A provider stores many tenants' block volumes on the same physical storage array. A prospective customer asks how the provider prevents one tenant from reading another tenant's data. Which combination best describes the expected protection?
Select an answer to reveal the explanation.
Short Explanation
Think of a shared storage array as an apartment building: everyone shares the walls, but each unit has its own lock and its own key. You get logical isolation from the storage layer and per-tenant encryption so even a misrouted block is gibberish to the neighbors. Separate arrays per tenant sound nice, but that's not how public cloud economics work.
Full Explanation
Multi-tenant storage relies on logical rather than physical separation. The storage virtualization layer maps each tenant's volumes to its own address space and enforces access so that one tenant's requests cannot reach blocks allocated to another. Encryption with tenant-specific keys adds a second barrier: if isolation fails, or if blocks are reallocated after deletion, the data remains unreadable without the owning tenant's key, which also enables crypto-shredding when a tenant leaves. Dedicated physical arrays per tenant would contradict resource pooling and are not the standard public cloud model; they exist only as special, higher-cost offerings. Deduplication across tenants is actually a known privacy risk because it can reveal whether another tenant holds identical data, and compression is an efficiency feature, not a security boundary. Network security group rules filter traffic between virtual machines, but they do not govern how the storage layer maps and returns data blocks, so they cannot prevent cross-tenant reads at the array. Exam caveat: data remanence on shared media is why per-tenant encryption and crypto-shredding are central to cloud sanitization. Operational check: request evidence of tenant isolation testing in the provider's attestation and confirm volumes are encrypted with keys scoped to the customer.