AWS Certified Security – SpecialtyDomain 3: Infrastructure SecurityHard
A client is building a highly confidential application on AWS that processes personally identifiable information (PII). They want to ensure that all compute instances processing this data have the strongest possible isolation from other AWS customers, even at the hardware level. The application needs to run on Amazon EC2. Which EC2 deployment option provides this level of dedicated physical isolation?
- AOn-Demand Instances
- BReserved Instances
- CDedicated Hosts
- DDedicated Instances
Show answer & explanationAnswer & explanation
Correct answer: C. Dedicated Hosts
Dedicated Hosts provide physical EC2 servers dedicated for your use, offering the highest level of isolation. This option gives you visibility into the underlying physical server and allows you to use your existing server-bound software licenses, meeting strict compliance and isolation requirements.
Why the other options are wrong
- A. On-Demand Instances run on shared tenancy by default, providing logical isolation but not dedicated physical hardware.
- B. Reserved Instances are a pricing model, not a deployment option, and don't provide dedicated physical isolation on their own.
- D. Dedicated Instances run on hardware dedicated to a single customer, but AWS controls instance placement. You don't get visibility into or control over the host, which is required for the 'strongest possible isolation' and often for specific licensing.
EC2 Dedicated Hosts
Amazon EC2 Dedicated Hosts are physical servers with EC2 instance capacity fully dedicated to your use, providing the highest level of isolation and control.
- Dedicated physical server for your account.
- Highest level of isolation for EC2 instances.
- Visibility into sockets, cores, host ID.
- Supports server-bound software licenses.
Memory trick: Dedicated Hosts are for Hardcore Host Isolation.