An architect is documenting a cloud programme and needs the standard that defines the cloud computing reference architecture, including the cloud computing roles, sub-roles, activities and functional components. Which statement most accurately distinguishes the two ISO/IEC standards she is weighing up?
- AISO/IEC 17788 defines the reference architecture with its roles and activities, while ISO/IEC 17789 provides only the vocabulary and overview.
- BBoth ISO/IEC 17788 and ISO/IEC 17789 define the reference architecture, and either may be cited interchangeably for roles and activities.
- CISO/IEC 17789 defines the cloud computing reference architecture with its roles, activities and functional components, while ISO/IEC 17788 supplies the overview and vocabulary. Correct
- DISO/IEC 17789 defines controls for public cloud personally identifiable information, while ISO/IEC 17788 lists cloud-specific security controls.
Why A is wrong: This is tempting because both numbers are adjacent and easy to transpose, but it reverses their scope: 17788 is the overview and vocabulary standard, not the reference architecture.
Why B is wrong: It seems safe to treat a paired overview and architecture as interchangeable, but they have distinct scopes, so citing 17788 for the reference architecture would be incorrect.
Why C is correct: Correct: 17789 is the reference architecture standard covering roles, sub-roles, activities and functional components, and 17788 is its companion overview and vocabulary standard.
Why D is wrong: This confuses the architecture standards with the security control standards; PII in public clouds is ISO/IEC 27018 and cloud security controls are ISO/IEC 27017, not the 1778x pair.