Which of the following observations would an IS auditor consider the GREATEST risk when conducting an audit of a virtual server farm for potential software vulnerabilities?

A. The hypervisor is updated quarterly.
B. Guest operating systems are updated monthly.
C. Antivirus software has been implemented on the guest operating system only.
D. A variety of guest operating systems operate on one virtual server.