Is physical pages zeroed out before it's mapped to a virtual page? I don't how this works. According to me if the physical memory is not cleared then there is some security risk as there may be some sensitive information in it from the other processes. How does the kernel take care of this?
Yes, the kernel zeroes out pages before allocating them to a user-level process.  The details depend on the specific operating system; some may zero it out when the page is needed, others might run a separate thread that periodically zeroes out pages in anticipation that they'll be allocated.