Certified Cloud Security Professional (CCSP)Cloud Concepts, Architecture and DesignHard
A government agency is implementing a new cloud application to handle classified information. Due to the extreme sensitivity of the data, the agency mandates that no component of the application, including development, testing, and production environments, can share physical resources with any other tenant. Furthermore, all physical access to the infrastructure must be managed and audited exclusively by agency personnel. Which cloud deployment model, combined with specific architectural choices, would be the most secure and compliant approach?
- AHybrid Cloud leveraging public cloud for non-classified data.
- BCommunity Cloud with enhanced security controls for all members.
- CMulti-tenant Public Cloud with strong encryption and IAM.
- DDedicated Private Cloud (on-premises or hosted) with bare-metal isolation.
Show answer & explanationAnswer & explanation
Correct answer: D. Dedicated Private Cloud (on-premises or hosted) with bare-metal isolation.
A dedicated private cloud, especially one leveraging bare-metal isolation, provides the highest level of physical and logical separation, ensuring no shared physical resources and exclusive control over infrastructure and access, which is critical for classified information and stringent agency mandates.
Why the other options are wrong
- A. Hybrid cloud might expose classified data if not fully isolated, and doesn't guarantee bare-metal isolation for the classified parts.
- B. Community clouds still involve sharing resources among multiple organizations, which is not acceptable for 'no shared physical resources' with classified data.
- C. Multi-tenant public clouds inherently share physical resources, failing the 'no shared physical resources' mandate.
Bare-Metal Isolation
A form of isolation in cloud computing where a single tenant is allocated dedicated physical hardware resources, with no virtualization layer or shared hardware.
- Provides strongest physical and logical separation
- Eliminates hypervisor-based vulnerabilities (virtualization escape)
- Highest cost, typically used for extremely sensitive workloads
Memory trick: Bare metal means *only* your metal.