ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Placing only the application and database tiers on EC2 Dedicated Hosts satisfies physical isolation and exposes socket-level details through the describe-hosts API, meeting both compliance and vendor licensing needs. Because the web tier remains on inexpensive shared-tenancy instances, the organization avoids paying dedicated-host rates where they are not required.

Setting the entire VPC to dedicated tenancy forces every instance-including the web tier-to run as Dedicated Instances, which do not expose host-level hardware details and unnecessarily increase cost. Running all tiers on shared-tenancy hardware fails the isolation requirement. Using separate bare-metal instances would provide isolation and socket visibility, but each instance consumes a whole physical server; deploying three separate bare-metal servers for a modest workload is typically more expensive than consolidating multiple smaller instances on a couple of Dedicated Hosts, so it is not the most cost-effective solution.