SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A public subnet with an internet gateway so the workload can be reached directly.

  Why it's wrong here

  Attaching a public subnet and internet gateway directly exposes the analytics workload to inbound traffic from the internet, dramatically expanding its attack surface. Although security groups and network ACLs can filter traffic, regulatory frameworks rarely permit direct public reachability for sensitive data processing; they require private connectivity such as VPN or Direct Connect. This option solves reachability, not the core requirement of strong tenant isolation, so it fails to provide containment appropriate for a regulated workload.

• ✗

  A shared-tenancy virtual machine in the provider's default compute pool.

  Why it's wrong here

  Choosing a standard VM in the provider's default compute pool means the instance shares a physical server with other customers through the hypervisor. For regulated data, that multi-tenant hardware arrangement may violate compliance requirements for physical separation, since a hypervisor compromise or side-channel attack could expose data to a co-tenant. Shared tenancy can be acceptable for low-risk workloads, but it is the weakest option for satisfying an explicit requirement of strong isolation.

• ✓

  A dedicated host or equivalent single-tenant compute placement in the provider's environment.

  Why this is correct

  A dedicated host (or an equivalent single-tenant placement such as an AWS Dedicated Host, Azure Dedicated Host, or GCP sole-tenant node) assigns an entire physical server to a single customer, eliminating co-tenant compute activity on that machine. This physical isolation directly addresses regulatory mandates that require data containment, while still allowing the cloud provider to manage hardware maintenance and updates. It also enables consistent instance placement, brings-your-own-license (BYOL) scenarios, and helps meet stringent compliance frameworks such as HIPAA, PCI DSS, or FedRAMP.

• ✗

  A serverless function because it removes all underlying infrastructure concerns.

  Why it's wrong here

  A serverless function abstracts away the server, but it runs on infrastructure that is inherently shared among many customers and does not offer any control over underlying host tenancy. Regulated analytics workloads often need predictable long-running compute, stateful execution, and dedicated hardware isolation, none of which are guaranteed by function-as-a-service offerings. From a containment perspective, serverless actually provides less visibility and control than a deliberately chosen dedicated host, making it insufficient for a compliance-driven requirement.