CCSP - Cloud Platform and Infrastructure Security (17% of the exam) - Section 3.1
Comprehend cloud infrastructure and platform components.
Physical and network environment, compute, virtualisation, storage, management plane, and the emerging technologies that sit on top of them.
management planecompute and virtualisationnetwork environmenthypervisor typescontainers and serverless
Practice question for this objective
lock_openFree sampleCloud Platform and Infrastructure Securityhard
A university consortium operates a private cloud in its own data centre for research workloads classified as confidential. A risk assessment identifies that multiple research teams share a single management network with the hypervisor management interfaces, so a compromised research host could reach those interfaces directly. Which control best reduces the attack vector the assessment describes?
ASegregate the hypervisor management interfaces onto an isolated management network separated from tenant workload trafficcheck_circle Correct
BEnable full-disk encryption on every research host so a compromised host cannot expose stored data
CRequire multi-factor authentication for researchers logging in to the workload virtual machines
DDeploy a host-based intrusion detection agent on each hypervisor to alert on suspicious management commands
Isolating the hypervisor management network from tenant workloads removes the lateral path a compromised host would use to reach the control plane. The attack vector is network reachability between a workload host and the management plane; network segregation of management interfaces eliminates that path, whereas encryption, MFA and detection address other risks and leave the path intact.
Why A is correct: Placing management interfaces on a dedicated, isolated network removes the lateral path from a compromised workload host to the control plane, directly addressing the stated vector.
Why B is wrong: Full-disk encryption protects data at rest, but it does nothing to stop a live compromised host from reaching management interfaces over a shared network.
Why C is wrong: Stronger workload authentication is worthwhile, but the risk is a compromised host reaching the control plane, and MFA on the workload does not sever that network path.
Why D is wrong: Detection on the hypervisor may raise an alert after the fact, but it neither removes the reachable network path nor prevents the lateral movement the assessment found.
Exam traps in Cloud Platform and Infrastructure Security
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
It is the aggregation of physical network switches and routers that carry east-west traffic between virtual machines within a single host.
errorWhy it is wrong: This describes elements of the underlying physical network fabric, not the management plane; the fabric moves workload traffic but does not orchestrate provisioning or configuration.
The guest operating system on one virtual machine could be running an unpatched kernel
errorWhy it is wrong: An unpatched guest is a genuine weakness, but its blast radius is a single workload; it does not explain why account-wide console access is the more severe exposure the scenario describes.
Full-disk encryption on every hypervisor host so stored tenant data is unreadable at rest
errorWhy it is wrong: Host encryption protects data at rest against physical theft, but it does not stop one running tenant from reaching another's live compute or network traffic.