stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
SOC Reports Quiz Flashcards | StudBud
Explore
/
SOC Reports Quiz
SOC Reports Quiz
17 terms
·
StudBud Administration
·
15 plays
Test your knowledge of SOC Reports
Flashcards
17 cards
F
Practice quiz
P
Host live
L
Questions
17
Answers
1
Which is not a challenge in managing third party risks?
Positive vendor relationships
Complex third-party intermediary networks
High costs of monitoring third parties
Lack of departmental collaboration
2
A SOC report contains auditor's opinion covering the following areas:
If the SO's controls are designed effectively
If the SO's controls interact with user entities
If the SO's controls operate effectively over time period
If the SO's description of controls is presented fairly
3
What is an aspect of vendor management?
It ends with onboarding
It is fully automated
It requires continuous monitoring
It is a set-it-and-forget-it process
4
What is the main goal of vendor management?
To increase cost savings
To minimize risk
To maximize profits
To minimize losses
5
SOC 1 SSAE No. 16 changes require management s to provide auditors with written assertion about
suitability of design of controls
fairness of presentation of management's system description
identification of any controls performed by internal audit
operating effectiveness of controls
6
1. Who is a third party?
Customers
Suppliers
Accounting Firms
All of the above
7
From a third-party perspective, which cloud computing model carries the most risk?
They have an equal amount of risk
SaaS
IaaS
PaaS
8
n the Target example, what kind of vendor was Fazio (the vendor that was attacked)?
Merchandise Supplier
HVAC Maintenance
Cloud Computing Services
Payroll
9
What is the final process in the risk management continuous life cycle?
Ongoing Monitoring
Independent Reviews
Documentation and Reporting
Termination
10
Which SOC report is for public use?
SOC 1
SOC 2
Socks
SOC 3
11
What are the three main cloud computing models?
NaaT, PaaT, and TaaT
NetZero, NetScape, NetThirty
IaaS, PaaS, and SaaS
IaaS, PaaS, and CBaS
12
Which of the following is the official TPRM framework (analagous to COBIT 5 or COSO)?
SOC 2
OCC 2013-29
SOC 1
There is no official framework
13
How many points of emphasis does the OCC 2013-29 TPRM Life Cycle have?
5
6
9
8
14
SOC 1 reports are intended to address service organization's _______
Internal Control over Financial Reporting
cybersecurity
trust services criteria
trust services criteria for general use
15
Which is NOT a function of a SOC report?
Build trust
Increase audit efficiency
Help gain competitive advantage
Aid in risk management
16
What is the regulation that governs SOC reports?
SSAE 20
SSAE 16
Sarbanes-Oxley
SSAE 18
17
Which is NOT a SOC report section?
Management’s description of system
Management’s assertions
Client’s opinion
Auditor’s opinion
