easyMultiple ChoiceObjective-mapped
CCSP Practice Question: A financial services company uses a public IaaS…
A financial services company uses a public IaaS provider to host its customer-facing applications. They have strict compliance requirements (e.g., PCI DSS) mandating that all customer data be encrypted at rest and in transit. The cloud provider recently performed a scheduled hypervisor update that required live migration of all customer VMs to different physical hosts to apply security patches. After the migration, the company's security team discovers that temporary files from one of their VMs remained on the original host's local storage and were accessible by another customer's VM that was subsequently provisioned on that host. Although the files did not contain actual customer data because the VM had encrypted its volumes, the security team is concerned about potential data remanence. Which of the following actions would BEST prevent such data remanence in future hypervisor migrations?
⚠ Common exam trap
ISC2 often tests the distinction between data remanence prevention (encryption at rest) and data-in-transit protection (encrypted migration), leading candidates to mistakenly choose encrypted live migration when the real issue is residual data left on the source host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable full-disk encryption on all VMs.
Full-disk encryption ensures that any residual data left on the original host's local storage after live migration is unreadable without the encryption key. Even if temporary files remain, encryption at rest renders the data inaccessible, directly addressing data remanence concerns without relying on the cloud provider's cleanup processes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Request dedicated (single-tenant) hosts for all VMs.
Why it's wrong here
Dedicated hosts prevent co-tenancy but do not address data remanence on the host after VM migration.
- ✓
Enable full-disk encryption on all VMs.
Why this is correct
Full-disk encryption protects data at rest, making residual data unreadable even if not securely erased.
- ✗
Perform a secure wipe of the original host after each migration.
Why it's wrong here
Customers cannot typically wipe shared hosts, and this responsibility lies with the provider.
- ✗
Use encrypted live migration for all VM moves.
Why it's wrong here
Encrypted migration secures data in transit, not residual data left on the source host storage.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.