SOC Information Security and Data Privacy Controls 5

Question 1

A SOC 2 auditor tests whether the organization's change management process requires approval before deployment to production. This test most directly supports which control objective?

Accepted Answer

Preventing unauthorized or untested changes from compromising security and integrity

Answer

Change management controls with required approvals prevent unauthorized or flawed changes from being deployed, protecting both the security and processing integrity of the system.

Question 2

Under the Privacy TSC, which of the following actions demonstrates compliance with the 'Use, Retention, and Disposal' principle?

Accepted Answer

Securely shredding physical records and purging database records after the defined retention period expires

Answer

Secure disposal of personal data when its retention period expires ensures data is not kept longer than necessary and that disposal methods protect against unauthorized recovery.

Question 3

Which risk does an organization face if it relies solely on perimeter-based security controls (e.g., firewalls) without implementing internal network segmentation?

Accepted Answer

Lateral movement by attackers who breach the perimeter can reach all internal systems

Answer

Without internal segmentation, an attacker who bypasses the perimeter can move freely across the entire network, dramatically increasing the potential scope of a breach.

Question 4

A cloud service provider lists a subservice organization using the 'carve-out method' in its SOC 2 report. What does this mean for report users?

Accepted Answer

The report users must obtain and review the subservice organization's own SOC report to complete their risk assessment

Answer

The carve-out method excludes the subservice organization from the primary SOC 2 scope, meaning report users must independently obtain and evaluate the subservice organization's own controls and SOC report.

Question 5

What is the primary purpose of a security awareness training program in the context of SOC 2 information security controls?

Accepted Answer

To reduce human-factor risks by educating employees on identifying and responding to threats like phishing

Answer

Security awareness training mitigates human-factor risks, particularly social engineering attacks like phishing, by helping employees recognize threats and respond appropriately.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Information Security and Data Privacy Controls 5