Examkin

Question

Difficulty: Very hardSecurity Audits, Assessments, and Attestations

During a vendor risk assessment, an enterprise security auditor evaluates an offshore development provider managing sensitive software repositories. The vendor provides a SOC 2 Type I report dated six months prior and an internal vulnerability scan report. The auditor concludes these documents do not verify that security controls operated effectively over time or that technical safeguards resist exploitation. Which of the following independent attestations or assessments should the auditor require from the vendor to address these deficiencies? (Select TWO.)

  1. Obtain a SOC 2 Type II report covering an operational evaluation period of at least six months.Answer
  2. Request an independent third-party penetration testing assessment validating technical security control resilience.Answer
  3. C
    Accept a SOC 3 attestation report to analyze the auditor's detailed test procedures and individual control results.
  4. D
    Request a SOC 1 Type I report to verify the operational effectiveness of IT security safeguards over the preceding year.

Answer

The auditor must require a SOC 2 Type II report covering an operational testing period of at least six months and an independent third-party penetration testing assessment.
To verify that security controls operate effectively over time, an organization requires a SOC 2 Type II report, which evaluates control execution across a sustained testing window (typically 6–12 months). Additionally, to validate technical defense mechanics beyond automated internal scans, an independent third-party penetration test is necessary to simulate real-world attacks and confirm safeguard resilience.

Step-by-Step Solution

1
Analyze the limitations of the vendor's provided SOC 2 Type I report.
Identify that a Type I report evaluates control design at a single point in time but provides zero evidence of operational effectiveness over an extended period.
Establishing ongoing compliance requires demonstrating that controls function continuously as designed over time.
2
Select the appropriate attestation report to validate operational effectiveness over time.
Specify a SOC 2 Type II report covering a duration of 6 to 12 months.
SOC 2 Type II audits explicitly test and confirm the operational performance of Trust Services Criteria security controls across a sustained testing timeframe.
3
Analyze the limitations of internal vulnerability scans.
Recognize that automated internal scans lack independent verification and do not simulate active adversary exploitation tactics.
Internal scans frequently yield unverified metrics and fail to test defensive responsiveness against skilled human threat actors.
4
Select the required assessment method for technical validation.
Require an independent third-party penetration test.
Penetration testing delivers objective, third-party validation of technical control implementation and exploited vulnerability impact.

Key Concept

Distinguishing SOC report types (SOC 1 vs SOC 2 vs SOC 3 and Type I vs Type II) and independent technical assessments in vendor risk management.
Rate this question

Topics

Security Audits, Assessments, and Attestations

More questions from this topic