Questão 90 — CompTIA SY0-701 CompTIA Security+ Certification Exam
An organization is conducting a third-party risk assessment of a critical cloud service provider before renewing a multi-year contract. The assessment needs to verify that the provider maintains adequate security controls and follows industry standards. Which of the following assessment approaches would provide the most comprehensive assurance of the provider's security posture?
- A. Request the provider's SOC 2 Type II audit report covering at least a 6-month observation period
- B. Conduct a scheduled vulnerability scan of the provider's public-facing systems quarterly
- C. Review the provider's security policy documentation and certifications without independent verification
- D. Perform an unannounced penetration test of the provider's production environment annually
Resposta correta:
A
Explicação
Explanation: Correct answer: A. Request the provider's SOC 2 Type II audit report covering at least a 6-month observation period The correct answer is request the provider's SOC 2 Type II audit report covering at least a 6-month observation period. A SOC 2 Type II audit provides independent, third-party verification of controls operating over time (not just a point-in-time snapshot like Type I). It demonstrates that the provider has implemented and maintained security controls across multiple domains including security, availability, processing integrity, confidentiality, and privacy. While vulnerability scanning and penetration testing provide useful data, they don't comprehensively assess control implementation and effectiveness. Reviewing policy documentation alone without independent verification provides minimal assurance. A SOC 2 Type II report, audited by a qualified independent auditor, is the industry standard for third-party risk assessment in this context.
Quer todas as 907 questões por R$ 1,00?