ISO-IEC-27001-LEAD-IMPLEMENTER practice question 21 of 35

Scenario 6: Skyver manufactures electronic products, such as gaming consoles, flat-screen TVs, computers, and printers. In order to ensure…

Full set: 290 questions

Domain Implementing an ISMS based on ISO/IEC 27001

Scenario 6: Skyver manufactures electronic products, such as gaming consoles, flat-screen TVs, computers, and printers. In order to ensure information security, the company has decided to implement an information security management system (ISMS) based on ISO/IEC 27001. Colin, the company's information security manager, decided to conduct a training and awareness session for the company's staff about the information security risks and the controls implemented to mitigate them. The session covered various topics, including Skyver's information security approaches, techniques for mitigating phishing and malware, and a dedicated segment on securing cloud infrastructure and services. This particular segment explored the shared responsibility model and concepts such as identity and access management in the cloud. Colin organized the training and awareness sessions through engaging presentations, interactive discussions, and practical demonstrations to ensure that the personnel were well-informed by security principles and practices. One of the participants in the session was Lisa, who works in the HR Department. Although Colin explained Skyver's information security policies and procedures in an honest and fair manner, she found some of the issues being discussed too technical and did not fully understand the session. Therefore, in many cases, she would request additional help from the trainer and her colleagues. In a supportive manner, Colin suggested Lisa consider attending the session again. Skyver has been exploring the implementation of AI solutions to help understand customer preferences and provide personalized recommendations for electronic products. The aim was to utilize AI technologies to enhance problem-solving capabilities and provide suggestions to customers. This strategic initiative aligned with Skyver’s commitment to improving the customer experience through data-driven insights. Additionally, Skyver looked for a flexible cloud infrastructure that allows the company to host certain services on internal and secure infrastructure and other services on external and scalable platforms that can be accessed from anywhere. This setup would enable various deployment options and enhance information security, crucial for Skyver's electronic product development. According to Skyver, implementing additional controls in the ISMS implementation plan has been successfully executed, and the company was ready to transition into operational mode. Skyver assigned Colin the responsibility of determining the materiality of this change within the company. Based on the scenario above, answer the following question: Which cloud computing model best aligns with Skyver's requirements?
Answer options
A: Public cloud
B: Private cloud
C: Hybrid cloud Correct answer
Correct Answer:
C. Hybrid cloud
Explanation

The scenario states that Skyver requires a flexible infrastructure to host some services on an "internal and secure infrastructure" while using "external and scalable platforms" for other services. This combination of a private, dedicated environment (internal) and a shared, scalable environment (external) is the defining characteristic of a hybrid cloud model. This model allows an organization to leverage the benefits of both public and private clouds, such as keeping sensitive data on-premise while using the public cloud for less critical applications, which aligns perfectly with Skyver's stated needs for varied deployment options and enhanced security.

Why Incorrect

A. Public cloud: This option fails to meet Skyver's requirement for hosting certain services on an internal and secure infrastructure, as it is an entirely external model.
B. Private cloud: This option does not satisfy the need for external and scalable platforms that can be accessed from anywhere, as it is an exclusively internal model.

References

1. Mell, P., & Grance, T. (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). National Institute of Standards and Technology. Page 3. Retrieved from https://doi.org/10.6028/NIST.SP.800-145

Section 2, "Deployment Models": This document defines a hybrid cloud as "a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability." This directly supports the answer, as Skyver requires a composition of internal (private) and external (public) infrastructures.

2. PECB. (2022). ISO/IEC 27001 Lead Implementer Training Course Material. Day 3, Section: "Statement of Applicability (SoA) and Risk Treatment Plan," Subsection: "Annex A Controls."

The course material, when discussing Annex A control A.5.23 (Information security for use of cloud services), explains the different cloud deployment models. It clarifies that a hybrid model is used when an organization needs to combine on-premises infrastructure with public cloud services to balance security, scalability, and cost, which is precisely Skyver's situation.

3. Almulla, M., & Iraqi, Y. (2021). A review of ISO/IEC 27001 and cloud security. Journal of Information Security and Applications, 58, 102791. https://doi.org/10.1016/j.jisa.2021.102791

Section 3.2, "Cloud Deployment Models": This academic review discusses how the hybrid cloud model allows organizations to "keep critical applications and sensitive data in a private cloud environment while using the public cloud for handling workload spikes or for less sensitive applications," reinforcing the rationale for Skyver's choice.

Scroll to Top