In a provider's data center design, tenant workloads and the provider's own hypervisor management and storage replication traffic all run on the same flat network segment. Which logical design change best reduces the risk this creates?
Select an answer to reveal the explanation.
Short Explanation
Mixing tenant traffic with management traffic is like running the bank vault's control wiring through the customer lobby. You separate tenants from each other and give management its own locked-down network. More bandwidth or public IPs don't build any walls.
Full Explanation
Logical design of a secure cloud data center relies on tenant partitioning and on isolating the provider's control and management functions from customer-facing networks. Hypervisor management interfaces and storage replication carry highly privileged traffic; if tenants share a flat segment with them, a compromised tenant workload could sniff, spoof or attack those interfaces and reach the infrastructure that underpins every other tenant. The fix is segmentation, using separate physical or logical networks such as VLANs or virtual networks for management, storage and tenant traffic, with strict access control between them and per-tenant isolation within the tenant zone. Adding bandwidth addresses performance contention but leaves every tenant with network reachability to management interfaces. Encrypting tenant disks protects data at rest on those volumes; it has no effect on what a tenant can observe or send on the network. Assigning public addresses identifies traffic but does not restrict it, and exposing tenants publicly could add rather than reduce risk. Exam caveat: isolation in a multi-tenant environment is enforced at compute, storage and network layers together, and management access is always on its own protected path. Operational check: from a tenant workload, attempt to reach hypervisor management addresses and confirm the connections are refused.