CCSP Cloud Concepts, Architecture, and Design Practice Question
A cloud architect is designing a solution that must ensure data isolation between tenants in a multi-tenant environment. The architect decides to use a virtual private cloud (VPC) per tenant. Which of the following is the PRIMARY security benefit of this approach?
⚠ Common exam trap
The trap here is conflating network isolation with other security controls like encryption or physical separation, and assuming that a VPC automatically provides those benefits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It ensures that each tenant's network traffic is isolated from other tenants.
Using a VPC per tenant provides network-level isolation, which is critical in multi-tenant environments to prevent cross-tenant traffic and unauthorized access. Each VPC acts as a virtual network boundary, with its own IP range, subnets, route tables, and security groups. This logical separation helps enforce security policies and reduces the attack surface, making it the primary security benefit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It provides dedicated physical hardware for each tenant.
Why it's wrong here
A VPC does not provide dedicated physical hardware; it is a logical isolation within a shared infrastructure. Tenants still share the same physical hosts and network equipment. Dedicated hardware would require a private cloud or bare-metal instances, which is not the case here. The primary benefit of a VPC is logical isolation, not physical separation.
- ✗
It automatically encrypts all data at rest for each tenant.
Why it's wrong here
A VPC does not automatically encrypt data at rest. Encryption at rest is typically configured separately using key management services and volume encryption. While a VPC can be part of a defense-in-depth strategy, it does not provide encryption by default. The primary benefit of a VPC is network isolation, not data encryption.
- ✗
It guarantees compliance with data residency requirements.
Why it's wrong here
A VPC can be deployed in specific regions, which may help with data residency, but it does not guarantee compliance by itself. Compliance requires additional controls, such as auditing, monitoring, and legal agreements. Data residency is about where data is stored, while a VPC is about network isolation. Thus, a VPC alone does not ensure compliance.
- ✓
It ensures that each tenant's network traffic is isolated from other tenants.
Why this is correct
A VPC enables logical isolation of network traffic at the virtual network layer. Each tenant's resources are placed in separate subnets with their own routing and security group rules, preventing unauthorized access between tenants. This is a fundamental security control in multi-tenant cloud environments, as it reduces the risk of lateral movement and data leakage.
Visual reference
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.