nerdexam
Isaca

CISM · Question #80

Management would like to understand the risk associated with engaging an Infrastructure-as-a- Service (IaaS) provider compared to hosting internally. Which of the following would provide the BEST…

The correct answer is B. Mapping the risk scenarios by likelihood and impact on a chart. Mapping risk scenarios by their likelihood and impact on a chart provides the best comparative visualization for management to understand and weigh different risk profiles between IaaS and internal hosting.

Submitted by the_admin· Apr 18, 2026Information Security Risk Management

Question

Management would like to understand the risk associated with engaging an Infrastructure-as-a- Service (IaaS) provider compared to hosting internally. Which of the following would provide the BEST method of comparing risk scenarios?

Options

  • AReviewing mitigating and compensating controls for each risk scenario
  • BMapping the risk scenarios by likelihood and impact on a chart
  • CPerforming a risk assessment on the IaaS provider
  • DMapping risk scenarios according to sensitivity of data

How the community answered

(21 responses)
  • A
    5% (1)
  • B
    81% (17)
  • C
    10% (2)
  • D
    5% (1)

Why each option

Mapping risk scenarios by their likelihood and impact on a chart provides the best comparative visualization for management to understand and weigh different risk profiles between IaaS and internal hosting.

AReviewing mitigating and compensating controls for each risk scenario

Reviewing controls is part of a detailed risk assessment but doesn't, on its own, provide a comparative overview of *risk scenarios* to management in the most effective way.

BMapping the risk scenarios by likelihood and impact on a chartCorrect

A risk matrix or chart that plots likelihood against impact for each risk scenario (IaaS vs. internal hosting) offers a clear, high-level, and easily digestible comparison for management. This visual representation allows them to immediately grasp the relative magnitude of risks, enabling informed decision-making based on the most critical factors.

CPerforming a risk assessment on the IaaS provider

Performing a risk assessment on the IaaS provider is necessary, but it only addresses one side of the comparison and doesn't explicitly provide a method for comparing *both* scenarios.

DMapping risk scenarios according to sensitivity of data

Mapping by sensitivity of data is an aspect of risk assessment but doesn't encompass the full spectrum of risk factors (like operational, legal, financial) that management needs to compare across different hosting models.

Concept tested: Risk comparison and visualization methods

Source: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/reference/risk-matrix

Topics

#Risk Assessment Methodology#Risk Comparison#Likelihood and Impact#Cloud Security Risk

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISM Practice