VA in a guest VM is translated to IPA through the Stage-1 page tables managed by guest OS just like non-virtualized systems.
having a trustworthy security monitor provides a secure foundation for the cloud server to strengthen the security of guest OS and its applications.