hardMultiple SelectObjective-mapped
CCSP Practice Question: Which THREE of the following are key…
Which THREE of the following are key considerations when conducting a cloud risk assessment?
⚠ Common exam trap
ISC2 often tests the distinction between operational metrics (like latency) and risk assessment inputs, tricking candidates into selecting performance-related options as risk factors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reviewing legal and regulatory requirements applicable to the organization
Legal and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS) directly dictate data residency, privacy controls, and breach notification obligations. A cloud risk assessment must map these requirements to the specific cloud deployment to identify compliance gaps and potential liabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Reviewing legal and regulatory requirements applicable to the organization
Why this is correct
Compliance with laws is a key risk consideration.
- ✗
Analyzing network latency between cloud regions
Why it's wrong here
Latency is a performance metric, not a risk factor.
- ✓
Identifying threats specific to cloud deployment models (IaaS, PaaS, SaaS)
Why this is correct
Each model has unique threats.
- ✗
Evaluating the CSP's physical security controls in detail
Why it's wrong here
Physical security is often inherited from the CSP and not a primary focus in customer risk assessment.
- ✓
Assessing the impact of shared tenancy on data isolation
Why this is correct
Shared tenancy introduces risks of resource isolation failure.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.