CRISC Information Technology and Security Practice Question
An enterprise is migrating to a public cloud environment. Which THREE of the following are critical cloud-specific risk considerations?
⚠ Common exam trap
CRISC often tests whether candidates distinguish cloud-specific risks (multi-tenancy, sovereignty, shared responsibility) from generic IT risks (latency, legacy compatibility) that exist regardless of cloud.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multi-tenancy isolation failures
Multi-tenancy isolation failures (A) are a cloud-specific risk because public cloud providers co-locate workloads from different customers on shared physical hosts, hypervisors, and storage, so a hypervisor escape or misconfigured tenant boundary can expose another tenant's data. Data sovereignty and legal jurisdiction (C) matter because cloud data may be replicated across regions and countries, subjecting it to differing privacy laws, subpoena powers, and residency requirements that the enterprise cannot control contractually alone. Shared responsibility model gaps (D) are critical because the provider secures the cloud (physical, hypervisor, managed services) while the customer secures what they put in it (IAM, encryption, patching of IaaS guests, misconfigured S3 buckets), and unclear ownership of a control creates exploitable blind spots. On-premises network latency (B) is not cloud-specific since it concerns the legacy data center rather than the public cloud migration itself, and legacy system compatibility (E) is a general migration/modernization concern that applies to any platform change, not a risk unique to public cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Multi-tenancy isolation failures
Why this is correct
Public cloud workloads share physical hosts, hypervisors and network fabric with other tenants, so a hypervisor escape, side-channel attack or misconfigured isolation could expose one tenant's data to another. This risk is specific to shared infrastructure and absent from dedicated on-premises hosting.
- ✗
On-premises network latency
Why it's wrong here
On-premises network latency concerns the existing data centre, not the public cloud provider's infrastructure. It is tempting because latency affects user experience during migration, yet it is a general networking issue. Cloud-specific risks include jurisdiction of data, provider lock-in and insecure API configurations.
- ✓
Data sovereignty and legal jurisdiction
Why this is correct
Data stored in a provider's region may fall under foreign laws, subpoenas or cross-border transfer restrictions. This jurisdictional exposure arises from the cloud's geographic distribution and is a legal risk distinct from purely on-premises hosting.
- ✓
Shared responsibility model gaps
Why this is correct
Cloud providers secure the platform while customers secure their data, identities and configurations. Ambiguity or misunderstanding about where duties divide leaves controls unowned, producing exploitable gaps that are unique to the cloud's divided operational model.
- ✗
Legacy system compatibility
Why it's wrong here
Legacy system compatibility is a general migration concern affecting any platform change, not specific to public cloud. It is tempting because old applications often break during moves, but the same issue arises in on-premises upgrades. Cloud-specific risks include shared responsibility gaps, data residency and multi-tenancy exposure.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.