CRISC Information Technology and Security Practice Question
A multinational corporation is migrating its customer relationship management (CRM) system to a public cloud provider. The data includes personally identifiable information (PII) from multiple jurisdictions. Which risk should be considered most critical during the cloud architecture review?
⚠ Common exam trap
Watch out — candidates often confuse technical risks like multi-tenancy or patching with the overriding legal and regulatory risk of data sovereignty, which is the most critical for multinational PII migrations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data sovereignty and cross-border data transfer restrictions
The CRM migration involves PII from multiple jurisdictions, making data sovereignty and cross-border data transfer restrictions the most critical risk. Regulations like GDPR (EU) and local data localization laws (e.g., Russia, China) can impose fines or block transfers if data leaves approved regions. This risk directly impacts legal compliance and operational continuity, outweighing technical concerns like isolation or patching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Multi-tenancy isolation failures
Why it's wrong here
Multi-tenancy isolation is a provider-controlled hypervisor concern, whereas the stem's multi-jurisdiction PII makes lawful cross-border transfer the critical architecture risk. It tempts because isolation failures are a real cloud threat, and this would be the correct answer if the data resided in a single jurisdiction without transfer restrictions.
- ✓
Data sovereignty and cross-border data transfer restrictions
Why this is correct
PII from multiple jurisdictions triggers conflicting legal requirements about where data may reside and when it may cross borders. Data sovereignty and transfer restrictions therefore dominate the architecture review, since violating them creates regulatory and contractual exposure that other cloud risks do not.
- ✗
Shared responsibility model gaps for patching
Why it's wrong here
Patching responsibility is contractually allocated and largely provider-owned for managed services, so it does not address the stem's multi-jurisdiction PII transfer obligations. It tempts because shared responsibility confusion is a genuine cloud risk, and it would be correct if the question concerned unpatched infrastructure rather than regulatory data placement.
- ✗
Vendor lock-in due to proprietary APIs
Why it's wrong here
Lock-in affects portability and future migration costs, not the lawful handling of cross-jurisdictional PII. It is tempting because proprietary APIs genuinely constrain exit strategy, and lock-in would be the critical risk when the architecture's main concern is avoiding dependence on one provider's services.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.