CCSP Cloud Concepts, Architecture, and Design Practice Question
A cloud security team is reviewing a provider's architecture documentation to assess multi-tenancy risks before migrating regulated workloads. The team wants to verify that logical isolation between tenants is enforced at multiple layers. Which TWO provider controls are MOST directly relevant to preventing one tenant from accessing another tenant's data or processes? (Choose two.)
⚠ Common exam trap
The trap here is selecting contractual or governance artifacts as isolation controls, when only technical mechanisms that enforce separation of execution, networking, or cryptographic keys actually prevent cross-tenant access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tenant-scoped encryption keys with strict key separation and access controls
Preventing cross-tenant access requires controls that enforce boundaries at the compute, network, and data layers. Hypervisor isolation with per-tenant network segmentation separates running workloads and their traffic, while tenant-scoped encryption keys protect data even on shared storage. Governance documents such as SLAs, privacy policies, and disaster recovery plans do not create technical isolation boundaries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A disaster recovery plan with a documented recovery time objective
Why it's wrong here
Disaster recovery planning concerns restoring service after disruptive events and meeting recovery targets, not preventing cross-tenant access. While important for resilience, it operates in a different risk domain and provides no mechanism to separate tenant memory, storage, or network traffic during normal operations.
- ✗
A provider-published privacy policy describing data handling practices
Why it's wrong here
A privacy policy is a governance and transparency artifact describing how data is collected and used, but it does not enforce technical boundaries between tenants. It cannot prevent a malicious or compromised tenant from probing shared resources, so it is not a direct control for the isolation risk the team is evaluating.
- ✓
Tenant-scoped encryption keys with strict key separation and access controls
Why this is correct
Encrypting each tenant's data with distinct keys, managed under strict access controls, ensures that even if storage media or backups are shared, one tenant cannot decrypt another's data. This cryptographic separation complements logical isolation by protecting data at rest and in transit, directly reducing the impact of any isolation failure in the shared infrastructure.
- ✓
Hypervisor-level virtual machine isolation with separate virtual network segments per tenant
Why this is correct
Hypervisor isolation ensures each tenant's virtual machines execute in separate domains with enforced memory and CPU boundaries, while per-tenant virtual network segmentation prevents lateral traffic between tenants. Together these controls directly address the risk of one tenant reaching another tenant's workloads or data through the shared compute and network fabric, making them core multi-tenancy safeguards.
- ✗
A published service level agreement guaranteeing 99.99 percent availability
Why it's wrong here
An availability SLA addresses uptime commitments and service credits, not tenant-to-tenant isolation. While useful for operational planning, it provides no technical assurance that one tenant's processes cannot read another tenant's memory or traverse shared network paths, so it does not mitigate the specific cross-tenant access risk under review.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.