Layer 3 networks can be logically separated by which technology?

A bridge domain is a Layer 2 concept used to define a broadcast domain, not for Layer 3 network separation.

A Virtual Routing and Forwarding (VRF) instance provides a mechanism to create multiple independent routing tables within a single router or Layer 3 switch. This enables complete logical separation of Layer 3 networks, allowing different customers or departments to have their own IP address spaces and routing policies while sharing the same physical device.

A VLAN (Virtual Local Area Network) provides logical separation at Layer 2 within a broadcast domain, but does not separate Layer 3 routing tables.

A tenant is an administrative grouping of resources, often including networking, but is not a networking technology itself for Layer 3 separation; VRFs might be utilized within a tenant's network.