SY0-701 Security Architecture Practice Question
A regulated workload must run in the cloud with the strongest possible isolation from other tenants, and the company wants to avoid managing its own physical hardware. Which placement is the best fit?
⚠ Common exam trap
Watch out — candidates often confuse logical isolation (like security groups or private subnets) with physical isolation, assuming that network controls alone satisfy the requirement for the strongest possible isolation from other tenants.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a dedicated host so the underlying hardware is allocated to one customer only.
A dedicated host provides the strongest possible isolation by ensuring that the physical server is not shared with any other tenant. This meets the requirement for a regulated workload without the company managing its own hardware, as the cloud provider still handles maintenance and patching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a dedicated host so the underlying hardware is allocated to one customer only.
Why this is correct
A dedicated host provides the highest level of tenant isolation without requiring the organization to own or maintain the physical server. It is a strong fit for regulated workloads where the business wants reduced sharing at the hardware layer.
- ✗
Use a shared tenancy instance with tighter security groups and a private subnet.
Why it's wrong here
Tighter security groups and a private subnet only constrain network-level access patterns; they do nothing to change the underlying tenancy model. On a shared tenancy instance, your VM still runs on a hypervisor that schedules other customers' workloads on the same physical hardware. This leaves a residual side-channel or hardware-level risk that is typically unacceptable for a regulated workload demanding the strongest possible isolation.
- ✗
Move the workload into a public subnet so the provider can inspect traffic more easily.
Why it's wrong here
Placing a regulated workload in a public subnet increases its network exposure to internet-routable addresses, directly expanding the attack surface. Providers do not gain any special traffic-inspection capability from this placement, and they cannot 'more easily' monitor traffic that is already encrypted or has legitimate confidentiality requirements. This approach weakens security controls and moves the workload further away from the least-privilege and defense-in-depth principles required by most compliance regimes.
- ✗
Use a container within a shared platform because containers always isolate tenants completely.
Why it's wrong here
Containers share the host operating system kernel and rely on kernel namespaces and cgroups for logical separation, which is not equivalent to hardware-enforced isolation. Even with hardened runtimes, a kernel vulnerability or a successful container escape can compromise other tenants or the host itself. Containers can be part of a secure architecture, but they are not a substitute for a dedicated host when the business requirement is maximum physical tenancy isolation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.