CRISC Information Technology and Security Practice Question
A risk manager is evaluating the risks associated with using a public cloud provider. Which TWO of the following are key considerations for multi-tenancy isolation? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk of misconfigured cloud storage exposing another tenant's data
Multi-tenancy isolation in a public cloud involves risks that could allow one tenant to access another tenant's data. The correct choices are C (Risk of misconfigured cloud storage exposing another tenant's data) and E (Risk of hypervisor escape attacks). Option C is correct because misconfigured storage buckets or databases can inadvertently expose data to other tenants if access controls are not properly set. Option E is correct because vulnerabilities in the hypervisor could allow a malicious tenant to break out of their virtual machine and access the host or other VMs, compromising isolation. Option A (shared responsibility) is about understanding security roles, not isolation. Option B (vendor lock-in) relates to dependency on a single provider, not isolation. Option D (data sovereignty) concerns legal and geographic compliance, not isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk of unclear shared responsibility
Why it's wrong here
Shared responsibility is a separate issue.
- ✗
Risk of vendor lock-in
Why it's wrong here
Vendor lock-in is not related to multi-tenancy isolation.
- ✓
Risk of misconfigured cloud storage exposing another tenant's data
Why this is correct
Misconfiguration can lead to cross-tenant exposure.
- ✗
Risk of data sovereignty violations
Why it's wrong here
Data sovereignty is about legal jurisdiction.
- ✓
Risk of hypervisor escape attacks
Why this is correct
Hypervisor escape is a direct multi-tenancy risk.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.