nerdexam
CompTIA

CAS-002 · Question #113

A startup company offering software on demand has hired a security consultant to provide expertise on data security. The company's clients are concerned about data confidentiality. The security…

The correct answer is C. Each client is assigned a set of virtual hosts running shared hardware. Assigning each client dedicated virtual hosts on shared physical hardware provides the strongest logical tenant isolation, making it the best design when data confidentiality is the top priority in a multi-tenant SaaS environment.

Technical Integration of Enterprise Components

Question

A startup company offering software on demand has hired a security consultant to provide expertise on data security. The company's clients are concerned about data confidentiality. The security consultant must design an environment with data confidentiality as the top priority, over availability and integrity. Which of the following designs is BEST suited for this purpose?

Options

  • AAll of the company servers are virtualized in a highly available environment sharing common
  • BAll of the company servers are virtualized in a highly available environment sharing common
  • CEach client is assigned a set of virtual hosts running shared hardware.
  • DEach client is assigned a set of virtual hosts running shared hardware.

How the community answered

(16 responses)
  • A
    25% (4)
  • B
    6% (1)
  • C
    56% (9)
  • D
    13% (2)

Why each option

Assigning each client dedicated virtual hosts on shared physical hardware provides the strongest logical tenant isolation, making it the best design when data confidentiality is the top priority in a multi-tenant SaaS environment.

AAll of the company servers are virtualized in a highly available environment sharing common

A highly available environment sharing common resources such as storage or memory pools increases the risk of cross-tenant data exposure, subordinating confidentiality to availability.

BAll of the company servers are virtualized in a highly available environment sharing common

Similarly, a shared highly available environment prioritizes uptime over isolation and does not provide the per-client separation required when confidentiality is the top priority.

CEach client is assigned a set of virtual hosts running shared hardware.Correct

Dedicated virtual hosts per client enforce hypervisor-level isolation between tenants, preventing cross-client data access and side-channel exposure. Even when the underlying hardware is shared, the hypervisor maintains separate memory, storage, and process spaces for each client, directly satisfying the confidentiality-first requirement.

DEach client is assigned a set of virtual hosts running shared hardware.

This option involves shared hardware without the per-client dedicated virtual host isolation described in C, creating potential cross-tenant access paths that weaken confidentiality guarantees.

Concept tested: Virtual machine isolation for multi-tenant data confidentiality

Source: https://csrc.nist.gov/publications/detail/sp/800-125/final

Topics

#data confidentiality#virtualization#multi-tenancy#cloud security

Community Discussion

No community discussion yet for this question.

Full CAS-002 Practice