CRISC Information Technology and Security Practice Question
A financial institution is implementing a cloud-based data analytics platform. The data includes personally identifiable information (PII) of customers in multiple jurisdictions. Which of the following is the MOST critical risk consideration?
⚠ Common exam trap
The trap here is that candidates often focus on technical risks like shared responsibility or multi-tenancy, but CRISC emphasizes that regulatory compliance (especially with PII across jurisdictions) is the highest-priority risk because it carries direct legal and financial consequences that cannot be overridden by technical controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data sovereignty and compliance with local regulations
The most critical risk is data sovereignty and compliance with local regulations because PII from multiple jurisdictions is subject to varying legal requirements (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil). A cloud-based analytics platform processes and stores this data, and failure to comply can result in severe fines, legal action, and reputational damage. Unlike technical risks like vendor lock-in or multi-tenancy, non-compliance is a direct regulatory and business risk that cannot be mitigated by standard cloud controls alone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vendor lock-in due to proprietary APIs
Why it's wrong here
Vendor lock-in is a concern but not as critical as legal compliance.
- ✗
Shared responsibility model gaps
Why it's wrong here
Gaps in shared responsibility are operational risks, but data sovereignty is paramount for PII.
- ✓
Data sovereignty and compliance with local regulations
Why this is correct
Non-compliance can result in significant fines and legal penalties.
- ✗
Multi-tenancy isolation risks
Why it's wrong here
While important, multi-tenancy risks can be mitigated with proper controls.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.