SOC Regulatory Compliance & Legal Framework 3

Question 1

The EU General Data Protection Regulation (GDPR) concept of 'data processor' most closely maps to which SOC framework role?

Accepted Answer

Service organization

Answer

Under GDPR, a data processor processes personal data on behalf of a controller, which parallels the service organization role in a SOC engagement that processes data for user entities.

Question 2

Which AICPA standard governs SOC 2 and SOC 3 attestation engagements?

Accepted Answer

AT-C Section 205

Answer

AT-C Section 205 (Examination Engagements) is the primary attestation standard governing SOC 2 and SOC 3 engagements performed by CPAs.

Question 3

A cloud provider subject to FedRAMP is most likely to reference which SOC report in their compliance documentation to satisfy federal agency requirements?

Accepted Answer

SOC 2 Type II

Answer

FedRAMP-authorized cloud providers commonly use SOC 2 Type II reports as supplementary evidence of security control effectiveness to federal agency customers.

Question 4

Which of the following scenarios would most likely result in a qualified opinion in a SOC 2 report?

Accepted Answer

The auditor is unable to assess availability controls due to scope limitation

Answer

A scope limitation that prevents the auditor from evaluating a criterion would result in a qualified or disclaimer of opinion in the SOC 2 report.

Question 5

Under the California Consumer Privacy Act (CCPA), a service organization acting as a 'service provider' must include which element in its contracts with businesses?

Accepted Answer

A prohibition on selling personal information received from the business

Answer

CCPA requires that contracts with service providers include a prohibition on selling the personal information they receive, a key compliance requirement for service organizations handling California consumer data.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Regulatory Compliance & Legal Framework 3