hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A large financial institution is migrating its…
A large financial institution is migrating its core banking system to a private cloud. The architecture must protect against data leakage between different business units sharing the same physical infrastructure. The system uses a hypervisor and virtual machines. Each business unit has its own security classification. The security requirement is that no VM belonging to a lower classification should be able to read data from a higher classification VM, even if the hypervisor is compromised. The architect proposes using mandatory access control at the hypervisor level. However, the IT team notes that a hypervisor compromise could bypass MAC. Additionally, they need to ensure that data at rest is encrypted and keys are stored securely. Which of the following would BEST meet the requirement?
⚠ Common exam trap
The trap here is that candidates often focus on network-level controls (like encryption or segmentation) and overlook the requirement that protection must hold even when the hypervisor is compromised, which demands hardware-enforced memory isolation rather than software-only solutions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a hardware security module (HSM) to manage keys and implement full memory encryption using AES-256 with integrity protection, and use a trusted execution environment (TEE) for each VM, ensuring that even the hypervisor cannot access VM memory.
It addresses the core requirement: preventing data leakage even if the hypervisor is compromised. By using a hardware security module (HSM) for key management, full memory encryption with AES-256 and integrity protection, and a trusted execution environment (TEE) for each VM, the solution ensures that VM memory is encrypted and isolated at the hardware level. The hypervisor, even if compromised, cannot access the decrypted memory of a VM, thus enforcing the security classification separation regardless of hypervisor integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement network segmentation with VLANs and IPsec encryption between VMs.
Why it's wrong here
Network segmentation with VLANs and IPsec encryption protects data in transit between VMs over the virtual network. However, a compromised hypervisor operates at a lower privilege level than the VMs, granting it direct access to the physical memory allocated to each VM. This allows the hypervisor to bypass all network-level controls and directly read or modify the VM's unencrypted memory contents, rendering these protections ineffective against such a privileged attack.
- ✗
Deploy a data loss prevention (DLP) system to monitor data transfers between VMs.
Why it's wrong here
A Data Loss Prevention (DLP) system monitors and prevents unauthorized data exfiltration or transfer based on predefined policies, typically operating at the network or application layer. While DLP can detect suspicious data movement, it is a reactive control and cannot prevent a compromised hypervisor from directly accessing and reading a VM's memory. Direct memory access by the hypervisor is not a 'data transfer' event that DLP is designed to intercept or prevent.
- ✗
Use a public key infrastructure (PKI) to issue certificates for each VM and enforce mutual TLS for all inter-VM communication.
Why it's wrong here
Using PKI to issue certificates and enforce mutual TLS secures communication between VMs, ensuring data confidentiality and integrity in transit. However, TLS encryption occurs at the network layer and decrypts data once it reaches the VM's operating system for processing. This means that data residing in the VM's active memory or stored on its virtual disk remains unencrypted and fully accessible to a compromised hypervisor, which can directly read these memory regions.
- ✓
Use a hardware security module (HSM) to manage keys and implement full memory encryption using AES-256 with integrity protection, and use a trusted execution environment (TEE) for each VM, ensuring that even the hypervisor cannot access VM memory.
Why this is correct
This option provides comprehensive protection against a compromised hypervisor by leveraging hardware-level security. A Trusted Execution Environment (TEE), such as Intel SGX or AMD SEV, creates a hardware-enforced isolated execution space for each VM, encrypting its memory and CPU state such that even the hypervisor cannot access it in plaintext. Full memory encryption with AES-256 and integrity protection further secures data in use, while a Hardware Security Module (HSM) securely manages the cryptographic keys, ensuring their protection from the compromised hypervisor.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.