What is a characteristic of a secure cloud architecture model?

Limiting access by job function describes the principle of least privilege applied to identity and access management - it is an IAM policy control, not a cloud architecture characteristic.

Dedicated and restricted workstations are an endpoint security control applied to user devices and are not a structural property of cloud architecture design.

Multi-factor authentication is an identity verification mechanism that strengthens access control but does not describe how the cloud architecture itself is structured or segmented.

Software-defined network segmentation is a fundamental design property of secure cloud architectures, using SDN or micro-segmentation to enforce logical network boundaries between workloads, services, and tenants independent of physical topology. This architectural control limits an attacker's ability to move laterally between segments and is a defining structural feature of zero-trust cloud environments.