Information Technology and Security →hardMultiple SelectObjective-mapped

CRISC Information Technology and Security Practice Question

A global company is moving its critical applications to a public cloud. Which THREE of the following are key risk considerations in the shared responsibility model?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Identity and access management

Data security, identity management, and compliance are typically customer responsibilities, while physical security is the provider's. Misunderstanding these can lead to gaps.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Physical security of data centers
Why it's wrong here
This is the provider's responsibility.
✓
Identity and access management
Why this is correct
Customers manage user identities and access controls.
✓
Compliance with regulatory requirements for data handling
Why this is correct
Customers must ensure their use of cloud services complies with regulations.
✓
Data encryption and key management
Why this is correct
Customers are responsible for encrypting their data and managing keys.
✗
Network firewall configuration
Why it's wrong here
Often a shared responsibility, but the customer typically configures firewalls.

Go deeper

CRISC Information Technology and Security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question