CCSP Cloud Platform and Infrastructure Security Practice Question
In a cloud environment using KVM, a security auditor wants to ensure that a tenant VM cannot access the memory of another tenant VM on the same physical host. Which resource isolation mechanism is specifically designed to prevent such memory access?
⚠ Common exam trap
A common mix-up: candidates confuse memory isolation mechanisms (EPT) with syscall filtering (Seccomp) or device isolation (IOMMU), leading candidates to pick IOMMU because it also sounds like an isolation technology.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Extended Page Tables (EPT)
Extended Page Tables (EPT) is a hardware virtualization feature (Intel VT-x) that provides second-level address translation, isolating guest physical memory from host physical memory. It ensures that a VM's memory accesses are translated through nested page tables controlled by the hypervisor, preventing one tenant VM from accessing another tenant's memory. EPT, along with AMD's Nested Page Tables (NPT), is specifically designed for memory isolation in virtualized environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Seccomp profiles
Why it's wrong here
Seccomp profiles restrict which system calls a process may invoke, operating at the syscall boundary rather than the memory-translation layer, so they cannot stop one guest reading another's RAM. They are tempting as a KVM hardening control, and would be correct for limiting a container's syscall surface.
- ✗
CPU pinning
Why it's wrong here
CPU pinning binds vCPUs to physical cores to control scheduling and cache locality; it does not partition address translation, so a guest could still reach another's memory. It is tempting because it isolates compute resources, and would be correct for reducing noisy-neighbour latency or NUMA effects, not memory isolation.
- ✓
Extended Page Tables (EPT)
Why this is correct
Extended Page Tables provide hardware-assisted second-level address translation, giving each guest VM its own nested page tables managed by the hypervisor. This isolates guest physical memory so one tenant VM cannot map or read another's memory, directly satisfying the auditor's cross-tenant isolation requirement.
- ✗
IOMMU
Why it's wrong here
IOMMU remaps device DMA, restricting which memory addresses a passthrough peripheral can reach; it does not isolate one tenant VM's RAM from another's. It is tempting because IOMMU underpins secure device assignment in KVM, and would be correct when passing a physical NIC or GPU to a VM.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.