Question 1

An auditor wants to get information about the operating effectiveness of controls addressing privacy, availability, and confidentiality of a service organization. Which of the following can BEST help to gain the required information?

Options :

A : SOC2 Type 2 report

B : ISAE 3402 report

C : SOC1 Type 1 report

D : ISO/IEC 27001 certification

Answer: A

Question 2

When mapping controls to architectural implementations, requirements define:

Options :

A : control objectives.

B : control activities.

C : guidelines.

D : policies.

Answer: B

Question 3

An auditor is assessing a European organization's compliance. Which regulation is suitable if health information needs to be protected?

Options :

A : GDPR

B : DPIA

C : DPA

D : HIPAA

Answer: A

Question 4

Which of the following is MOST important to manage risk from cloud vendors who might accidentally introduce unnecessary risk to an organization by adding new features to their solutions?

Options :

A : Deploying new features using cloud orchestration tools

B : Performing prior due diligence of the vendor

C : Establishing responsibility in the vendor contract

D : Implementing service level agreements (SLAs) around changes to baseline configurations

Answer: D

Question 5

Which of the following controls is MOST relevant for identifying cases of misuse when scripts are running in the background with minimal human oversight?

Options :

A : Additional manual testing

B : Segregation of duties

C : Increased regression testing

D : Additional monitoring

Answer: D