Discuss EC-Council 112-51 Exam Topic 3 Question 39

Which of the following ISO standards provides guidance to ensure that cloud service providers offer appropriate information security controls to protect the privacy of their customer's clients by securing personally identifiable information entrusted to them?

AISO/IEC 27001

BISO/IEC 27018

CISO/IEC 27011

DISO/IEC 27007

Suggested Answer: B

ISO/IEC 27018 is the ISO standard that provides guidance to ensure that cloud service providers offer appropriate information security controls to protect the privacy of their customer's clients by securing personally identifiable information entrusted to them. ISO/IEC 27018 is a code of practice for protecting personal information in cloud storage. The term for the personal data it covers is Personally Identifiable Information or PII. ISO/IEC 27018 is an addendum to ISO/IEC 27001, the first international code of practice for cloud privacy. It helps cloud service providers who process PII to assess risk and implement controls for protecting PII. ISO/IEC 27018 was created in 2014 and updated in 2019. It has the following objectives:

Help the public cloud service provider to comply with applicable obligations when acting as a PII processor, whether such obligations fall on the PII processor directly or through contract.

Enable the public cloud PII processor to be transparent in relevant matters so that cloud service customers can select well-governed cloud-based PII processing services.

Assist the cloud service customer and the public cloud PII processor in entering into a contractual agreement.

Provide cloud service customers with a mechanism for exercising audit and compliance rights and responsibilities in cases where individual cloud service customer audits of data hosted in a multiparty, virtualized server (cloud) environment can be impractical technically and can increase risks to those physical and logical network security controls in place123.

ISO/IEC 27018: Protecting PII in Public Clouds - ISMS.online, ISMS.online, 2019

ISO/IEC 27018 - Wikipedia, Wikipedia, 2021

ISO/IEC 27018:2019 - Information technology --- Security techniques --- Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors, ISO, 2019

Get Premium 112-51 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

32 comments · newest first

Lazaro 6 months ago

I feel confident with B too. It’s tailored for cloud service providers.

Derick 6 months ago

27001 is good, but 27018 is specifically for cloud privacy.

Coral 7 months ago

I’m not so sure. What about A) ISO/IEC 27001? It’s more general.

Buffy 7 months ago

Agreed! 27018 is all about privacy in the cloud.

Shizue 7 months ago

I think it's B) ISO/IEC 27018. It focuses on PII protection.

Vincenza 7 months ago

Agreed, 27018 is the one for PII protection!

Verdell 7 months ago

Wait, are you sure about that?

Melina 7 months ago

27018 is all about privacy, right?

Elly 8 months ago

I thought it was 27001, though.

Cordelia 8 months ago

It's definitely ISO/IEC 27018!

Leonor 8 months ago

B, because who wants their personal info exposed in the cloud? Not me, that's for sure!

Sherell 9 months ago

B, no doubt. I'd be worried if the cloud provider wasn't following that standard.

Dyan 9 months ago

ISO/IEC 27018 is the way to go. Gotta keep that personal data safe in the cloud!

Sue 9 months ago

I'm going with B. Seems like the obvious choice to me.

Simona 9 months ago

Definitely B. I can't imagine any other standard being more relevant for cloud privacy and security.

Scarlet 9 months ago

ISO/IEC 27018 is the correct answer. It provides guidance on protecting personally identifiable information in the cloud.

Wenona 9 months ago

I remember that ISO/IEC 27018 is specifically for cloud service providers and their responsibilities regarding personal data. That seems like the right answer!

Leonard 10 months ago

B) ISO/IEC 27018 sounds like the most relevant standard based on the information provided in the question. I'm fairly confident that's the right choice.

Shalon 10 months ago

This is a tricky one. I'll have to carefully read through the question and options to figure out the best answer.

Vivienne 10 months ago

Okay, I remember learning about ISO/IEC 27018 in class. That's the one that provides guidance on protecting personally identifiable information in the cloud, right?

Erick 10 months ago

I’m a bit confused about ISO/IEC 27011 and 27007. I think 27011 relates to telecommunications, but I can't recall what 27007 covers.

Evangelina 10 months ago

I practiced a similar question, and I believe ISO/IEC 27001 is more about general information security management, not specifically for cloud services.

Dylan 10 months ago

I think it's ISO/IEC 27018, but I'm not entirely sure. I remember it focuses on protecting personal data in the cloud.

Mammie 11 months ago

ISO/IEC 27018 all the way! Wouldn't want my data floating around in the cloud without proper protection.

Valentin 11 months ago

Yeah, 27018 seems like the best fit for this question!

Renay 11 months ago

Hmm, I'm not too sure about this one. I'll have to review the details of those ISO standards to make a confident choice.

Helene 11 months ago

I think B) ISO/IEC 27018 is the right answer, as it specifically addresses privacy controls for cloud service providers.

Jolanda 4 months ago

↳ replying to Helene

Definitely B) is the best choice for cloud security.

Tabetha 6 months ago

↳ replying to Helene

But 27018 specifically targets cloud services!

Kayleigh 6 months ago

↳ replying to Helene

I think A) ISO/IEC 27001 is more general though.

Dana 6 months ago

↳ replying to Helene

Yes, it’s all about protecting personal data.

Odelia 6 months ago

↳ replying to Helene

I agree, B) ISO/IEC 27018 is focused on privacy.

EC-Council 112-51 Exam - Topic 3 Question 39 Discussion