CISSP Security Assessment and Testing Practice Question
Which type of SOC report provides a public summary of an organization's controls over security, availability, and confidentiality?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SOC 3
SOC 3 reports are designed for public distribution and summarize the findings of a SOC 2 engagement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SOC 2 Type II
Why it's wrong here
SOC 2 Type II reports provide a detailed assessment of a service organization's controls over a specified period, typically 6-12 months, including the suitability of design and operating effectiveness. These comprehensive reports are intended for restricted use by user entities and their auditors to evaluate the impact of the service organization's controls on their own operations, making them unsuitable for public disclosure.
- ✗
SOC 1
Why it's wrong here
SOC 1 reports, governed by SSAE 18 (Statement on Standards for Attestation Engagements No. 18), focus exclusively on controls relevant to a service organization's financial reporting. These reports are primarily for user entities' financial statement auditors to assess the impact of the service organization's controls on the user entity's financial statements and are not designed for public consumption or a broader summary of security posture.
- ✗
SOC 2 Type I
Why it's wrong here
A SOC 2 Type I report evaluates the suitability of the design of a service organization's controls at a specific point in time, addressing one or more of the Trust Services Criteria (TSC). While it provides assurance regarding control design, it does not assess operating effectiveness and, like its Type II counterpart, is intended for restricted distribution to user entities and their auditors, not for public release.
- ✓
SOC 3
Why this is correct
SOC 3 reports are general-use reports that provide a public summary of a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy (Trust Services Criteria). Unlike SOC 2 reports, SOC 3 reports do not contain the detailed description of controls or test results, making them suitable for public distribution, marketing, and demonstrating commitment to security without revealing sensitive operational details.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.