AWS Certified Security – SpecialtyDomain 3: Infrastructure SecurityHard
A financial institution is deploying a new backend service on AWS that processes highly sensitive customer data. This service runs on EC2 instances and requires dedicated, non-shared tenancy for compliance reasons. The institution also needs to ensure that the underlying hardware is dedicated to their use and isolated from other AWS customers. What EC2 deployment option should they choose to meet these strict compliance and isolation requirements?
- ASpot Instances with dedicated tenancy.
- BReserved Instances with dedicated tenancy.
- CDedicated Hosts.
- DOn-Demand Instances with default tenancy.
Show answer & explanationAnswer & explanation
Correct answer: C. Dedicated Hosts.
Dedicated Hosts provide physical EC2 servers dedicated for your use, giving you full control over instance placement and visibility into the physical hardware. This meets the strictest compliance requirements for dedicated, non-shared tenancy and isolation at the physical server level, which Dedicated Instances (part of Reserved Instances or On-Demand) do not fully provide at the hardware level.
Why the other options are wrong
- A. Spot Instances with dedicated tenancy are still instances on hardware dedicated to your account, similar to Dedicated Instances, but they don't offer the physical host control and isolation of Dedicated Hosts, and Spot is not suitable for critical services due to interruption risk.
- B. Reserved Instances with dedicated tenancy ensure your instance runs on hardware dedicated to your account, but you don't have control over instance placement or visibility into the physical host. Other instances from your *own* account could share that host, and it doesn't guarantee isolation at the physical server level from *other* AWS customers, as AWS manages the underlying hardware.
- D. Default tenancy instances run on shared hardware, violating the 'dedicated, non-shared tenancy' and 'isolated from other AWS customers' requirements.
EC2 Dedicated Hosts
An Amazon EC2 deployment option that provides physical servers dedicated for your exclusive use, offering the highest level of isolation and control over host placement and licensing.
- Physical server dedicated to your AWS account.
- Provides visibility into underlying host.
- Supports server-bound software licenses.
- Highest isolation level for compliance.
Memory trick: Dedicated Host: Your Own Physical Server!