SOC Technology & Digital Tools 3

Question 1

In a SOC 1 engagement, a service organization processes payroll on behalf of user entities. Which technology control is most relevant to ensuring input completeness?

Accepted Answer

Hash totals or record counts validated between submitted files and processed records

Answer

Hash totals and record counts are automated controls that verify all submitted payroll records were received and processed without loss or duplication.

Question 2

A SOC 2 report covers a cloud provider's vulnerability management program. What technology provides the foundational evidence of this program's operation?

Accepted Answer

Scheduled vulnerability scanner reports showing identified and remediated findings

Answer

Scheduled vulnerability scanner reports demonstrating identified findings and their remediation provide direct evidence that a vulnerability management program is operating effectively.

Question 3

When assessing the availability trust service criteria, an auditor would most likely examine which technology artifact?

Accepted Answer

System uptime monitoring dashboards and incident response logs

Answer

Uptime monitoring dashboards and incident response logs directly evidence that the organization monitors system availability and responds to disruptions.

Question 4

What is the significance of immutable audit logs in the context of a SOC examination?

Accepted Answer

They ensure log records cannot be altered or deleted, preserving the integrity of the audit trail

Answer

Immutable logs preserve the integrity of the audit trail, ensuring evidence of system activities cannot be tampered with, which is critical for SOC monitoring controls.

Question 5

A service organization uses a cloud access security broker (CASB). Which SOC 2 trust service criteria does this tool most directly support?

Accepted Answer

Confidentiality and security, by enforcing policies on data moving to and from cloud services

Answer

A CASB enforces security and data handling policies for cloud services, directly supporting the confidentiality and security trust service criteria.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Technology & Digital Tools 3