SY0-701 Question 194
Single answerComputeA company is migrating a customer-facing application to a public cloud provider and will run it on virtual machines. The security team must reduce the risk of one tenant accessing another tenant's data through flaws in the underlying host while still allowing administrators to centrally enforce security settings on the workloads. Which solution best meets these requirements?
- A
Deploy the application on dedicated hosts and use hardened golden images with baseline configurations
- B
Place the virtual machines in a private subnet and disable public IP addresses
- C
Enable autoscaling so compromised virtual machines are replaced automatically
- D
Use object storage server-side encryption for all application logs
Show answer and explanation
Correct answer: A
Explanation
This question focuses on secure cloud compute design. In public cloud environments, multitenancy is a key consideration because multiple customers may share the same underlying physical infrastructure through virtualization. When a scenario specifically calls out concern about tenant-to-tenant access through the host, stronger compute isolation such as dedicated hosts or dedicated instances is the most appropriate control. To meet the additional requirement for centrally enforced security settings, hardened golden images provide a standardized, repeatable method for deploying secure virtual machines with approved configurations. This aligns with common cloud security best practices from major providers and guidance such as NIST recommendations on secure configuration baselines and virtualization security. The other options are valid security controls in their own domains, but they primarily address network exposure, resilience, or data-at-rest protection rather than host-level compute isolation.
- A. Correct.
Correct. Dedicated hosts reduce multitenancy exposure by placing the organization's virtual machines on physical hardware not shared with other customers, which helps mitigate risks related to tenant-to-tenant isolation failures at the compute layer. Using hardened golden images also supports centralized, consistent enforcement of security baselines across workloads, which is a core best practice for secure cloud compute deployments.
- B. Incorrect.
Incorrect. Private subnets and removing public IP addresses improve network exposure and reduce attack surface from the internet, but they do not address the specific concern about one tenant accessing another tenant's data through the underlying host. They also do not by themselves provide centralized enforcement of workload security settings.
- C. Incorrect.
Incorrect. Autoscaling improves availability and can help operational resilience, but it does not directly mitigate risks associated with shared physical hosts or tenant isolation. Replacing instances may help recover from compromise, but it is not the best answer to the scenario's compute-isolation requirement.
- D. Incorrect.
Incorrect. Encrypting logs in object storage is a good data protection measure, but it addresses confidentiality of stored log data rather than compute isolation between tenants or centralized workload hardening. It is a useful control, just not the one that best matches the stated requirements.