SOC 2 Type II Controls and Evidence Essentials Quiz Quiz

Assess your knowledge of SOC 2 Type II compliance concepts, including controls, evidence, and best practices for security and integrity. This quiz covers control mapping, preventive and detective controls, environment separation, and more.

1. Control Mapping Fundamentals

   What is a 'control mapping' during SOC 2 preparation?

   1. Choosing which controls to ignore during audits
   2. Documenting only failed controls in a report
   3. Creating user training material for SOC 2 standards
   4. Linking each SOC 2 requirement to a specific company policy/process/control

   Explanation: Control mapping means linking every SOC 2 requirement to a company's specific policies, processes, or controls to ensure full coverage. The other options are incorrect: ignoring controls risks non-compliance, documenting only failures is insufficient, and creating training material is important but not control mapping.

2. Understanding Preventive Controls

   Which of the following is a common example of a 'preventive control' in SOC 2?

   1. MFA to prevent unauthorized logins
   2. Incident response after a breach
   3. Log review to detect suspicious activity
   4. Monthly backup verification

   Explanation: Multi-factor authentication (MFA) is a preventive control because it aims to stop unauthorized access before it occurs. Log review is detective, incident response is corrective, and backup verification is related to availability, not directly preventive.

3. Detective Control Examples

   What is a common example of a 'detective control' in SOC 2 compliance?

   1. Disaster recovery drills
   2. Automatic password rotation
   3. Encryption of stored data
   4. Alerts or monitoring that detects suspicious activity

   Explanation: Detective controls, like alerts or monitoring, help identify issues after they occur. Password rotation and encryption are preventive controls, and disaster recovery drills are part of availability and incident response, not detective controls.

4. Corrective Control Practices

   Which activity best illustrates a 'corrective control' in SOC 2 frameworks?

   1. Requiring long passwords on all systems
   2. 24/7 system monitoring
   3. Annual risk assessments
   4. Incident remediation steps like patching and access removal after an issue is found

   Explanation: Corrective controls are actions taken to fix identified problems, such as patching vulnerabilities and removing access after an incident. Requiring long passwords and monitoring are preventive/detective, while risk assessments are risk management processes.

5. Ticket Evidence Usage

   What is 'ticket evidence' and where is it most commonly used in SOC 2 compliance?

   1. Employee satisfaction surveys
   2. Support/IT tickets showing actions taken, such as access requests, changes, or incidents
   3. Invoices showing audit costs
   4. User feedback forms

   Explanation: Ticket evidence involves using support or IT tickets to show proof that required actions (like access changes or issue resolution) were completed. Invoices, feedback forms, and satisfaction surveys are not used as evidence for SOC 2 controls.

6. Reconciliation Checks Purpose

   What does a 'reconciliation' check achieve in SOC 2 processing integrity controls?

   1. Resetting user passwords automatically
   2. Disabling unneeded user accounts
   3. Comparing outputs and records to ensure data processing is complete and accurate
   4. Encrypting files before transfer

   Explanation: Reconciliation checks involve comparing records or outputs to confirm that data processing was done correctly and fully. The other options represent access management and encryption controls, not reconciliation.

7. Environment Separation Importance

   What does 'environment separation' (dev, stage, prod) mean and why is it vital for SOC 2?

   1. Limiting access to only the production environment
   2. Merging all environments to simplify development
   3. Using the same credentials across all environments for convenience
   4. Keeping environments separate to reduce the risk of untested changes affecting production

   Explanation: Separation of development, staging, and production environments limits the chance that buggy or untested code will impact live systems. Using same credentials, merging environments, or only limiting access are not best practices for SOC 2.

8. Vulnerability Management in SOC 2

   What is meant by 'vulnerability management' in SOC 2 compliance?

   1. Hiring only experienced developers
   2. Finding, prioritizing, and fixing security weaknesses on a regular schedule
   3. Encrypting all network traffic
   4. Disabling all unused user accounts

   Explanation: Vulnerability management is the ongoing process of discovering, ranking, and remediating weaknesses. The distractors are important practices but are not comprehensive vulnerability management.

9. Patch Management Evidence

   Which of the following is typically included as 'patch management' evidence for SOC 2 audits?

   1. Patch schedules, update records, and proof patches were applied within timelines
   2. Annual budget documentation
   3. Customer satisfaction survey results
   4. User training reports

   Explanation: Auditors review patch schedules and implementation records as evidence that patches are managed properly. User training, budgets, and customer surveys do not demonstrate patch management.

10. Access Provisioning Workflow Steps

    What best describes an 'access provisioning workflow' in SOC 2?

    1. Disabling old accounts annually
    2. The documented steps to grant access: request → approval → grant → record
    3. Requiring two-factor authentication for all users
    4. A weekly password reset process

    Explanation: Access provisioning workflows document each step in granting access, ensuring proper authorization and tracking. The other answers are important controls but do not describe the access request workflow process.