CISSP Security Assessment and Testing Practice Question
Which TWO of the following are characteristics of a SOC 2 Type II report?
⚠ Common exam trap
CISSP often tests the distinction between SOC 2 Type I and Type II, and between SOC 2 and SOC 3 reports, causing candidates to confuse point-in-time vs. period coverage or public vs. restricted distribution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Covers the design and operating effectiveness of controls over a period of time
Option A is correct because a SOC 2 Type II report specifically tests both the design and the operating effectiveness of controls throughout a defined review period (typically 3–12 months), unlike a Type I report which only assesses design at a point in time. Option C is correct because SOC 2 engagements are structured around the AICPA Trust Services Criteria, which include security (required) plus availability, processing integrity, confidentiality, and privacy as optional categories. Option B is incorrect because SOC 2 reports are restricted-use reports distributed under NDA to management, customers, and auditors—not public documents (that role belongs to SOC 3). Option D is incorrect because financial reporting controls are the focus of SOC 1 (SSAE 18/ISAE 3402), not SOC 2. Option E is incorrect because point-in-time evaluation describes a SOC 2 Type I report, whereas Type II covers a period.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Covers the design and operating effectiveness of controls over a period of time
Why this is correct
A SOC 2 Type II report provides an opinion on the suitability of the design of controls and their operating effectiveness throughout a specified reporting period, typically 6-12 months. This extended observation period offers a higher level of assurance regarding the consistent application and performance of a service organization's system and controls. It demonstrates sustained adherence to the Trust Service Criteria, which is crucial for user entities relying on these services.
- ✗
Is a public summary report available to anyone
Why it's wrong here
A SOC 2 report is a restricted-use report, meaning it is not publicly available and is intended only for the management of the service organization, user entities, and their auditors. Unlike a SOC 3 report, which is a general-use report providing a high-level summary for public consumption, the detailed nature of a SOC 2 report, including specific control descriptions and test results, necessitates its confidential distribution to protect sensitive operational information.
- ✓
Includes trust service criteria such as security, availability, and confidentiality
Why this is correct
SOC 2 reports are specifically designed to address controls relevant to the security, availability, processing integrity, confidentiality, or privacy of user entity data. These five categories, known as the Trust Service Criteria (TSC), form the framework against which a service organization's controls are evaluated. Organizations select the relevant TSC based on the services they provide, with Security being the mandatory baseline criterion for all SOC 2 reports.
- ✗
Focuses only on financial reporting controls
Why it's wrong here
This statement incorrectly describes a SOC 2 report. SOC 2 reports are specifically designed to address controls related to the security, availability, processing integrity, confidentiality, and privacy of data, not financial reporting. Controls focused solely on internal control over financial reporting (ICFR) are the domain of a SOC 1 report, which is relevant for user entities' financial statement audits.
- ✗
Evaluates controls at a single point in time
Why it's wrong here
This describes a SOC 2 Type I report, not a Type II. A SOC 2 Type I report evaluates the suitability of the design of controls and their implementation at a specific point in time. In contrast, a SOC 2 Type II report provides assurance over the design and operating effectiveness of controls over a period of time, typically six months to a year, offering a more comprehensive and robust assessment of control performance.
Go deeper
Related to this question
Learn chapter
Physical Security and Environmental Controls
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Privacy
Privacy in IT is the control over how personal data is collected, stored, used, and shared by systems and organizations.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.