Practice compliance testing vocabulary: penetration tests, evidence samples, control testing, compensating controls, and SOC 2 Type II requirements.
0 / 18 completed
1 / 18
Your auditor says 'The penetration test is required for SOC 2 Type II.' Why does SOC 2 require a pentest?
SOC 2 Type II evaluates operating effectiveness of security controls over time. A penetration test provides evidence that the organization actively identifies and remediates exploitable vulnerabilities — it demonstrates the 'risk assessment' and 'logical access controls' trust service criteria in practice.
2 / 18
An auditor says 'The evidence is a screenshot of the control.' What makes evidence valid for compliance purposes?
Compliance evidence (screenshots, exports, logs) must demonstrate the control is operating as designed. Good evidence includes the system name, timestamp, and relevant data. Auditors assess whether it actually proves the control works, not just that it exists.
3 / 18
An audit report says 'The auditor samples 25 tickets for evidence.' What is sampling in compliance testing?
Compliance auditors use sampling because testing every instance of a control is impractical. They select a statistically representative sample (e.g., 25 change tickets) and test whether the control was applied correctly in each case. Failures in the sample indicate systemic control issues.
4 / 18
The audit report reads 'The control test passed — no exceptions.' What does 'no exceptions' mean?
'No exceptions' means the auditor's sample testing found zero cases where the control failed to operate as designed. This is a clean result — the control is considered effective for the audit period.
5 / 18
An auditor notes 'The compensating control substitutes for the missing primary control.' When is a compensating control used?
A compensating control is an alternative security measure accepted when the standard control is not feasible. For example, if segregation of duties is impossible in a small team (one person handles both tasks), enhanced logging and monitoring might be accepted as a compensating control.
6 / 18
PR Description
Subject: Security Update - Implement Rate Limiting
We've implemented rate limiting on the API endpoint to mitigate potential DDoS attacks. This change aligns with our security requirements for PCI DSS compliance. The code has been thoroughly tested and documented, and we've included updated logging.
Which of the following statements best describes the purpose of this PR description in the context of a compliance review?
This question assesses understanding of how PR descriptions contribute to compliance. The correct answer highlights that a good PR description isn't just about code changes; it *must* demonstrate adherence to relevant regulations like PCI DSS. Options A and D are too vague, while option B focuses on the technical details but misses the crucial connection to regulatory requirements – the core of compliance testing. Option C directly addresses the purpose of such descriptions in a compliance context.
7 / 18
During a code review discussion about a recent API update, a developer explains: 'We've added rate limiting to the endpoint. This is necessary because PCI DSS requires us to demonstrate we're protecting against unauthorized access.' Which of the following best captures the *reasoning* behind this statement in terms of compliance?
The correct answer highlights the core function of rate limiting in mitigating a significant risk outlined by PCI DSS. Rate limiting directly addresses the requirement to prevent unauthorized access by limiting the number of requests an API endpoint can handle within a given timeframe. The other options misinterpret the purpose of rate limiting – it's not just about slowing down attackers, nor is it a general-purpose security control. It's a specific mechanism to meet a defined PCI DSS standard.
8 / 18
PR Description
Subject: Security Update - Implement Rate Limiting
We've implemented rate limiting on the API endpoint to mitigate potential DDoS attacks. This change aligns with our security requirements for PCI DSS compliance. The code has been thoroughly tested and documented, and we've included updated logging.
Which of the following statements best describes the purpose of this PR description in the context of a compliance review?
This question assesses understanding of how PR descriptions contribute to compliance. The correct answer highlights that a good PR description isn't just about code changes; it *must* demonstrate adherence to relevant regulations like PCI DSS. Options A and D are too vague, while option B focuses on the technical details but misses the crucial connection to regulatory requirements – the core of compliance testing. Option C directly addresses the purpose of such descriptions in a compliance context.
9 / 18
During a code review discussion about a recent API update, a developer explains: 'We've added rate limiting to the endpoint. This is necessary because PCI DSS requires us to demonstrate we're protecting against unauthorized access.' Which of the following best captures the *reasoning* behind this statement in terms of compliance?
The correct answer highlights the core function of rate limiting in mitigating a significant risk outlined by PCI DSS. Rate limiting directly addresses the requirement to prevent unauthorized access by limiting the number of requests an API endpoint can handle within a given timeframe. The other options misinterpret the purpose of rate limiting – it's not just about slowing down attackers, nor is it a general-purpose security control. It's a specific mechanism to meet a defined PCI DSS standard.
10 / 18
PR Description
Subject: Security Update - Implement Rate Limiting
We've implemented rate limiting on the API endpoint to mitigate potential DDoS attacks. This change aligns with our security requirements for PCI DSS compliance. The code has been thoroughly tested and documented, and we've included updated logging.
Which of the following statements best describes the purpose of this PR description in the context of a compliance review?
This question assesses understanding of how PR descriptions contribute to compliance. The correct answer highlights that a good PR description isn't just about code changes; it *must* demonstrate adherence to relevant regulations like PCI DSS. Options A and D are too vague, while option B focuses on the technical details but misses the crucial connection to regulatory requirements – the core of compliance testing. Option C directly addresses the purpose of such descriptions in a compliance context.
11 / 18
During a code review discussion about a recent API update, a developer explains: 'We've added rate limiting to the endpoint. This is necessary because PCI DSS requires us to demonstrate we're protecting against unauthorized access.' Which of the following best captures the *reasoning* behind this statement in terms of compliance?
The correct answer highlights the core function of rate limiting in mitigating a significant risk outlined by PCI DSS. Rate limiting directly addresses the requirement to prevent unauthorized access by limiting the number of requests an API endpoint can handle within a given timeframe. The other options misinterpret the purpose of rate limiting – it's not just about slowing down attackers, nor is it a general-purpose security control. It's a specific mechanism to meet a defined PCI DSS standard.
12 / 18
PR Description
Subject: Security Update - Implement Rate Limiting
We've implemented rate limiting on the API endpoint to mitigate potential DDoS attacks. This change aligns with our security requirements for PCI DSS compliance. The code has been thoroughly tested and documented, and we've included updated logging.
Which of the following statements best describes the purpose of this PR description in the context of a compliance review?
This question assesses understanding of how PR descriptions contribute to compliance. The correct answer highlights that a good PR description isn't just about code changes; it *must* demonstrate adherence to relevant regulations like PCI DSS. Options A and D are too vague, while option B focuses on the technical details but misses the crucial connection to regulatory requirements – the core of compliance testing. Option C directly addresses the purpose of such descriptions in a compliance context.
13 / 18
During a code review discussion about a recent API update, a developer explains: 'We've added rate limiting to the endpoint. This is necessary because PCI DSS requires us to demonstrate we're protecting against unauthorized access.' Which of the following best captures the *reasoning* behind this statement in terms of compliance?
The correct answer highlights the core function of rate limiting in mitigating a significant risk outlined by PCI DSS. Rate limiting directly addresses the requirement to prevent unauthorized access by limiting the number of requests an API endpoint can handle within a given timeframe. The other options misinterpret the purpose of rate limiting – it's not just about slowing down attackers, nor is it a general-purpose security control. It's a specific mechanism to meet a defined PCI DSS standard.
14 / 18
During a code review of a new payment processing service, Sarah asks Mark: 'We've implemented a CAPTCHA challenge on the login form. Why is that relevant to compliance?'
CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart) specifically target bot attacks – automated processes that can attempt unauthorized logins. Implementing a CAPTCHA demonstrates an active step taken to prevent non-human access, aligning with requirements for user authentication and preventing fraudulent activity which is key to many compliance frameworks like PCI DSS.
15 / 18
Alex sends a Slack message to the security team: 'Just deployed the updated firewall rules. We've blocked outbound connections to known malicious IPs.'
Preventative controls are designed to stop threats before they impact the system. Blocking outbound connections from known malicious IP addresses is a standard preventative measure for mitigating external risks, particularly in environments subject to regulations like PCI DSS where data transmission needs robust protection. It's crucial to note that this is *one* element of a broader security strategy.
16 / 18
The API returns the following response when processing a user login attempt: 'Authentication Failed. Invalid Credentials or Rate Limit Exceeded.'
This API response clearly indicates two separate issues. 'Invalid Credentials' refers to incorrect username or password. 'Rate Limit Exceeded' signifies the user has exceeded pre-defined limits on login attempts (likely a security measure). The response correctly identifies both and their implications for security.
17 / 18
Subject: Audit Fix - Implement Data Masking
We've implemented data masking on the customer database to redact sensitive information during development and testing environments. This addresses a key finding from the recent internal audit regarding potential PII exposure.
Data masking is a key control that directly addresses vulnerabilities and reduces the risk of exposing Personally Identifiable Information (PII). Implementing it demonstrates proactive compliance efforts, specifically responding to audit findings. It's crucial to understand that data masking isn't just about technical implementation; it's about mitigating regulatory risks associated with sensitive data.
18 / 18
During the daily stand-up, David says: 'I've finished implementing multi-factor authentication for privileged accounts. We're using a hardware token for strong two-factor authentication.'
Multi-factor authentication significantly strengthens access controls by requiring multiple verification factors beyond just a password. This reduces the risk of unauthorized access to sensitive systems – an essential element for compliance with regulations like PCI DSS or HIPAA. Using hardware tokens adds another layer of security and is a best practice.
What does the "Compliance Testing Vocabulary" exercise practise?
Practice compliance testing vocabulary: penetration tests, evidence samples, control testing, compensating controls, and SOC 2 Type II requirements.
How many questions are in this exercise?
This exercise has 18 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Compliance Security category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Compliance Testing Vocabulary" part of a larger series?
Yes — it's one exercise in the Compliance Security category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Compliance Security category page for related exercises, or browse the main Exercises hub for other IT English topics.