Best method for comparing IaaS and internal hosting risk scenarios?

CISM By islever Editorial Last updated

Short answer

B Map the risk scenarios by likelihood and impact on a chart.

Question

Management would like to understand the risk associated with engaging an Infrastructure-as-a-Service (IaaS) provider compared to hosting internally. Which of the following would provide the BEST method of comparing risk scenarios?
  1. Reviewing mitigating and compensating controls for each risk scenario
  2. Mapping the risk scenarios by likelihood and impact on a chart Correct Answer
  3. Performing a risk assessment on the IaaS provider
  4. Mapping risk scenarios according to sensitivity of data

Key Takeaways

This question tests the ability to select a comparative analysis tool, where the trap is choosing a specific assessment action (Option C) rather than the visualization method required for comparison.

To compare the risks of IaaS versus internal hosting, mapping scenarios by likelihood and impact is the most effective method. This approach creates a visual heat map that allows management to directly evaluate the relative severity of risks across different environments.

Common mistake: The most common mistake is selecting Option C (Performing a risk assessment on the IaaS provider) because it sounds relevant, but it fails to provide a direct comparison framework against internal hosting.

Expert Analysis

Why the Answer Is Correct

Mapping risk scenarios by likelihood and impact (Option B) creates a risk matrix or heat map. This visual tool is specifically designed for comparing disparate risks on a common scale. It allows management to see if the high-impact risks of IaaS are more or less severe than the high-likelihood risks of internal hosting.

Why the Other Options Are Wrong

Option C is incorrect because assessing only the IaaS provider does not inherently facilitate a comparison; it only identifies risks for one party. Option A focuses on controls, which is a mitigation step, not a comparison method. Option D focuses on data sensitivity, which is a factor in risk but not a method for comparing scenarios.

Community Comment Notes

Comments highlight that Option B provides the "visual representation" needed for decision-making, whereas Option C is limited because it only addresses "half of the comparison." Users noted that a heat map allows for a holistic view of both scenarios side-by-side.

Exam Strategy

When questions ask for a "method of comparison" or "best way to present to management," look for tools that visualize data, such as heat maps or matrices. Avoid options that describe specific technical actions unless the question specifically asks for the next step in the process.

Community Votes

B
67%
C
33%

67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. shootnot 👍 2 Answered B
    question is about the 'method' of comparing risk scenarios. C would only give risk but nothing to compare to decision making
  2. Y0GA 👍 1 Answered B
    To add to the confusion, here is GPT4o and GPT4 explaining why it's not C: (1) Comparative Analysis: Mapping risk scenarios by likelihood and impact allows for a direct comparison between the risks associated with the IaaS provider and those of internal hosting. This visual comparison helps management understand the relative severity of different risks in both contexts. (2) Holistic View: A risk assessment on the IaaS provider (option C) focuses solely on the external provider's risks, without directly comparing them to internal risks. Option B, on the other hand, includes both internal and external risk scenarios on the same chart, offering a holistic view. (3) Decision-Making: Management can make more informed decisions when they see how risks compare in terms of both likelihood and impact. This approach supports strategic decision-making by clearly showing which environment (IaaS or internal) presents higher or lower risks. GPT3.5 said C. Anyone have any quotes from the ISACA book to determine if its C or B?
  3. helg420 👍 1 Answered B
    Mapping risk scenarios by their likelihood and impact provides a visual representation (heat map) that makes it easier to compare the range and severity of risks associated with each option. C addresses only half of the comparison.
  4. ats20 👍 2 Answered C
    Risk assessment

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Best Defense Against DDoS Attacks in Enterprise Networks?

S-grade

When Should a Business Continuity Plan Be Primarily Triggered?

S-grade

Which Approach Best Communicates Security to Senior Management?

S-grade

How to Keep a Business Continuity Plan Current?

S-grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide