mediumMultiple SelectObjective-mapped
CCSP Practice Question: A cloud security architect is concerned about…
A cloud security architect is concerned about potential side-channel attacks against VMs running on a shared hypervisor. Which TWO of the following measures would be most effective in mitigating such attacks?
⚠ Common exam trap
ISC2 often tests the distinction between data protection controls (encryption, MFA, network segmentation) and compute-level isolation controls, leading candidates to mistakenly select network or access controls that do not address the shared hardware attack surface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use dedicated (single-tenant) hosts for sensitive workloads.
Using dedicated (single-tenant) hosts ensures that the physical server is not shared with any other customer's VMs. This eliminates the possibility of a co-resident attacker exploiting shared hardware resources (such as CPU caches, memory buses, or branch predictors) to launch side-channel attacks like Prime+Probe or Flush+Reload. By removing the shared hypervisor layer between tenants, the attack surface for cross-VM side channels is effectively nullified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use dedicated (single-tenant) hosts for sensitive workloads.
Why this is correct
Dedicated hosts guarantee no other VMs on the same hypervisor, eliminating shared-resource side channels.
- ✗
Encrypt all data at rest using AES-256.
Why it's wrong here
Encryption protects stored data but does not address runtime side-channel attacks on shared CPUs.
- ✓
Disable hyper-threading on the physical hosts.
Why this is correct
Disabling hyper-threading reduces the attack surface for side-channel attacks that exploit logical processor sharing.
- ✗
Implement network segmentation using VLANs.
Why it's wrong here
Network segmentation separates traffic but does not prevent CPU-level side channels within the same hypervisor.
- ✗
Enable multi-factor authentication for all cloud administrative accounts.
Why it's wrong here
MFA improves access security but does not mitigate hypervisor side-channel attacks.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.