CCSP Cloud Platform and Infrastructure Security Practice Question
A security auditor is reviewing a cloud provider's virtualisation infrastructure. Which TWO mechanisms ensure VM isolation at the hardware level to prevent one tenant from accessing another's resources?
⚠ Common exam trap
ISC2 often tests the distinction between software-based isolation controls (like Security Groups and Network ACLs) and hardware-enforced mechanisms (like CPU Pinning and IOMMU), trapping candidates who confuse network-layer security with hardware-level resource isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CPU Pinning
CPU Pinning (option A) ensures VM isolation at the hardware level by dedicating specific physical CPU cores exclusively to a particular VM. This prevents other VMs from scheduling on those cores, eliminating CPU-level side-channel attacks and resource contention. It is a hardware-enforced isolation mechanism because the hypervisor uses the CPU's hardware virtualization extensions (e.g., Intel VT-x or AMD-V) to enforce the pinning, ensuring that one tenant's VM cannot access another's CPU resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CPU Pinning
Why this is correct
CPU pinning dedicates physical cores to specific VMs, enforcing resource isolation.
- ✓
IOMMU (Input-Output Memory Management Unit)
Why this is correct
IOMMU isolates device DMA access to assigned VMs.
- ✗
Hypervisor Introspection
Why it's wrong here
Introspection monitors VMs but does not provide hardware-level isolation.
- ✗
Security Groups
Why it's wrong here
Security Groups are network-level firewalls, not hardware isolation.
- ✗
Network ACLs
Why it's wrong here
NACLs are subnet-level firewalls, not hardware isolation.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.