Isolation of application runtimes and dependencies is the correct option because containers package an application with its libraries and runtime so each service runs in a separate, consistent environment which reduces conflicts and the risk that a compromise of one service will directly affect others.

Containers provide process and resource isolation through kernel features such as namespaces and cgroups which helps limit the blast radius of an attack and enforces separation of application runtimes and dependencies. This isolation is the primary security benefit when moving workloads to containers in the cloud, and it also makes builds reproducible and easier to scan for vulnerabilities.

That said containers share the host kernel so isolation is not identical to full virtual machines and you still need runtime hardening, least privilege, image signing, and patching to maintain a strong security posture.

Identity-Aware Proxy is incorrect because it is an access control and identity based gateway for protecting application access and it does not describe a property of container technology itself.

Improved network isolation through VPC configurations is incorrect because VPCs and cloud network controls relate to cloud networking design rather than the intrinsic security property of containers which is runtime and dependency isolation.

Encrypted persistent storage is incorrect because encryption of storage protects data at rest and is independent of containerization and can be applied to virtual machines and other compute models as well.

Full AWS Practitioner Certification Question