ISO-IEC-27001-LEAD-IMPLEMENTER practice question 21 of 35
Scenario 6: Skyver manufactures electronic products, such as gaming consoles, flat-screen TVs, computers, and printers. In order to ensure…
Full set: 290 questionsDomain Implementing an ISMS based on ISO/IEC 27001
The scenario states that Skyver requires a flexible infrastructure to host some services on an "internal and secure infrastructure" while using "external and scalable platforms" for other services. This combination of a private, dedicated environment (internal) and a shared, scalable environment (external) is the defining characteristic of a hybrid cloud model. This model allows an organization to leverage the benefits of both public and private clouds, such as keeping sensitive data on-premise while using the public cloud for less critical applications, which aligns perfectly with Skyver's stated needs for varied deployment options and enhanced security.
A. Public cloud: This option fails to meet Skyver's requirement for hosting certain services on an internal and secure infrastructure, as it is an entirely external model.
B. Private cloud: This option does not satisfy the need for external and scalable platforms that can be accessed from anywhere, as it is an exclusively internal model.
1. Mell, P., & Grance, T. (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). National Institute of Standards and Technology. Page 3. Retrieved from https://doi.org/10.6028/NIST.SP.800-145
Section 2, "Deployment Models": This document defines a hybrid cloud as "a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability." This directly supports the answer, as Skyver requires a composition of internal (private) and external (public) infrastructures.
2. PECB. (2022). ISO/IEC 27001 Lead Implementer Training Course Material. Day 3, Section: "Statement of Applicability (SoA) and Risk Treatment Plan," Subsection: "Annex A Controls."
The course material, when discussing Annex A control A.5.23 (Information security for use of cloud services), explains the different cloud deployment models. It clarifies that a hybrid model is used when an organization needs to combine on-premises infrastructure with public cloud services to balance security, scalability, and cost, which is precisely Skyver's situation.
3. Almulla, M., & Iraqi, Y. (2021). A review of ISO/IEC 27001 and cloud security. Journal of Information Security and Applications, 58, 102791. https://doi.org/10.1016/j.jisa.2021.102791
Section 3.2, "Cloud Deployment Models": This academic review discusses how the hybrid cloud model allows organizations to "keep critical applications and sensitive data in a private cloud environment while using the public cloud for handling workload spikes or for less sensitive applications," reinforcing the rationale for Skyver's choice.
Keep practicing
Take the free ISO-IEC-27001-LEAD-IMPLEMENTER practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other ISO-IEC-27001-LEAD-IMPLEMENTER practice questions
- Question 1Scenario 2: Beauty is a well-established cosmetics company in the beauty industry. The co…
- Question 2What category of decision-making does the implementation of an ISMS belong to within an o…
- Question 3During a security audit, analysts discover that an attacker repeatedly queried a black-bo…
- Question 4Who is responsible for ensuring that the ISMS achieves its intended outcomes?
- Question 5Scenario 8: SunDee is a biopharmaceutical firm headquartered in California, US. Renowned …
- Question 6Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce mod…
