SOC Business Continuity and Disaster Recovery 2

Question 1

Which availability monitoring control best satisfies AICPA Trust Services Criteria requirements?

Accepted Answer

Tracking system uptime against documented SLAs and investigating deviations

Answer

Reviewing employee access logs to detect unauthorized login attempts

Answer

Conducting quarterly penetration tests on production systems

Answer

Encrypting all data at rest using AES-256 encryption standards

Question 2

What is the key distinction between a SOC 2 Type I and Type II report for business continuity controls?

Accepted Answer

Type I evaluates control design at a point in time; Type II tests operating effectiveness over a period

Answer

Type I covers all five Trust Services Criteria; Type II covers only availability and security

Answer

Type I is restricted to management; Type II is available for public distribution

Answer

Type I focuses on financial reporting controls; Type II focuses on operational controls

Question 3

Which backup storage practice best supports SOC 2 availability and continuity requirements?

Accepted Answer

Encrypting backups and storing them at a geographically separated off-site location

Answer

Storing unencrypted backups on-site for the fastest possible restore times

Answer

Keeping all backup copies in the primary data center to simplify management

Answer

Archiving backups to removable media in a locked cabinet within the same building

Question 4

What does MTTR measure in the context of disaster recovery and system reliability?

Accepted Answer

The average time required to restore a failed system to normal operation

Answer

The maximum tolerable time allowed before declaring a formal disaster

Answer

The minimum testing time required for DR plan certification

Answer

The mean number of transactions processed per recovery hour

Question 5

A SOC 2 auditor discovers the service organization's DR plan has not been tested in over 18 months. What is the most likely audit impact?

Accepted Answer

A noted control deficiency, as untested plans cannot demonstrate operating effectiveness

Answer

No audit impact if the plan is comprehensive and well-documented

Answer

A qualified opinion covering all five Trust Services Criteria

Answer

A finding limited to the processing integrity criterion only

Question 6

Which NIST publication provides comprehensive guidance on IT contingency planning?

Accepted Answer

NIST SP 800-34: Contingency Planning Guide for Federal Information Systems

Answer

NIST SP 800-53: Security and Privacy Controls for Information Systems

Answer

NIST SP 800-37: Risk Management Framework for Information Systems

Answer

NIST SP 800-61: Computer Security Incident Handling Guide

Question 7

What is the primary operational difference between a warm site and a cold site?

Accepted Answer

A warm site has hardware pre-installed but needs data restoration; a cold site requires complete setup from scratch

Answer

A warm site is cloud-hosted; a cold site requires physical infrastructure installation

Answer

A warm site supports only read-only operations; a cold site supports full production workloads

Answer

A warm site is maintained by a third party; a cold site is owned exclusively by the organization