hardMultiple Choice
CRISC Practice Question: An international bank is expanding its operations…
An international bank is expanding its operations into a new country with strict data localization laws. The IT department plans to use a cloud service provider that stores data in neighboring countries but promises compliance. The risk team has identified several potential risks: regulatory fines for non-compliance, data interception during cross-border transmission, and difficulty in auditing the cloud provider. The legal team advises that the contract includes data protection clauses, but these have not been tested. The risk manager must now prioritize risk identification efforts. What is the MOST important risk identification step the risk team should undertake?
⚠ Common exam trap
A common mix-up: candidates choose Option B (legal review of contract) because they assume contractual clauses are the primary risk mitigation, but the question asks for risk identification, and without first understanding the local law, the contract's adequacy cannot be evaluated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a regulatory compliance assessment specific to the new country's laws.
The most critical risk identification step when entering a new country with strict data localization laws is to perform a regulatory compliance assessment specific to that country's laws. This ensures the bank understands the exact legal requirements for data storage, processing, and transfer, which directly informs whether the cloud provider's promised compliance is achievable. Without this assessment, the risk team cannot accurately identify the scope and severity of regulatory fines or other legal risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Review the cloud provider's SOC 2 report.
Why it's wrong here
A SOC 2 report attests to the provider's controls over security and availability, but says nothing about the geographic location of data. Localisation compliance depends on where data is stored and processed. SOC 2 review is appropriate when assessing a provider's control environment, not jurisdictional data residency.
- ✗
Conduct a thorough legal review of the contract's data handling clauses.
Why it's wrong here
A legal review of untested contract clauses addresses contractual risk, not the regulatory exposure created by storing data in neighbouring countries. Data localisation laws require data to reside within the jurisdiction; contract wording cannot override statute. Legal review suits vendor negotiation, not identifying where data physically resides.
- ✓
Perform a regulatory compliance assessment specific to the new country's laws.
Why this is correct
Untested contractual clauses cannot demonstrate compliance with the new country's data localization laws, and the provider stores data in neighbouring jurisdictions. A country-specific regulatory compliance assessment establishes the actual legal obligations first, grounding all subsequent risk identification and prioritisation.
- ✗
Map data flows to ensure all data is properly classified.
Why it's wrong here
Mapping data flows and classifying data identifies where information resides and moves, but does not by itself establish whether storage locations satisfy the new country's localisation statute. The priority is determining the actual geographic placement of data against regulatory requirements. Flow mapping supports broader data governance and privacy programmes.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.