CCSP Cloud Concepts, Architecture, and Design Practice Question
A cloud customer is reviewing a provider's SOC 2 Type II report. What does this report primarily attest to?
⚠ Common exam trap
The trap is confusing SOC 2 Type II with SOC 1 (financial controls) or with regulatory compliance attestations like GDPR — candidates must remember that SOC 2 Type II specifically addresses the design and operating effectiveness of controls over a period, based on the AICPA Trust Services Criteria.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The design and operating effectiveness of controls over a period
A SOC 2 Type II report attests to the design and operating effectiveness of a service organization's controls over a specified period (typically 3–12 months). It goes beyond a Type I report, which only evaluates control design at a point in time, by testing whether controls operated effectively throughout the audit period.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The provider's financial controls and accuracy of billing
Why it's wrong here
SOC 2 reports address the Trust Services Criteria — security, availability, processing integrity, confidentiality and privacy — not billing accuracy, which falls under financial auditing standards such as SOC 1. It tempts because SOC 1 does cover financial reporting controls, so it would be the right report when assessing a provider's billing or financial-processing controls.
- ✓
The design and operating effectiveness of controls over a period
Why this is correct
A SOC 2 Type II report attests to both the suitability of control design and the operating effectiveness of those controls throughout a specified review period. This period-based testing distinguishes it from Type I, which covers design at a single point in time.
- ✗
Compliance with international data protection regulations like GDPR
Why it's wrong here
SOC 2 attests to controls against the Trust Services Criteria; it does not certify GDPR conformity, which rests on legal obligations and supervisory authority oversight. It tempts because privacy is one of the five criteria, so a SOC 2 report can evidence privacy controls supporting GDPR compliance, but it is not itself a regulatory attestation.
- ✗
Penetration test results and vulnerability assessments
Why it's wrong here
SOC 2 Type II reports on the operating effectiveness of controls over a period; penetration test results and vulnerability scans are separate artefacts, often merely referenced as evidence. It tempts because security is a Trust Services Criterion, so such testing frequently supports the report, but the report itself does not present test findings.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.