An engineer is responsible for managing a private cloud environment at a software company. Company developers perform all programming in the cloud environment. There are two departments working on a…

Creating a baseline is a performance or security benchmarking activity and does not establish access controls or resource isolation between departments.

Assigning an ACL (Access Control List) restricts which users or departments can access specific cloud resources at the network or resource layer. By explicitly defining permitted and denied connections, ACLs enforce the access boundaries required to keep the classified project isolated from other departments.

Verifying segmentation confirms that the private cloud network is properly partitioned into isolated logical segments. This ensures that traffic, VMs, and storage designated for the two classified departments cannot be reached or viewed by users or systems in other segments.

Thin provisioned storage is a storage efficiency technique that allocates disk space on-demand and has no bearing on departmental access control or data confidentiality.

Automating patch deployments addresses system maintenance and vulnerability management, not the isolation or access restriction of cloud resources between departments.

Creating a tenant provides logical multi-tenancy isolation but does not alone enforce the specific access control, network segmentation, and encryption controls needed to fully protect classified resources from other departments.

Deploying a PKI (Public Key Infrastructure) solution enables certificate-based authentication and encryption within the private cloud environment. Even if a network boundary were somehow bypassed, PKI encryption ensures data remains unreadable to any party without the appropriate private key, directly satisfying the requirement that resources cannot be viewed by other departments.