Microsoft Cybersecurity Architect (SC-100)Design a Zero Trust strategy and architectureHard
A software-as-a-service (SaaS) provider is designing its Zero Trust architecture. They host multiple customer environments (tenants) within the same underlying infrastructure. To meet strict compliance requirements and ensure data isolation, the architecture must prevent any unauthorized cross-tenant communication or data leakage, even in the event of a security compromise within one tenant. Which design principle is critical for this scenario?
- AIdentity-Based Multi-Tenant Isolation
- BContent-Based Access Control
- CNetwork Micro-segmentation
- DGeographic Redundancy
Show answer & explanationAnswer & explanation
Correct answer: A. Identity-Based Multi-Tenant Isolation
Identity-Based Multi-Tenant Isolation uses identity as the primary control plane to strictly segment access and resources for each tenant. This ensures that a user or service in one tenant cannot access resources or data belonging to another tenant, even if they share underlying infrastructure.
Why the other options are wrong
- B. Content-Based Access Control focuses on access to specific data items based on their content, not comprehensive tenant isolation.
- C. Network Micro-segmentation isolates network segments, but identity-based isolation goes further by enforcing access at the application and data layer based on tenant identity.
- D. Geographic Redundancy is for disaster recovery and business continuity, not tenant isolation.
Identity-Based Multi-Tenant Isolation
A design principle for multi-tenant architectures that uses identity as the primary control plane to strictly segment access and resources, ensuring no unauthorized cross-tenant communication or data leakage.
- Ensures logical separation of customer data and resources.
- Identity is the cornerstone of access enforcement.
- Crucial for compliance and data privacy in multi-tenant SaaS.
- Prevents lateral movement between tenants in case of compromise.
Memory trick: Identities keep tenants in their own rooms.