SOC Information Security and Data Privacy Controls 2

Question 1

Under SOC 2, which Trust Service Criteria category specifically addresses the protection of personal information collected, used, retained, and disclosed?

Accepted Answer

Privacy

Answer

The Privacy criteria (P series) in SOC 2 specifically governs how personal information is collected, used, retained, disclosed, and disposed of in conformity with commitments and applicable regulations.

Question 2

A company stores encrypted backups offsite but the encryption keys are kept in the same location as the backups. Which control weakness does this represent?

Accepted Answer

Failure to segregate key management from encrypted data

Answer

Storing encryption keys with the encrypted data defeats the purpose of encryption, as an attacker who gains access to the backup also gains the keys needed to decrypt it.

Question 3

Which of the following best describes a data retention policy in the context of SOC 2 Privacy criteria?

Accepted Answer

A policy defining how long data must be stored before disposal based on legal and business requirements

Answer

A data retention policy defines the periods for which personal information is retained based on legal obligations, business needs, and privacy commitments before it is securely disposed of.

Question 4

During a SOC 2 examination, auditors discover that access to the HR database is granted based on job title alone, without individual review. This violates which principle?

Accepted Answer

Least privilege

Answer

Least privilege requires that access rights be granted based on individual need-to-know, not broad role assignments, to minimize the risk of unauthorized data exposure.

Question 5

A SOC 2 report user notices the report covers only the period January 1 to March 31. What is the significance of this date range?

Accepted Answer

It defines the period of time controls were tested and must be verified for ongoing engagements

Answer

The examination period in a SOC 2 Type II report specifies the duration over which controls were observed and tested, and report users must consider whether this period aligns with their own risk assessment needs.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Information Security and Data Privacy Controls 2