In designing a multi-tenant solution on ECS, which isolation feature is essential to ensure data privacy between tenants?

Question

Options

• AShared network spaces without any segmentation
• BTenant-specific encryption keys
• CCommon user identities for all tenants
• DUnified access policies for all data

• A
  3% (1)
• B
  82% (27)
• C
  12% (4)
• D
  3% (1)

Explanation

Tenant-specific encryption keys (B) are the cornerstone of data privacy in multi-tenant architectures - when each tenant's data is encrypted with a unique key, even if storage is shared, one tenant's data is cryptographically inaccessible to another. This is typically implemented via AWS KMS with per-tenant Customer Managed Keys (CMKs), ensuring breach of one tenant's key doesn't expose others.

Why the distractors fail:

• A (Shared network spaces without segmentation) is the opposite of isolation - it actively enables cross-tenant traffic and data leakage.
• C (Common user identities) destroys auditability and access control; tenants could impersonate each other or access each other's resources.
• D (Unified access policies) means all tenants share the same permissions boundary, making it impossible to restrict data access per tenant.

Memory tip: Think of tenant-specific encryption keys like safety deposit boxes at a bank - the vault (ECS infrastructure) is shared, but each box has a unique key that only its owner holds. No key = no access, regardless of who else uses the vault.

No community discussion yet for this question.