You are working at an institution that processes medical data. You are migrating several workloads onto Google Cloud. Company policies require all workloads to run on physically separated hardware, and workloads from different clients must also be separated. You created a sole-tenant node group and added a node for each client. You need to deploy the workloads on these dedicated hosts. What should you do?

The correct answer is to use node affinity labels based on the node name when creating Compute Engine instances. Sole-tenant nodes provide dedicated physical servers, and node affinity allows you to specify that a VM instance must run on a particular sole-tenant node or node group. Since the requirement is to separate workloads from different clients onto different nodes within the sole-tenant node group, using the specific node name ensures this granular separation. Using network tags (options 1 and 2) is incorrect because network tags are used for network firewall rules and routing, not for scheduling instances onto specific physical hardware. Using node affinity labels based on the node group name (option 3) is incorrect because while it would place the instance within the correct group, it wouldn't guarantee placement on a specific node within that group, which is required for client-specific physical separation.