Exam CCSK topic 1 question 43 discussion

I have to be careful here but if I put on my Shared Responsibility Model hat here, E feels more like the CSP responsibility, while the question talks about CSC business continuity management which kinda leans more to D. So im thinking D.

D. Clients need to do business continuity planning due diligence in case they suddenly need to switch providers. Cloud computing has indeed shifted the focus of business continuity management to vendor management, and clients need to carefully plan and consider their contracts and agreements with their cloud vendors to ensure continuity of business operations. This includes planning for potential outages, vendor discontinuance, or scenarios where they may have to switch providers. It's not just about technicalities - legal, contractual, and business aspects also play a significant role in cloud continuity management.

beside the below mentioned references, you should consider that despite there can more AZ in a region, it doesn't mean your application is disaster resistant if you don't implement it in that way to work on Multi AZ. So finally it is up the consumer's due diligence to care with Business Continuity.

pg 68: 6.0.1 Business Continuity and Disaster Recovery in the Cloud. Refer to this section. Last bullet point: Considering options for portability, in case you need to migrate providers or platforms. This could be due to anything from desiring a different feature set to the complete loss of the provider if, for example, they go out of business or you have a legal dispute.

I think D is the answer. Not all cloud providers provide the Geographical Redundancy mentioned (or it could be an extra charge). While the provider Geographic redundancy will help in case of a datacentre DR event, what if a critical system (e.g. IaaS) fails in the cloud -> Geographical Redundancy I dont think will help you, so for that you need to do your own BCP Planning. I would go with D but it is a badly worded question, me thinks :-).

In option D, the customer's responsibility is expressed, and in option E, the provider's statement "Geographic redundancy ensures that Cloud Providers provide highly available services." has a significant impact on ensuring business continuity. As if option E was a more correct answer I think. The question asked about the impact of the provider side.

Although the question is a little vague, here is my opinion: E is not the right response because it cannot be categorized as impact.  As stated on page 73 of Security-Guidance-v4.0, "For example, the odds of a major IaaS provider going out of business or changing their entire business model are low, but this isn’t all that uncommon for a smaller venture-backed SaaS provider". Thus, the following statement sounds like an impact to me: "Clients need to do business continuity planning due diligence in case they suddenly need to switch providers.". Thus, I will go with option D.

Where did you obtain the description provided in the comments?

The statement that best describes the impact of Cloud Computing on business continuity management is: D. Clients need to do business continuity planning due diligence in case they suddenly need to switch providers. Cloud computing introduces new considerations for business continuity management. While cloud services can provide advantages such as scalability and redundancy, organizations must still ensure they have proper business continuity plans in place. This includes conducting due diligence in terms of understanding the provider's service-level agreements (SLAs), data backup and recovery processes, and the potential need to switch providers in case of service disruptions or other unforeseen events. Organizations need to have plans in place to handle such scenarios and ensure the continuity of their operations. Business continuity planning is crucial to mitigate risks and maintain the availability and resilience of critical systems and services, even in the cloud computing context.