This sample follows a SaaS organisation from report purpose and management responsibility into system boundaries, criteria selection and evidence readiness. Reveal each answer to see the reasoning and why the other options fail.
What this exact sample covers
SOC 2 scope, criteria and evidence
Report users and management assertion
Type 1 versus Type 2
System description and control evidence
Question 01Domain 1 · recall
Which response best connects the intended users of Kestrel’s SOC 2 report to its preparation work?
AMap the scoped criterion, control owner, operating activity and retained evidence for the purpose and users of a SOC 2 report.
BAdd a policy title to the controls matrix without validating operation of the purpose and users of a SOC 2 report.
CAssume the service auditor will design and operate the control during fieldwork.
the answer and reasoning
Correct answerA. Map the scoped criterion, control owner, operating activity and retained evidence for the purpose and users of a SOC 2 report.
The stronger response connects the purpose and users of a SOC 2 report to a defined purpose, accountable action and usable evidence. Map the scoped criterion, control owner, operating activity and retained evidence for the purpose and users of a SOC 2 report. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
B. This response deflects an accountability that remains with the organisation or practitioner and would leave the relevant competency unevidenced.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Which response best reflects management’s responsibility for the system description and assertion?
AAdd a policy title to the controls matrix without validating operation of management responsibility and assertion.
BMap the scoped criterion, control owner, operating activity and retained evidence for management responsibility and assertion.
CAssume the service auditor will design and operate the control during fieldwork.
the answer and reasoning
Correct answerB. Map the scoped criterion, control owner, operating activity and retained evidence for management responsibility and assertion.
The stronger response connects management responsibility and assertion to a defined purpose, accountable action and usable evidence. Map the scoped criterion, control owner, operating activity and retained evidence for management responsibility and assertion. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
A. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Which response correctly preserves the independent service auditor’s role?
AAdd a policy title to the controls matrix without validating operation of the service auditor role.
BAssume the service auditor will design and operate the control during fieldwork.
CMap the scoped criterion, control owner, operating activity and retained evidence for the service auditor role.
the answer and reasoning
Correct answerC. Map the scoped criterion, control owner, operating activity and retained evidence for the service auditor role.
The stronger response connects the service auditor role to a defined purpose, accountable action and usable evidence. Map the scoped criterion, control owner, operating activity and retained evidence for the service auditor role. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
A. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
B. This response deflects an accountability that remains with the organisation or practitioner and would leave the relevant competency unevidenced.
Which response best accounts for the difference between Type 1 and Type 2 evidence?
AMap the scoped criterion, control owner, operating activity and retained evidence for Type 1 and Type 2 reporting periods.
BAdd a policy title to the controls matrix without validating operation of Type 1 and Type 2 reporting periods.
CAssume the service auditor will design and operate the control during fieldwork.
the answer and reasoning
Correct answerA. Map the scoped criterion, control owner, operating activity and retained evidence for Type 1 and Type 2 reporting periods.
The stronger response connects Type 1 and Type 2 reporting periods to a defined purpose, accountable action and usable evidence. Map the scoped criterion, control owner, operating activity and retained evidence for Type 1 and Type 2 reporting periods. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
B. This response deflects an accountability that remains with the organisation or practitioner and would leave the relevant competency unevidenced.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Which response best establishes Kestrel’s system boundary and principal service commitments?
AAdd a policy title to the controls matrix without validating operation of system boundaries and principal service commitments.
BMap the scoped criterion, control owner, operating activity and retained evidence for system boundaries and principal service commitments.
CAssume the service auditor will design and operate the control during fieldwork.
the answer and reasoning
Correct answerB. Map the scoped criterion, control owner, operating activity and retained evidence for system boundaries and principal service commitments.
The stronger response connects system boundaries and principal service commitments to a defined purpose, accountable action and usable evidence. Map the scoped criterion, control owner, operating activity and retained evidence for system boundaries and principal service commitments. This avoids mistaking a document, assumption or outsourced activity for an effective and reviewable practice.
Why the other options fail
A. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
C. This response treats the visible artefact as the outcome and does not establish that the underlying process is suitable, owned and operating.
Casual mode shows feedback as you answer. Full access adds the complete weighted bank, exam mode, saved results and domain-level analysis for this exact qualification.
