CCSP Legal, Risk, and Compliance Practice Question
When assessing cloud risk, an organization identifies that if a single cloud provider fails, the organization cannot operate. This risk is known as:
⚠ Common exam trap
CCSP often tests the distinction between concentration risk and general third-party risk — candidates pick 'third-party risk' because a cloud provider is a third party, but the specific scenario of single-provider dependency is concentration risk, a narrower and more precise term.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Concentration risk
Concentration risk is the risk that arises from over-reliance on a single provider, system, or counterparty — in cloud terms, if one provider fails and the organization cannot operate, that dependency is a concentration risk. It is a well-known concept in financial services (e.g., reliance on a single clearing bank) and applies directly to cloud, where multi-cloud or hybrid strategies are often adopted specifically to mitigate it. The scenario describes exactly this single-point-of-failure dependency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Third-party risk
Why it's wrong here
Third-party risk covers supplier failures generally, including performance, compliance and financial exposure, not specifically the inability to operate without one provider. It tempts because a cloud provider is a third party, but the scenario describes concentration or lock-in risk.
- ✗
Inherent risk
Why it's wrong here
Inherent risk is the exposure present before any controls are applied, not the concentration exposure itself. It tempts because the scenario describes an untreated risk, but the named risk arising from dependence on one provider is vendor lock-in or concentration risk.
- ✓
Concentration risk
Why this is correct
Concentration risk arises when dependency on a single provider creates correlated failure exposure, so one outage halts all operations. Unlike operational or compliance risk, it specifically measures over-reliance on one entity, matching the stem's single-provider failure scenario.
- ✗
Residual risk
Why it's wrong here
Residual risk is what remains after controls are implemented, so it describes post-mitigation exposure rather than the identified single-provider dependency. It tempts because the organisation currently tolerates the exposure, but no controls have yet reduced it.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.