SOC Risk and Control Objectives 4

Question 1

Which SOC 2 criterion requires that the entity select and develop general control activities over technology to support the achievement of objectives?

Accepted Answer

CC5.3

Answer

CC5.3 requires the entity to select and develop control activities, including general controls over technology infrastructure, to mitigate risks to acceptable levels.

Question 2

An auditor identifies that a service organization relies on a vendor for patch management but has no oversight process for confirming patches are applied. This gap most directly relates to which risk area?

Accepted Answer

Vendor risk management and control monitoring

Answer

Lack of oversight over a vendor's patch management exposes the organization to vendor risk and represents a gap in monitoring controls over third parties.

Question 3

Under the availability trust services category, which control objective is most critical for ensuring systems operate as committed?

Accepted Answer

Capacity monitoring and performance management

Answer

Availability requires that systems perform at sufficient capacity; capacity monitoring and performance management directly support this control objective.

Question 4

What is the purpose of a 'control objective' in a SOC 1 report?

Accepted Answer

To define what needs to be achieved for internal control over financial reporting to be effective

Answer

Control objectives in SOC 1 reports define the desired outcomes that controls must achieve to support the user entities' financial reporting objectives.

Question 5

An entity implements segregation of duties to prevent a single employee from both authorizing and recording transactions. This is an example of which type of control?

Accepted Answer

Preventive control

Answer

Segregation of duties is a preventive control because it is designed to stop errors or fraud from occurring in the first place.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Risk and Control Objectives 4