SOC Information Security and Data Privacy Controls 4

Question 1

An organization discovers that a third-party subprocessor experienced a breach exposing customer data. Under SOC 2, what is the service organization's primary responsibility?

Accepted Answer

Notify affected customers and regulators in accordance with its incident response and breach notification commitments

Answer

Service organizations remain accountable for how their subprocessors handle data and must fulfill their breach notification commitments to customers and applicable regulators regardless of where the breach occurred.

Question 2

Which metric is most useful for evaluating the effectiveness of an organization's vulnerability management program?

Accepted Answer

Mean time to remediate critical vulnerabilities after discovery

Answer

Mean time to remediate (MTTR) critical vulnerabilities directly measures how quickly the organization closes security gaps, which is the core objective of vulnerability management.

Question 3

Under SOC 2, what is the purpose of a System Description in the audit report?

Accepted Answer

To describe the service organization's system boundaries, components, and controls for the period under review

Answer

The System Description defines what is covered in the audit, including the services provided, system infrastructure, and the controls in place, forming the foundation for the auditor's testing.

Question 4

A penetration test finds that an application is vulnerable to SQL injection. Under which SOC 2 Trust Service Criteria would this finding most likely be documented?

Accepted Answer

Security (CC) — Logical and Physical Access Controls

Answer

SQL injection is a security vulnerability that allows unauthorized logical access to data, placing it squarely under the Security (Common Criteria) category related to access control and system protection.

Question 5

Which of the following describes a key difference between a SOC 2 Type I and a SOC 2 Type II report?

Accepted Answer

Type I describes control design at a point in time; Type II tests operating effectiveness over a period

Answer

A SOC 2 Type I report evaluates whether controls are suitably designed at a specific point in time, while a Type II report also tests whether those controls operated effectively over a minimum six-month period.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Information Security and Data Privacy Controls 4