Examkin

Soru

Zorluk: Çok zorSecurity Audits, Assessments, and Attestations

A multinational financial enterprise is undergoing a comprehensive regulatory oversight review following a cloud migration. The Chief Risk Officer must provide formal verification to federal regulators that administrative access controls and data encryption mechanisms within the multi-tenant software-as-a-service environment were continuously evaluated for operational effectiveness across the entire preceding 12-month fiscal period. Which of the following independent attestations or evaluation mechanisms fulfills this regulatory requirement?

  1. A SOC 2 Type II report covering the operating effectiveness of Trust Services Criteria controls over the 12-month periodCevap
  2. B
    A SOC 2 Type I report validating the design suitability and baseline implementation of security controls at the date of migration
  3. C
    A SOC 3 attestation report outlining high-level security management practices for public disclosure
  4. D
    An external network penetration testing and technical vulnerability assessment report executed at the end of the fiscal year

Cevap

The correct evaluation mechanism is a SOC 2 Type II report covering the operating effectiveness of Trust Services Criteria controls over the 12-month period.
A SOC 2 Type II report provides an independent third-party attestation that evaluates both the suitability of control design and the operational effectiveness of security controls based on the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) over a specified period (typically 6 to 12 months). This meets the regulatory demand for proof of continuous operational effectiveness across the preceding fiscal year.

Adım Adım Çözüm

1
Analyze the scenario constraints and regulatory criteria.
Identified two primary requirements: evaluation of administrative/encryption controls (Trust Services Criteria) and verification of operational effectiveness continuously over a past 12-month timeframe.
Regulators require proof of ongoing execution over time rather than a static point-in-time configuration baseline.
2
Evaluate the difference between Type I and Type II attestation reports.
Type I measures control design at a single point in time, whereas Type II measures operational effectiveness over a historical duration.
The scenario explicitly specifies a 12-month fiscal period evaluation, requiring a Type II report.
3
Differentiate between SOC 1, SOC 2, SOC 3, and technical testing methods.
SOC 1 targets financial reporting controls (ICFR), SOC 3 provides public non-confidential summaries, penetration tests assess point-in-time exploitability, and SOC 2 detailed reports provide comprehensive proof of security/privacy Trust Services Criteria.
Only SOC 2 Type II fulfills the requirement for detailed operational effectiveness evidence across security controls over time.

Anahtar Kavram

SOC Report Types and Attestation Scopes (Type I vs Type II)
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Security Audits, Assessments, and Attestations

Bu konudan daha fazla soru