Sample Questions
Question 1
Easy
Which Trust Services criterion is included in every SOC 2 examination?
Solution
B is correct.
In a SOC 2 engagement, the Security criterion (also called the Common Criteria) is mandatory and must be included in every examination. Security is considered the foundation because it addresses the protection of information and systems against unauthorized access, which underpins the other four optional criteria (Availability, Processing Integrity, Confidentiality, and Privacy). Organizations select which additional criteria to include based on their services and client needs, but Security is never optional. This structure comes from the AICPA Trust Services Criteria.
In a SOC 2 engagement, the Security criterion (also called the Common Criteria) is mandatory and must be included in every examination. Security is considered the foundation because it addresses the protection of information and systems against unauthorized access, which underpins the other four optional criteria (Availability, Processing Integrity, Confidentiality, and Privacy). Organizations select which additional criteria to include based on their services and client needs, but Security is never optional. This structure comes from the AICPA Trust Services Criteria.
Question 2
Medium
The authentication method providing the strongest protection against credential theft through phishing attacks is:
Solution
A is correct.
FIDO2 hardware security keys provide the strongest phishing resistance among these methods by binding authentication to the legitimate website's origin. A phishing site using a different origin cannot obtain a valid authentication response for the legitimate site. The private key remains on the device rather than being submitted as a reusable credential.
FIDO2 hardware security keys provide the strongest phishing resistance among these methods by binding authentication to the legitimate website's origin. A phishing site using a different origin cannot obtain a valid authentication response for the legitimate site. The private key remains on the device rather than being submitted as a reusable credential.
Question 3
Hard
For a firm comparing the NIST Cybersecurity Framework (CSF) 2.0 with the AICPA Trust Services Criteria (TSC), the key distinction in their scope and application is that:
Solution
C is correct.
The NIST CSF 2.0 is a voluntary framework (not a regulation) that organizes cybersecurity risk management activities into six core functions - Govern, Identify, Protect, Detect, Respond, and Recover - and is designed for enterprise-wide use across any sector. The TSC, developed by the AICPA, defines criteria across five categories (security, availability, processing integrity, confidentiality, and privacy) and serves as the basis for SOC 2 attestation engagements performed by CPAs. The key distinction is that the TSC is specifically designed for attestation and reporting, while the NIST CSF is a broader risk management tool.
The NIST CSF 2.0 is a voluntary framework (not a regulation) that organizes cybersecurity risk management activities into six core functions - Govern, Identify, Protect, Detect, Respond, and Recover - and is designed for enterprise-wide use across any sector. The TSC, developed by the AICPA, defines criteria across five categories (security, availability, processing integrity, confidentiality, and privacy) and serves as the basis for SOC 2 attestation engagements performed by CPAs. The key distinction is that the TSC is specifically designed for attestation and reporting, while the NIST CSF is a broader risk management tool.
