CAS-004 Governance, Risk, and Compliance Practice Question
A financial institution is evaluating a cloud service provider for hosting customer data. During the due diligence process, which report would best help the institution assess the provider's control environment and compliance with SOC 2?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SOC 2 Type II report
A SOC 2 Type II report provides an auditor's opinion on the effectiveness of controls over a period, directly addressing the service provider's control environment and compliance with Trust Services Criteria.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SOC 2 Type II report
Why this is correct
This report evaluates the design and operating effectiveness of controls over time, suitable for assessing a service provider's control environment.
- ✗
ISO 27001 certificate
Why it's wrong here
An ISO 27001 certificate confirms compliance with an ISMS standard but may not cover specific SOC 2 criteria.
- ✗
Penetration test report
Why it's wrong here
A penetration test assesses specific vulnerabilities but does not provide a comprehensive view of ongoing control effectiveness.
- ✗
Vulnerability scan results
Why it's wrong here
Vulnerability scans are point-in-time and do not assess overall control effectiveness.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.