable target, and the target must never reach the internet. How many network adapters would each machine need, and in which modes?

7. 6. Isolation has limits Predict 5 min

   Purpose: Set out the limits of isolation and the controls that match the risk.

   Ask

   • Is a suspicious program safe inside a VM?

   Responses to expect

   • Some say yes.
   • On screen in turns: the opening question, its answer; then shared folders, clipboard and bridging; vulnerabilities in the software itself; controls that match the activity.

   Misconceptions to challenge

   • A learner may believe: “Anything inside a VM is safely contained.” Respond: Integrations, network access and flaws can connect it to other systems.

   In the lesson window

   • Think it through: A friend says any suspicious program is safe to run as long as it is inside a VM. What could go wrong?

8. 7. Platforms and learning context Explain 3 min

   Purpose: Distinguish running VMs yourself from using a training website’s.

   Ask

   • What stays the same either way?

   Responses to expect

   • Host, hypervisor, guest and network mode.
   • On screen in turns: the opening; then two ways to meet a VM, starting with your own computer; a training website; the same ideas either way; three checks before an exercise.

9. 8. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The café tests containment; the cores test shared hardware; the integrations test isolation.
   • On screen in turns: the opening; then the question on a bridged target, and its answer; the question on three VMs and four cores, and its answer; the question on what to switch off, and its answer.

   In the lesson window

   • Apply it: A learner plans to switch a deliberately vulnerable VM to bridged mode on a café’s Wi-Fi, to fetch updates. What is the problem?
   • Apply it: A laptop has four processor cores. Three VMs are each given four virtual processors. What happens when all three are busy?
   • Apply it: Before an exercise in a VM, which integrations should you switch off if the exercise does not need them?

10. 9. Check your understanding Check 6 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The lab questions link to the two-VM step.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

11. 10. Revision takeaway Consolidate 3 min

    Purpose: Consolidate the takeaway, the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: which setting decides what a guest can reach?

    Responses to expect

    • Its network mode, with any integrations.
    • On screen in turns: the opening; then what to remember; the key terms; the common misunderstandings.

12. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • A computer in software, sharing real hardware.
    • Snapshots are not backups.
    • Choose the network mode by what the guest must reach.
    • Contain a vulnerable target on a private network.
    • Isolation is software, and can be opened.

Consolidation

• A computer in software, sharing real hardware.
• Snapshots are not backups.
• Choose the network mode by what the guest must reach.
• Contain a vulnerable target on a private network.
• Isolation is software, and can be opened.