CCSP Legal, Risk, and Compliance Practice Question
A cloud customer is concerned about the risk of unauthorized access to data due to the shared infrastructure of a public cloud. What type of risk does this represent?
⚠ Common exam trap
CCSP often tests the distinction between inherent, residual, control, and detection risk — candidates must recognize that the question describes exposure before mitigation, which is inherent risk, not residual risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inherent risk
Inherent risk is the level of risk that exists before any controls are applied, arising from the nature of the activity or environment itself. The shared infrastructure of a public cloud introduces exposure to unauthorized access due to multi-tenancy, and this exposure exists inherently before the customer implements mitigating controls — making it an inherent risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Control risk
Why it's wrong here
Control risk concerns the customer's inability to enforce its own controls over provider-managed infrastructure, not exposure created by multi-tenancy itself. It is tempting because shared infrastructure limits customer control, but the scenario describes unauthorised access arising from that sharing.
- ✗
Detection risk
Why it's wrong here
Detection risk concerns controls failing to identify an event, not exposure created by multi-tenancy itself. Shared infrastructure enabling unauthorised access is a multi-tenancy or isolation risk. Detection risk would be the answer if the question asked about monitoring or logging failing to spot a breach after it occurred.
- ✓
Inherent risk
Why this is correct
Inherent risk is the risk that exists before any controls are applied, arising here from the public cloud's shared infrastructure exposing data to unauthorised access. It reflects the exposure intrinsic to the chosen architecture, not residual or control risk.
- ✗
Residual risk
Why it's wrong here
Residual risk is what remains after controls are applied, whereas the scenario describes an inherent risk from multi-tenancy before mitigation. It is tempting because shared infrastructure risk may persist, but no controls or treatment have yet been described.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.