mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: During a risk assessment for a cloud migration…
During a risk assessment for a cloud migration project, the IT risk manager identifies that the organization lacks visibility into the cloud provider's security controls. Which approach should the risk manager recommend to address this risk?
⚠ Common exam trap
Candidates often choose penetration testing (D) as a direct technical solution, not realizing that cloud providers typically restrict such testing and that a SOC 2 report is the established, non-invasive method for gaining visibility into a provider's controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Obtain a third-party audit report (e.g., SOC 2 Type II).
A SOC 2 Type II report provides an independent, third-party assessment of a cloud provider's controls over a period of time, directly addressing the lack of visibility by offering verifiable evidence of control effectiveness. This is the standard approach for gaining assurance over a provider's security posture without relying on internal access or self-reporting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Obtain a third-party audit report (e.g., SOC 2 Type II).
Why this is correct
Provides independent assurance of control effectiveness.
- ✗
Request the provider to self-attest their controls.
Why it's wrong here
Self-attestation lacks independent verification.
- ✗
Accept the risk based on the provider's reputation.
Why it's wrong here
Accepting risk without evidence is not a sound risk management practice.
- ✗
Conduct a penetration test on the provider's infrastructure.
Why it's wrong here
Penetration testing is limited in scope and may not cover all controls.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.