CRISC Information Technology and Security Practice Question
A company is migrating critical applications to the cloud. The risk manager is assessing the shared responsibility model. Which risk is the customer typically responsible for?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data classification and access control
According to the shared responsibility model, the customer is responsible for data, access management, and application-level security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network infrastructure maintenance
Why it's wrong here
Cloud providers own and maintain the physical network fabric, so network infrastructure maintenance sits with them under the shared responsibility model. It tempts because on-premises estates place this squarely on the customer; there, patching switches and routers would indeed be the customer's duty.
- ✗
Physical security of data centers
Why it's wrong here
Physical data centre security is the provider's domain — they control facilities, personnel and hardware access. It tempts because on-premises deployments make the customer wholly accountable for guarding server rooms; in a colocation or self-hosted scenario, this would be the customer's responsibility.
- ✓
Data classification and access control
Why this is correct
Under the shared responsibility model the provider secures the cloud infrastructure, while the customer always owns its data. Classification and access control are therefore customer duties, governing who may reach data and how it is labelled, regardless of the deployment model chosen.
- ✗
Hypervisor security
Why it's wrong here
Hypervisor security belongs to the cloud provider, who controls the virtualisation layer separating tenants. It tempts because in private-cloud or on-premises virtualisation the customer owns the hypervisor; there, hardening ESXi or Hyper-V would correctly fall to the customer's team.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.