SOC Risk and Control Objectives 3

Question 1

Which SOC 2 criterion addresses the requirement for an organization to implement controls to prevent or detect unauthorized access to systems?

Accepted Answer

CC6.1

Answer

CC6.1 requires the entity to implement logical access security software, infrastructure, and architectures to protect against threats from sources outside its boundaries.

Question 2

What is the key difference between a Type 1 and Type 2 SOC report?

Accepted Answer

Type 1 reports on design suitability at a point in time; Type 2 reports on operating effectiveness over a period

Answer

A Type 1 report assesses whether controls are suitably designed as of a specific date, while a Type 2 report also tests whether those controls operated effectively throughout the review period.

Question 3

Under CC3.2, an entity is required to analyze risks considering which two dimensions?

Accepted Answer

Likelihood and impact

Answer

CC3.2 requires management to estimate the significance of identified risks using likelihood and impact as the two primary dimensions of risk analysis.

Question 4

A company's SOC 2 report lists 'employee security awareness training' as a control. If no training records exist for the review period, what type of finding would this generate?

Accepted Answer

A control deficiency or deviation from the stated control

Answer

Missing evidence of control operation results in a control deviation or deficiency, which the service auditor documents in the report's test results.

Question 5

Which risk response strategy involves shifting the financial consequences of a risk to a third party, such as through insurance?

Accepted Answer

Risk sharing

Answer

Risk sharing (or transfer) moves the financial impact of a risk to another party, commonly accomplished through insurance or contractual agreements.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Risk and Control Objectives 3