CRISC Information Technology and Security Practice Question
A multinational corporation is migrating its customer relationship management (CRM) system to a public cloud provider. The data includes personally identifiable information (PII) from multiple jurisdictions. Which risk should be considered most critical during the cloud architecture review?
⚠ Common exam trap
Watch out — candidates often confuse technical risks like multi-tenancy or patching with the overriding legal and regulatory risk of data sovereignty, which is the most critical for multinational PII migrations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data sovereignty and cross-border data transfer restrictions
The CRM migration involves PII from multiple jurisdictions, making data sovereignty and cross-border data transfer restrictions the most critical risk. Regulations like GDPR (EU) and local data localization laws (e.g., Russia, China) can impose fines or block transfers if data leaves approved regions. This risk directly impacts legal compliance and operational continuity, outweighing technical concerns like isolation or patching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Multi-tenancy isolation failures
Why it's wrong here
While important, isolation failures are a technical risk that can be mitigated; data sovereignty is a legal requirement.
- ✓
Data sovereignty and cross-border data transfer restrictions
Why this is correct
Correct. Data sovereignty is a critical legal risk that must be addressed before migration.
- ✗
Shared responsibility model gaps for patching
Why it's wrong here
Patching gaps are operational risks but can be managed through contractual agreements.
- ✗
Vendor lock-in due to proprietary APIs
Why it's wrong here
Vendor lock-in is a strategic risk but less critical than legal compliance.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.