SOC 2 Type II Key Concepts and Evidence Essentials Quiz

Explore fundamental terms and audit practices central to SOC 2 Type II compliance, focusing on controls, evidence, and best practices. This quiz will help you assess your understanding of terminology and core audit requirements.

1. Understanding Control Tests

   What is a “control test” in a SOC 2 Type II audit?

   1. The auditor checks evidence samples to verify a control worked as described
   2. A simulation of a security breach to assess response
   3. The service organization tests its own security systems
   4. A review of employee training records

   Explanation: A control test involves the auditor examining samples of evidence to confirm that a control operated as intended during the audit period. The other options are not control tests; self-testing by the organization may help prepare, breach simulations are incident response activities, and employee training record reviews are specific to training controls, not control operation.

2. Population in Audit Sampling

   What does “population” mean in audit sampling for SOC 2?

   1. The third-party vendors used by the organization
   2. The full list of items that could be sampled (all access changes, all deployments, etc.)
   3. The total number of users in the system
   4. The group of employees involved in an incident

   Explanation: In auditing, the population defines all possible instances or occurrences that could be selected for sample testing, such as every access change or deployment in the period. Other options misinterpret population as groups of people or vendors rather than items involved in sample selection.

3. Defining Evidence Completeness

   What is “evidence completeness” in a SOC 2 Type II audit?

   1. Evidence is reviewed by the internal IT team
   2. Evidence is approved by senior management
   3. Evidence is collected only for the most recent month
   4. Evidence is fully covering the audit period with no missing required occurrences

   Explanation: Evidence completeness refers to ensuring that all required evidence spans the entire audit period and nothing that should be included is missing. Collecting evidence only for a short timeframe, requiring management approval, or internal IT review are not definitions of evidence completeness.

4. Authentication Control Evidence Example

   Which is an example of “authentication control” evidence for a SOC 2 audit?

   1. SSO/MFA configuration settings and login policy screenshots/exports
   2. Change management meeting minutes
   3. Employee onboarding checklists
   4. Weekly vulnerability scan results

   Explanation: Authentication control evidence includes documentation showing how login and access controls are enforced, such as SSO/MFA settings and screenshots of policies. The other options relate to separate controls, like vulnerability management, onboarding, and change management.

5. Purpose of Periodic Policy Review

   What is the purpose of “periodic policy review” in SOC 2 compliance?

   1. To eliminate the need for external consultants
   2. To automate all security processes
   3. To reduce the frequency of internal audits
   4. To ensure security policies are updated and approved regularly as the business changes

   Explanation: Periodic policy review ensures that security policies stay current with organizational needs and risks by requiring regular updates and approvals. Reducing audit frequency, eliminating consultants, or automating processes are unrelated to the purpose of reviewing policies periodically.

6. Meaning of Evidence Consistency

   What does “evidence consistency” mean during a SOC 2 Type II audit?

   1. Evidence shows the control was performed the same way each time (as defined)
   2. Evidence is stored in multiple locations
   3. Evidence changes format every month
   4. Evidence is approved by different departments

   Explanation: Evidence consistency indicates that the control was executed repeatedly in accordance with defined procedures, helping the auditor verify reliable operation. Changing formats, differing approvers, or distribution of storage do not reflect the concept of consistency.

7. Time-to-Revoke Access Significance

   What is “time-to-revoke access” and why do auditors care during a SOC 2 audit?

   1. How long users can keep temporary passwords
   2. How quickly access is removed after termination; delays increase risk
   3. The duration of security awareness training
   4. The frequency of routine access reviews

   Explanation: Time-to-revoke measures the speed at which access is terminated when someone leaves or changes role; auditors care because delayed revocation increases exposure to unauthorized access. The other options misinterpret the term as password duration, review frequencies, or training length.

8. Defining a Security Incident

   What is considered a “security incident” in the context of SOC 2 compliance?

   1. Any event that threatens confidentiality, integrity, or availability of systems/data
   2. Routine maintenance notifications
   3. A scheduled system upgrade
   4. Onboarding a new employee

   Explanation: A security incident includes any event with the potential to impact system or data security in terms of confidentiality, integrity, or availability. Scheduled upgrades, maintenance, and employee onboarding are not classified as security incidents.

9. Understanding Availability SLA/SLO

   What does “availability SLA/SLO” relate to in SOC 2 audits?

   1. The types of encryption algorithms used
   2. Target uptime and performance commitments for the service
   3. The frequency of employee background checks
   4. The company’s tax filing deadlines

   Explanation: Availability SLA/SLOs represent the organization’s promises to customers about service uptime and performance. Encryption, background checks, and tax deadlines are unrelated to the definition of SLAs or SLOs in this context.

10. Configuration Management Evidence

    What is “configuration management” evidence usually about in SOC 2 Type II audits?

    1. Documenting physical office locations
    2. Keeping secure, approved settings and tracking changes to system configurations
    3. Maintaining employee payroll records
    4. Collecting customer satisfaction surveys

    Explanation: Configuration management evidence focuses on maintaining secure, authorized settings and properly recording any configuration changes. This is distinct from documenting office locations, payroll, or customer surveys, which are not related to configuration controls.