CISSP Security Assessment and Testing Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Covers the design and operating effectiveness of controls over a period of time

  Why this is correct

  A SOC 2 Type II report provides an opinion on the suitability of the design of controls and their operating effectiveness throughout a specified reporting period, typically 6-12 months. This extended observation period offers a higher level of assurance regarding the consistent application and performance of a service organization's system and controls. It demonstrates sustained adherence to the Trust Service Criteria, which is crucial for user entities relying on these services.

• ✗

  Is a public summary report available to anyone

  Why it's wrong here

  A SOC 2 report is a restricted-use report, meaning it is not publicly available and is intended only for the management of the service organization, user entities, and their auditors. Unlike a SOC 3 report, which is a general-use report providing a high-level summary for public consumption, the detailed nature of a SOC 2 report, including specific control descriptions and test results, necessitates its confidential distribution to protect sensitive operational information.

• ✓

  Includes trust service criteria such as security, availability, and confidentiality

  Why this is correct

  SOC 2 reports are specifically designed to address controls relevant to the security, availability, processing integrity, confidentiality, or privacy of user entity data. These five categories, known as the Trust Service Criteria (TSC), form the framework against which a service organization's controls are evaluated. Organizations select the relevant TSC based on the services they provide, with Security being the mandatory baseline criterion for all SOC 2 reports.

• ✗

  Focuses only on financial reporting controls

  Why it's wrong here

  This statement incorrectly describes a SOC 2 report. SOC 2 reports are specifically designed to address controls related to the security, availability, processing integrity, confidentiality, and privacy of data, not financial reporting. Controls focused solely on internal control over financial reporting (ICFR) are the domain of a SOC 1 report, which is relevant for user entities' financial statement audits.

• ✗

  Evaluates controls at a single point in time

  Why it's wrong here

  This describes a SOC 2 Type I report, not a Type II. A SOC 2 Type I report evaluates the suitability of the design of controls and their implementation at a specific point in time. In contrast, a SOC 2 Type II report provides assurance over the design and operating effectiveness of controls over a period of time, typically six months to a year, offering a more comprehensive and robust assessment of control performance.

Go deeper

Related to this question