Which practice aligns with Req 2.2.1 to prevent co-location of functions with differing security levels on a single server?

• A. Run all primary functions on a single server for efficiency
• B. Implement only 1 primary function per server
• C. Distribute functions across different servers with no virtualization
• D. Use virtualization to run multiple primary functions on the same VM

Answer: (B)

Limiting the roles of each server by ensuring it handles only one primary function is the practice being tested. Implementing only one primary function per server directly enforces separation of duties and prevents multiple functions with different security needs from sharing the same hardware or virtualization layer. This reduces the blast radius if a vulnerability is exploited and makes security controls, patching, and monitoring easier to manage.

Why this is the best fit: If a server is dedicated to a single primary function, there’s no risk of cross-contamination between functions that require different levels of protection. This aligns exactly with the intent of Req 2.2.1 to keep security boundaries clear on each server.

Why the other options aren’t as suitable: Running all primary functions on one server creates the opposite of the intended separation, increasing risk. Distributing across servers with no virtualization might meet the spirit in some scenarios, but the statement adds an unnecessary constraint and doesn’t explicitly ensure a single function per server. Using virtualization to run multiple primary functions on the same VM directly violates the requirement by enabling co-location of different functions on the same host.