The correct answer is Plan Do Check Act cycle.

Plan Do Check Act cycle is the iterative management approach that underpins continual improvement in ISO 27001. The standard requires organizations to plan their information security objectives and processes, implement and operate them, monitor and measure performance, and then act on the results to make improvements. This cycle aligns directly with the requirement for ongoing improvement of the information security management system.

COSO Cube framework is focused on enterprise internal control and financial reporting and it is not the management system cycle used by ISO 27001, so it does not form the foundation for continual improvement in this standard.

NIST Cybersecurity Framework is a useful risk management and cybersecurity guidance with functions such as identify, protect, detect, respond, and recover, but it is not the PDCA management cycle that ISO 27001 uses as its continual improvement foundation.

Three Lines of Defence model describes roles and responsibilities for governance and assurance across an organization and it does not provide the iterative Plan Do Check Act methodology that drives continual improvement in an ISO 27001 management system.

Full AWS Practitioner Certification Question