Built by Jeffrey Ting, FSA, CFA, who passed thirteen of the hardest finance exams on the first attempt. The full question bank and worked solutions are free forever.
Take the free CPA ISC diagnostic quiz →
Instant readiness score in about 6 minutes. No signup to start.
Sample Questions
Question 1
Easy
In a SOC 2 engagement, the Availability criterion evaluates:
Solution
A is correct.
The Availability criterion in the Trust Services Criteria evaluates whether the system is available for operation and use as committed or agreed upon, typically as defined in service level agreements. This includes controls over system monitoring, capacity planning, redundancy, failover mechanisms, incident management, and disaster recovery that support the system's operational availability.
The Availability criterion in the Trust Services Criteria evaluates whether the system is available for operation and use as committed or agreed upon, typically as defined in service level agreements. This includes controls over system monitoring, capacity planning, redundancy, failover mechanisms, incident management, and disaster recovery that support the system's operational availability.
Question 2
Medium
How does a SOC for Cybersecurity engagement differ from a SOC 2 engagement?
Solution
A is correct.
A key distinction is that a SOC for Cybersecurity engagement evaluates an entity's enterprise-wide cybersecurity risk management program, not a specific system or service, and the resulting report is intended for general use by a broad range of stakeholders. In contrast, a SOC 2 engagement evaluates controls at a service organization related to the Trust Services Criteria for a specific system or service, and the report is restricted to user entities, their auditors, and certain specified parties. The SOC for Cybersecurity engagement also relies on management's description criteria and on control criteria that may come from any suitable framework, while SOC 2 reports against the AICPA Trust Services Criteria.
A key distinction is that a SOC for Cybersecurity engagement evaluates an entity's enterprise-wide cybersecurity risk management program, not a specific system or service, and the resulting report is intended for general use by a broad range of stakeholders. In contrast, a SOC 2 engagement evaluates controls at a service organization related to the Trust Services Criteria for a specific system or service, and the report is restricted to user entities, their auditors, and certain specified parties. The SOC for Cybersecurity engagement also relies on management's description criteria and on control criteria that may come from any suitable framework, while SOC 2 reports against the AICPA Trust Services Criteria.
Question 3
Hard
For a firm comparing the NIST Cybersecurity Framework (CSF) 2.0 with the AICPA Trust Services Criteria (TSC), the key distinction in their scope and application is that:
Solution
C is correct.
The NIST CSF 2.0 is a voluntary framework (not a regulation) that organizes cybersecurity risk management activities into six core functions - Govern, Identify, Protect, Detect, Respond, and Recover - and is designed for enterprise-wide use across any sector. The TSC, developed by the AICPA, defines criteria across five categories (security, availability, processing integrity, confidentiality, and privacy) and serves as the basis for SOC 2 attestation engagements performed by CPAs. The key distinction is that the TSC is specifically designed for attestation and reporting, while the NIST CSF is a broader risk management tool.
The NIST CSF 2.0 is a voluntary framework (not a regulation) that organizes cybersecurity risk management activities into six core functions - Govern, Identify, Protect, Detect, Respond, and Recover - and is designed for enterprise-wide use across any sector. The TSC, developed by the AICPA, defines criteria across five categories (security, availability, processing integrity, confidentiality, and privacy) and serves as the basis for SOC 2 attestation engagements performed by CPAs. The key distinction is that the TSC is specifically designed for attestation and reporting, while the NIST CSF is a broader risk management tool.
What CPA ISC candidates are saying
“I practised the Lease questions subtopic by subtopic in Area 3F, and it was honestly a great experience. Learning felt much easier, faster, and more organised. It was especially helpful when I got a question wrong, because I could immediately connect the mistake to the exact concept.”
“I have been finding the FreeFellow materials incredibly helpful. The way you break down complex topics is making a real difference in my CPA prep.”
“I really liked the access the free tier has. The amount of questions you made is incredible and very accurate to the real deal.”
Free practice questions, worked solutions, and written lessons.
The full original question bank, written solutions, lessons, formula sheet, mixed practice, and readiness tracking for your CPA ISC prep are free forever. Full access requires a free account and is subject to usage limits. No trial period, no credit card. Every task-based simulation has a copy-to-AI prompt builder for your own ChatGPT or Claude. Become a Fellow ($79/qtr) only if you want mock exams, flashcards, analytics, AI simulation grading, and a personalized study plan.
What's Free, and What Fellow Unlocks
The original question bank, worked solutions, written lessons, mixed practice, and readiness score stay free forever. Full access requires a free account and is subject to usage limits. Fellow adds mock exams, flashcards, analytics, and a personalized study plan.
Free forever
$0 · no credit card
- 1,037 practice questions with detailed solutions
- Copy-to-AI simulation prompts for your own ChatGPT or Claude
- Mixed practice sessions across all topics
- Formula sheet and reference materials
- Readiness tracking based on practice history
- No paywalls on original questions · no trial period · no credit card
Fellow unlock
$39 / mo · $79 / qtr per track · $199 / yr as Fellow Plus
- Timed mock exams with weighted scoring
- Spaced-repetition flashcards backed by memory science
- Topic-level practice to drill weak areas
- Performance analytics by topic and difficulty
- AI grading for task-based simulations using the practice item's rubric and reference solution
- Personalized study plan that adapts to your exam date
Compare prep prices and exam coverage.
Practice tools for your exam
Fellow ($79/qtr) adds the pacing tools.
1,037+ Practice QuestionsFREE
Every question includes a detailed, step-by-step solution.
Diagnostic QuizFREE
12 questions, an instant readiness score, no signup. Start the CPA ISC diagnostic.
Mixed PracticeFREE
Cross-topic sessions to keep recall sharp.
Readiness TrackingFREE
An estimate based on your practice history for each exam.
Copy-to-AI Simulation PromptsFREE
Structured prompts you paste into your own ChatGPT or Claude for self-graded simulation feedback.
Flashcards & Spaced RepetitionFELLOW
SM-2 review cards for long-term retention.
Timed Mock ExamsFELLOW
Full-length practice exams weighted to the real blueprint.
AI Grading for SimulationsFELLOW
Instant AI-graded feedback on task-based simulations using the practice item's rubric and reference solution.
Performance AnalyticsFELLOW
Topic-by-topic mastery breakdown with difficulty mix.
Personalized Study PlanFELLOW
Adapts to your exam date and weakest topics.
