Cloud Architecture for Air-Gapped Security

400-007 By islever Editorial Last updated

Short answer

C A private cloud provides the necessary isolation and control to match the security levels of an air-gapped data center while supporting modernized application architectures.

Question

The major business applications of an enterprise are largely monolithic and hard-coded. As part of a major modernization and overhaul of the applications, the goal is to move to a modular and containerized application architecture mode. At the same time, decoupling from the hardware is desired to move to an on-demand provisioning. However, the CyberOps team mandated that the final architecture must provide the same security levels as an air-gapped data center. Which cloud architecture meets these requirements?
  1. PaaS
  2. IaaS
  3. private cloud Correct Answer
  4. public cloud
  5. hybrid cloud

Key Takeaways

The question tests the understanding of how 'air-gapped' security levels map to specific cloud deployment models, highlighting the trap of assuming hybrid or public clouds can achieve the same physical isolation.

This question evaluates the selection of a cloud deployment model that balances modernization with strict security isolation. It establishes why a private cloud is the correct choice to meet air-gapped equivalent security requirements.

Common mistake: Candidates often choose Hybrid Cloud (E) because they associate it with flexibility and security controls, failing to realize that true air-gapped equivalence requires the dedicated, isolated infrastructure of a Private Cloud.

Expert Analysis

Why the Answer Is Correct

A Private Cloud (Option C) is the only architecture among the choices that provides the level of isolation and control necessary to replicate the security posture of an air-gapped data center. While it offers the on-demand provisioning and decoupling from hardware desired in modernization, its exclusive use by a single organization allows for strict network segmentation and physical separation, which are key characteristics of air-gapping.

Why the Other Options Are Wrong

Public Cloud (D) shares infrastructure among multiple tenants, making it impossible to guarantee air-gapped-level security without significant compromises. Hybrid Cloud (E) combines public and private resources; while it offers flexibility, the public component introduces shared risks that violate the strict isolation mandate. IaaS (B) and PaaS (A) are service models, not deployment models, so they do not define the physical or logical isolation boundaries required by the question.

Community Comment Notes

Community consensus strongly supports Option C, with users noting that 'air-gap' directly implies the isolation found in a private cloud. As one commenter stated, 'AIR-GAP is private cloud,' reflecting the direct mapping between the security requirement and the deployment model. Another user highlighted that no keywords forced a hybrid approach, reinforcing the logic for a dedicated private environment.

Official Reference

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf

This link opens the official vendor documentation in a new tab.

Exam Strategy

When questions mention 'air-gapped' or 'physical isolation' alongside cloud benefits, prioritize Private Cloud over Hybrid or Public options, as these terms specifically refer to the degree of tenant isolation and physical security controls.

Frequently Asked Questions

Why isn't Hybrid Cloud suitable for air-gapped security?

Hybrid Cloud includes public cloud components that share infrastructure with other tenants, breaking the strict physical and logical isolation required for air-gapped equivalence.

Can IaaS provide air-gapped security?

IaaS is a service model, not a deployment model. It does not inherently define the isolation boundaries needed for air-gapped security, which depends on the underlying deployment (e.g., Private vs. Public).

More 400-007 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. JCGO 👍 1 Answered C
    Voting for C. No single word, which could force us to think about hybrid/public clouds. just 'air-gaped', 'same security-level', but as flexible as cloud. so private cloud most logical choice.
  2. kalulosu 👍 1 Answered C
    I think ans is C. air-gapped data center is private cloud.
  3. 0d1b5b9 👍 4 Answered C
    AIR-GAP is private cloud.
  4. Baramzon 👍 1
    Air-Gap mean the Private
  5. Redrum702 👍 1 Answered E
    Answer E:

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Evaluating WAN Technology for OPEX Reduction

S-grade

Resolving Asymmetric Routing with BGP MED

S-grade

Data Sovereignty vs Data Localization Policy

S-grade

SD-WAN Solution Characteristics and Architecture

S-grade

← Back to 400-007 Study Guide