| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🎯 Free CISSP Practice Test |
CISSP 9.16 - Virtualized Systems (Part 2 of 2)
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series continues the tour of virtualization from Domain 3, moving beyond the building blocks into the wider software-defined world — and the habits that keep centralized, virtualized environments secure as fleets quietly turn into software.
What this episode covers
- Software-defined everything — replacing hardware with software equivalents you provision and tear down on demand.
- Virtual desktop infrastructure (VDI) — persistent vs nonpersistent desktops, and virtual mobile infrastructure.
- Thin clients — lightweight endpoints that handle input and display while the server does the computing.
- Software-defined visibility and data centers — automated network monitoring and fully virtualized facilities.
- Managing virtual system security — hardening the hypervisor host, patching guests, backups, and testing.
- VM sprawl and shadow IT — untracked machines and unapproved technology, and the policies that rein them in.
- VM escaping — how guests break isolation, and the layered defenses that contain them.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
What is software-defined everything?
Software-defined everything is the trend of replacing pieces of hardware with software equivalents built on virtualization. Networking, storage, visibility, and even whole data centers become software that can be provisioned and torn down on demand. The flexibility is enormous, but it also creates a new attack surface that must be secured.
What is the difference between a virtual desktop and a thin client?
A virtual desktop infrastructure (VDI) hosts each user’s workstation as a virtual machine on a central server, either persistent (saving customizations) or nonpersistent (resetting at every logoff). A thin client is the lightweight endpoint that connects to it, handling only the screen, keyboard, and mouse while the real computing happens on the server.
How do you manage the security of virtual systems?
Start by hardening the hypervisor host and using it for nothing but hosting, since compromising the physical host can expose every guest on it. Each guest operating system and the hypervisor itself still need their own patches, tested backups and snapshots, and regular vulnerability scans and penetration testing just like physical systems.
What is VM sprawl and how do you control it?
VM sprawl happens when virtual machines are cloned so easily that dozens end up running with no real oversight, each carrying the same licensing and patching burden as a physical system. The fix is a firm policy for how machines are built plus a library of approved base images to deploy from. It is closely related to shadow IT, technology stood up without the knowledge of management or the security group.
What is VM escaping and how do you defend against it?
VM escaping is when software inside one guest defeats the isolation the hypervisor enforces, reaching into other guests or the host itself. Defend in layers: keep the most sensitive systems on separate physical hardware so isolation is real rather than logical, patch every hypervisor as soon as fixes arrive, and watch threat feeds for new escape techniques.
📚 Master the ISC2 CISSP Exam!
Reinforce this lesson with real practice. The RooCloud CISSP Practice Pack gives you 6,000+ exam-style questions, 366 section-wise practice tests and 40 full-length adaptive (CAT) tests across all 8 CISSP domains, with full explanations. Start with a FREE full-length adaptive CISSP test →
Reference: This article is based on concepts discussed in CISSP 9.16 - Virtualized Systems (Part 2 of 2).