The best answer is B. End users are able to create their own cloud server instances.

The biggest concern is uncontrolled provisioning, because allowing end users to create their own server instances can bypass governance, security baselines, cost controls, asset management, and monitoring. ISACA’s cloud and auditable security guidance emphasizes the importance of strong governance, control over misconfigurations, and consistent security baselines in cloud environments. Unrestricted self-provisioning significantly increases the risk of shadow IT and insecure deployments.

Option A is usually a normal protective arrangement. Option C can be appropriate depending on design and identity strategy. Option D is a governance weakness, but it is less immediate than uncontrolled creation of cloud infrastructure by end users. In audit terms, uncontrolled server creation directly threatens configuration, access control, and accountability.

References (Official ISACA):

ISACA, Best Practices for Auditable Security Controls

ISACA, The Role of Digital Transformation Audits