The correct answer is to conduct a legal review to assess regulatory implications and contractual safeguards. This is the most appropriate next step because cloud data protection regulations vary by jurisdiction, and a vendor’s data center located in a foreign country introduces potential conflicts between local laws and the organization’s compliance obligations, such as GDPR or HIPAA. Without first understanding these legal gaps through a formal review, any technical or risk acceptance decision would be premature and could expose the organization to regulatory penalties. On the CRISC exam, this scenario tests your understanding of the risk assessment process, specifically that legal and compliance analysis must precede risk treatment when cross-border data flows are involved. A common trap is to jump to technical controls like encryption, but the exam emphasizes that contractual safeguards—such as Standard Contractual Clauses—must be validated by legal counsel first. Remember the mnemonic “Legal First, Tech Later” to avoid choosing a technical fix before addressing regulatory compliance.
CRISC IT Risk Assessment Practice Question
This CRISC practice question tests your understanding of it risk assessment. Compare every option against the stated constraints before choosing — the best answer satisfies all requirements, not just the most obvious one. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During an IT risk assessment for a new cloud-based customer relationship management (CRM) system, the risk practitioner identifies that the vendor's data center is located in a country with different data protection regulations. Which of the following is the MOST appropriate next step?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a legal review to assess regulatory implications and contractual safeguards.
When a cloud vendor's data center is in a jurisdiction with different data protection regulations, the immediate priority is to understand the legal and contractual implications before making any technical or risk acceptance decisions. A legal review will identify specific regulatory conflicts (e.g., GDPR vs. local law) and assess whether existing contractual safeguards (such as Standard Contractual Clauses or Binding Corporate Rules) adequately address the gap. This step ensures that subsequent risk treatment decisions are informed by compliance requirements rather than assumptions.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Conduct a legal review to assess regulatory implications and contractual safeguards.
Why this is correct
Legal review ensures compliance and identifies necessary controls.
Related concept
Read the scenario before looking for a memorised answer.
✗
Recommend migrating to a different cloud provider.
Why it's wrong here
Migration is premature without analyzing legal risks.
✗
Implement technical controls to encrypt data in transit and at rest.
Why it's wrong here
Technical controls cannot substitute for legal compliance.
✗
Accept the risk because the vendor is compliant with industry standards.
Why it's wrong here
Accepting the risk without understanding legal implications is inappropriate.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often jump to technical controls (encryption) as a universal solution, overlooking that regulatory compliance is a legal and contractual issue that cannot be fully resolved by encryption alone.
Detailed technical explanation
How to think about this question
Under the hood, data protection regulations like GDPR impose strict conditions on cross-border data transfers, requiring either an adequacy decision, Standard Contractual Clauses (SCCs), or Binding Corporate Rules (BCRs). Even with encryption, a foreign government may compel the vendor to provide decryption keys or access data under local laws (e.g., the US CLOUD Act), which can override contractual protections. A legal review would examine whether the vendor's data center location triggers such risks and whether the contract includes specific provisions like data processing agreements (DPAs) or sub-processor restrictions to mitigate them.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CRISC exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
IT Risk Assessment — This question tests IT Risk Assessment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Conduct a legal review to assess regulatory implications and contractual safeguards. — When a cloud vendor's data center is in a jurisdiction with different data protection regulations, the immediate priority is to understand the legal and contractual implications before making any technical or risk acceptance decisions. A legal review will identify specific regulatory conflicts (e.g., GDPR vs. local law) and assess whether existing contractual safeguards (such as Standard Contractual Clauses or Binding Corporate Rules) adequately address the gap. This step ensures that subsequent risk treatment decisions are informed by compliance requirements rather than assumptions.
What should I do if I get this CRISC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.