Relying on a one size fits all checklist is the correct answer.

ISO/IEC 27001 requires a risk based and context driven approach when selecting and applying information security controls. The standard expects organizations to identify their context, assess risks, and choose or adapt controls accordingly rather than applying the same checklist to every situation.

The standard references Annex A as a catalog of controls and it expects organizations to justify which controls are applicable through their risk assessment and treatment process. Using a blanket checklist does not demonstrate that controls are appropriate for the organization or that risks have been assessed and treated.

Supporting security across the entire system lifecycle is not wrong because ISO/IEC 27001 encourages integration of information security into processes and across the system lifecycle and it supports secure development and maintenance practices.

Cloud Identity is not wrong because identity and access management are legitimate control areas within ISO/IEC 27001 and the standard can be applied to cloud services and cloud identity solutions when they are relevant to the organization.

Protecting organizational and stakeholder confidence is not wrong because preserving confidentiality, integrity, and availability and maintaining stakeholder trust are central objectives of ISO/IEC 27001 and its risk based approach.

Full AWS Practitioner Certification Question