A risk assessment for a multi-tenant SaaS application notes that a vulnerability in the hypervisor or in a shared database engine could expose data belonging to every tenant at once. Which cloud-specific risk category does this describe?

Shared technology issues arise because cloud services are built on components that many tenants share: hypervisors, container hosts, storage and database engines, networking and management systems. Those components were often not designed for strong isolation between mutually distrusting tenants, so a single vulnerability can let one tenant affect or read another's workloads and data. Mitigation relies on provider isolation and patching, plus customer-managed encryption that limits what a cross-tenant breach exposes. Lack of visibility and control describes the customer's limited insight into and influence over provider-managed layers, such as missing platform logs or no say over patch timing; it is a consequence of the model, not the cross-tenant exposure described. Legal and jurisdiction issues concern data location, conflicting laws, government access and e-discovery, none of which is the mechanism here. Cloud service provider insider threats involve provider personnel misusing privileged access; this scenario involves a technical flaw in shared components, not a person acting maliciously. Exam caveat: these four categories are listed together in objective 4.3 of the 2026 outline, so the exam distinguishes them by mechanism: shared component, provider personnel, missing insight, or law. Operational check: review the provider's isolation assurances in its audit reports and confirm tenant data is encrypted with keys scoped to that tenant.