ISC2 Certified Cloud Security Professional (CCSP) Practice Question

In public cloud and other multi-tenant environments, customers no longer control or even see the physical and virtualization layers that host their workloads. This lack of direct physical and logical access makes it difficult for auditors to obtain evidence about underlying controls such as hypervisor hardening and patch management. The primary assurance challenge is therefore loss of visibility and control over the infrastructure owned and managed by the cloud provider. While hypervisor vulnerabilities, single points of failure, or data remanence are genuine concerns, they describe technical risks rather than the audit-specific problem of being unable to gain sufficient assurance because the infrastructure is outside the customer's span of control.