CRISC Information Technology and Security Practice Question
An organization is developing a new cloud-based application that will process personal data of EU citizens. The risk manager is assessing the shared responsibility model with the cloud service provider (CSP). Which of the following is the MOST critical risk to address in the risk assessment?
⚠ Common exam trap
CRISC often tests the distinction between technical security risks and regulatory compliance risks — candidates pick encryption or isolation because they sound like 'security,' missing that GDPR data sovereignty is the dominant legal risk when EU personal data is involved.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data sovereignty and cross-border data transfer restrictions
When processing EU citizens' personal data in the cloud, the most critical risk is data sovereignty and cross-border transfer restrictions under GDPR. The regulation limits transfers of personal data outside the EU/EEA unless adequate safeguards (e.g., Standard Contractual Clauses, adequacy decisions) are in place. A CSP may store or replicate data in regions the organization did not intend, creating legal exposure that outweighs the other technical risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Lack of encryption at rest
Why it's wrong here
Encryption at rest is a control the organisation can configure or require contractually, and it addresses confidentiality rather than the shared responsibility split for lawful EU processing. It is tempting because unencrypted storage is a real exposure, and this option would be correct where the CSP offers no native encryption and no customer-managed keys.
- ✗
Vendor lock-in due to proprietary APIs
Why it's wrong here
Vendor lock-in concerns portability and exit cost, not the lawful basis for processing EU personal data. It is tempting because proprietary APIs genuinely raise switching costs, and lock-in assessment belongs in any cloud risk register — but it would be the priority for a non-GDPR workload where migration flexibility outweighs regulatory exposure.
- ✓
Data sovereignty and cross-border data transfer restrictions
Why this is correct
Under GDPR, personal data of EU citizens may not be transferred to jurisdictions lacking adequate protection, and the CSP controls where replicas and backups reside. This legal constraint sits with the organisation, not the provider, so it must be assessed explicitly.
- ✗
Multi-tenancy isolation failures
Why it's wrong here
Multi-tenancy isolation failures concern the CSP's infrastructure controls, which sit largely outside the organisation's direct risk treatment under the shared responsibility model. It tempts because isolation breaches are severe, but the organisation's critical risk is its own misconfiguration of access controls and data handling in the cloud application.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.