Best method for comparing IaaS and internal hosting risk scenarios?

Information Risk Management
Answer Correct answer: B — Map the risk scenarios by likelihood and impact on a chart.

Management would like to understand the risk associated with engaging an Infrastructure-as-a-Service (IaaS) provider compared to hosting internally. Which of the following would provide the BEST method of comparing risk scenarios?

  1. Reviewing mitigating and compensating controls for each risk scenario
  2. Mapping the risk scenarios by likelihood and impact on a chart Correct Answer
  3. Performing a risk assessment on the IaaS provider
  4. Mapping risk scenarios according to sensitivity of data
iaas risk comparison risk assessment methods cism risk analysis heat map risk

Community Votes

B
67%
C
33%

67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the ability to select a comparative analysis tool, where the trap is choosing a specific assessment action (Option C) rather than the visualization method required for comparison.

To compare the risks of IaaS versus internal hosting, mapping scenarios by likelihood and impact is the most effective method. This approach creates a visual heat map that allows management to directly evaluate the relative severity of risks across different environments.

The most common mistake is selecting Option C (Performing a risk assessment on the IaaS provider) because it sounds relevant, but it fails to provide a direct comparison framework against internal hosting.

Community Discussion (4 comments)

helg420 👍 1 Selected: B
Mapping risk scenarios by their likelihood and impact provides a visual representation (heat map) that makes it easier to compare the range and severity of risks associated with each option. C addresses only half of the comparison.
Y0GA 👍 1 Selected: B
To add to the confusion, here is GPT4o and GPT4 explaining why it's not C: (1) Comparative Analysis: Mapping risk scenarios by likelihood and impact allows for a direct comparison between the risks associated with the IaaS provider and those of internal hosting. This visual comparison helps management understand the relative severity of different risks in both contexts. (2) Holistic View: A risk assessment on the IaaS provider (option C) focuses solely on the external provider's risks, without directly comparing them to internal risks. Option B, on the other hand, includes both internal and external risk scenarios on the same chart, offering a holistic view. (3) Decision-Making: Management can make more informed decisions when they see how risks compare in terms of both likelihood and impact. This approach supports strategic decision-making by clearly showing which environment (IaaS or internal) presents higher or lower risks. GPT3.5 said C. Anyone have any quotes from the ISACA book to determine if its C or B?
shootnot 👍 2 Selected: B
question is about the 'method' of comparing risk scenarios. C would only give risk but nothing to compare to decision making
ats20 👍 2 Selected: C
Risk assessment

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Mapping risk scenarios by likelihood and impact (Option B) creates a risk matrix or heat map. This visual tool is specifically designed for comparing disparate risks on a common scale. It allows management to see if the high-impact risks of IaaS are more or less severe than the high-likelihood risks of internal hosting.

Why the Other Options Are Wrong

Option C is incorrect because assessing only the IaaS provider does not inherently facilitate a comparison; it only identifies risks for one party. Option A focuses on controls, which is a mitigation step, not a comparison method. Option D focuses on data sensitivity, which is a factor in risk but not a method for comparing scenarios.

Community Comment Notes

Comments highlight that Option B provides the "visual representation" needed for decision-making, whereas Option C is limited because it only addresses "half of the comparison." Users noted that a heat map allows for a holistic view of both scenarios side-by-side.

Official Reference

https://www.isaca.org/resources/certified-information-security-manager

Exam Strategy

When questions ask for a "method of comparison" or "best way to present to management," look for tools that visualize data, such as heat maps or matrices. Avoid options that describe specific technical actions unless the question specifically asks for the next step in the process.

Related Analysis

Which of the following is MOST important for effective cyber

S-Grade

Which of the following is the BEST control to protect custom

A-Grade

Which of the following will have the GREATEST impact on the

A-Grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide