Examkin

Soru

Zorluk: OrtaSecurity Audits, Assessments, and Attestations

An organization is preparing for an independent external audit to verify that its operational security controls have functioned effectively throughout the previous fiscal year. The Lead Auditor requires evidence and reports that demonstrate control performance over this extended timeframe rather than at a single point in time. Which of the following evidence sources or attestation types satisfy the auditor's requirement? (Select TWO.)

  1. A SOC 2 Type II attestation report evaluating the operational effectiveness of security controls over the specified 12-month windowCevap
  2. Historical log management records and continuous monitoring evidence collected across the full 12-month timeframeCevap
  3. C
    A SOC 2 Type I attestation report demonstrating control design suitability as of a single specified date
  4. D
    A single automated vulnerability scanning report executed on the final day of the assessment period

Cevap

The correct selections are the SOC 2 Type II attestation report evaluating control effectiveness over the 12-month window and historical log management records collected continuously across the 12-month timeframe.
The requirement specifically calls for demonstrating operational security control effectiveness over an extended 12-month period. A SOC 2 Type II attestation report specifically covers operational effectiveness over a designated timeframe, and continuous historical log management records provide empirical evidence of ongoing control execution across that entire period.

Adım Adım Çözüm

1
Analyze the audit requirement specified in the scenario
The scenario requires evidence demonstrating operational control effectiveness across an extended period (12 months), excluding single point-in-time evaluations.
Audits distinguishing between period-of-time performance and point-in-time design require longitudinal evidence.
2
Evaluate the attestation report options against the period-of-time criteria
A SOC 2 Type II report specifically evaluates operational effectiveness over a period of time, whereas a Type I report only evaluates design at a point in time.
Type II audits test whether controls actually functioned over time.
3
Evaluate the operational evidence options against the period-of-time criteria
Continuous log records spanning 12 months fulfill the longitudinal evidence requirement, whereas a single point-in-time vulnerability scan fails to reflect operational continuity.
Audit logs collected continuously demonstrate persistent control execution.

Anahtar Kavram

Distinguishing period-of-time attestation reports and evidence (SOC 2 Type II, continuous logs) from point-in-time evaluations (SOC 2 Type I, single vulnerability scans).
Bu soruyu puanla

Konular

Security Audits, Assessments, and Attestations

Bu konudan daha fazla soru