Practice compliance testing vocabulary: penetration tests, evidence samples, control testing, compensating controls, and SOC 2 Type II requirements.
0 / 5 completed
1 / 5
Your auditor says 'The penetration test is required for SOC 2 Type II.' Why does SOC 2 require a pentest?
SOC 2 Type II evaluates operating effectiveness of security controls over time. A penetration test provides evidence that the organization actively identifies and remediates exploitable vulnerabilities — it demonstrates the 'risk assessment' and 'logical access controls' trust service criteria in practice.
2 / 5
An auditor says 'The evidence is a screenshot of the control.' What makes evidence valid for compliance purposes?
Compliance evidence (screenshots, exports, logs) must demonstrate the control is operating as designed. Good evidence includes the system name, timestamp, and relevant data. Auditors assess whether it actually proves the control works, not just that it exists.
3 / 5
An audit report says 'The auditor samples 25 tickets for evidence.' What is sampling in compliance testing?
Compliance auditors use sampling because testing every instance of a control is impractical. They select a statistically representative sample (e.g., 25 change tickets) and test whether the control was applied correctly in each case. Failures in the sample indicate systemic control issues.
4 / 5
The audit report reads 'The control test passed — no exceptions.' What does 'no exceptions' mean?
'No exceptions' means the auditor's sample testing found zero cases where the control failed to operate as designed. This is a clean result — the control is considered effective for the audit period.
5 / 5
An auditor notes 'The compensating control substitutes for the missing primary control.' When is a compensating control used?
A compensating control is an alternative security measure accepted when the standard control is not feasible. For example, if segregation of duties is impossible in a small team (one person handles both tasks), enhanced logging and monitoring might be accepted as a compensating control.