I'm preparing for the CCSP exam and another test question is throwing me off.
The question reads:
In all cloud models, security controls are driven by which of the following:
A. Virtualization engine
D. Business Requirements
I chose C. SLAs because:
- Virtualization and hypervisor answers are too technical and not in scope for the context of this question.
- The cloud provider may not necessarily have the same business objectives as the customer so a business requirement for the customer may not align with the goals or security objectives of the cloud provider.
- The SLA is a mutual contractually-binding document describing the extent of service reliability and the scope of overall liability for both parties in the cloud.
Example: if the cloud provider decides to sell all customer information to a customer's competitor, that would be in breach (hopefully) of the security and disclosure terms outlined in the SLA... right?
Obviously though, I'm wrong though according to the test prep material. Could someone please elaborate?
The test prep material considers "D. Business Requirements" the correct answer.