A regulated workload must run in the cloud with the strongest possible isolation from other tenants, and the company wants to avoid managing its own physical hardware. Which placement is the best fit?

Use a shared tenancy instance with tighter security groups and a private subnet.

Security groups and private subnets are useful, but they do not provide the strongest isolation from other tenants on the same physical infrastructure.

Move the workload into a public subnet so the provider can inspect traffic more easily.

A public subnet increases exposure and does not improve tenant isolation. It is not appropriate for a regulated workload.

Use a container within a shared platform because containers always isolate tenants completely.

Containers improve efficiency, but they are not the strongest isolation choice and do not eliminate multi-tenant concerns by themselves.

What does this SY0-701 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Use a dedicated host so the underlying hardware is allocated to one customer only. — A dedicated host is the best match when an organization needs strong tenant isolation without buying and operating its own servers. The hardware is reserved for one customer, which reduces sharing concerns that come with standard multi-tenant compute. It is more appropriate than simply using a private subnet or security groups, because those controls protect network access but do not change how the underlying host is shared. Why others are wrong: Option B improves network posture but still uses shared compute. Option C increases exposure and does not address isolation. Option D is not the strongest isolation model and is not equivalent to dedicated hardware in a regulated environment.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.