CCSP Legal, Risk, and Compliance Practice Question
A company is using a single cloud provider for all critical services. What is the primary risk this company faces?
⚠ Common exam trap
The trap is selecting a risk that sounds severe (sovereignty, compliance) when the question specifically describes reliance on a single provider — the key signal is 'single' or 'all critical services,' which maps to concentration risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Concentration risk
Concentration risk is the risk that reliance on a single provider, vendor, region, or service creates a single point of failure — an outage, bankruptcy, or contractual dispute with that provider can disrupt all critical services simultaneously. Using one cloud provider for all critical services is the textbook definition of concentration risk in cloud governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data sovereignty risk
Why it's wrong here
Data sovereignty depends on where data is stored and processed, which a single provider can satisfy through regional deployment. It is tempting because jurisdiction is a real cloud concern, and sovereignty would be the primary risk when the stem specified data crossing borders or residing outside a mandated geography.
- ✗
Compliance risk
Why it's wrong here
Compliance risk arises from workload or data characteristics, not from using one provider; a multi-provider estate can breach the same rules. It is tempting because provider-specific certifications matter, and compliance would be the primary concern when the stem described regulated data mapped to a provider lacking the required attestation.
- ✗
Insider threat risk
Why it's wrong here
Insider threat exists in every deployment model, so it is not caused by single-provider concentration. It is tempting because insider misuse is a genuine cloud risk, and insider-threat controls would be the focus when the scenario described privileged administrators abusing their access rather than provider dependency.
- ✓
Concentration risk
Why this is correct
Relying on a single cloud provider creates concentration risk: an outage, breach, or provider failure disrupts all critical services simultaneously, with no failover path. This dependency, rather than portability or lock-in alone, is the primary risk.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.