CRISC Information Technology and Security Practice Question
A financial institution is implementing a cloud-based data analytics platform. The data includes personally identifiable information (PII) of customers in multiple jurisdictions. Which of the following is the MOST critical risk consideration?
⚠ Common exam trap
The trap here is that candidates often focus on technical risks like shared responsibility or multi-tenancy, but CRISC emphasizes that regulatory compliance (especially with PII across jurisdictions) is the highest-priority risk because it carries direct legal and financial consequences that cannot be overridden by technical controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data sovereignty and compliance with local regulations
The most critical risk is data sovereignty and compliance with local regulations because PII from multiple jurisdictions is subject to varying legal requirements (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil). A cloud-based analytics platform processes and stores this data, and failure to comply can result in severe fines, legal action, and reputational damage. Unlike technical risks like vendor lock-in or multi-tenancy, non-compliance is a direct regulatory and business risk that cannot be mitigated by standard cloud controls alone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vendor lock-in due to proprietary APIs
Why it's wrong here
Vendor lock-in affects future portability and cost, not the lawful processing of multi-jurisdiction PII, so it leaves the regulatory exposure unaddressed. It is tempting because proprietary APIs do constrain exit, and lock-in would be the leading consideration when selecting a platform for workloads carrying no personal data.
- ✗
Shared responsibility model gaps
Why it's wrong here
Shared responsibility gaps concern who secures which layer, not the cross-border handling of PII itself, so they do not address the jurisdictional obligations driving this scenario. It is tempting because misaligned duties genuinely cause breaches, and it would be the right focus for a platform hosting non-regulated workloads.
- ✓
Data sovereignty and compliance with local regulations
Why this is correct
PII spanning multiple jurisdictions triggers conflicting residency and privacy mandates, so data sovereignty and local regulatory compliance dominate. Where data resides and which laws govern it determine lawful processing, transfer restrictions and breach liability, outweighing other cloud analytics risks.
- ✗
Multi-tenancy isolation risks
Why it's wrong here
Multi-tenancy isolation concerns logical separation between cloud customers, not the residency and consent rules applying to PII across jurisdictions. It is tempting because tenant leakage is a real breach vector, and it would be the priority when the platform stores only non-personal or single-jurisdiction data.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.