ISC2 CCSP Exam - Topic 3 Question 93 Discussion

Actual exam question for ISC2's CCSP exam

Question #: 93
Topic #: 3

[All CCSP Questions]

Because cloud providers will not give detailed information out about their infrastructures and practices to the general public, they will often use established auditing reports to ensure public trust, where the reputation of the auditors serves for assurance.

Which type of audit reports can be used for general public trust assurances?

ASOC 2

BSAS-70

CSOC 3

DSOC 1

Show Suggested Answer

Suggested Answer: A

A cloud carrier is the intermediary who provides connectivity and transport of cloud services between cloud providers and cloud customers.

by James at Jul 10, 2024, 08:08 PM

Limited Time Offer

25%

Off

Get Premium CCSP Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Cherilyn

3 months ago

SAS-70 is outdated; SOC reports are the current standard!

upvoted 0 times

...

Thurman

3 months ago

Wait, are auditors really that trustworthy?

upvoted 0 times

...

Edward

3 months ago

SOC 1 is more for financial controls, not public trust.

upvoted 0 times

...

Eulah

4 months ago

I thought SOC 3 was more reliable for that?

upvoted 0 times

...

Kristeen

4 months ago

SOC 2 is the go-to for public trust!

upvoted 0 times

...

Ben

4 months ago

SOC 1 seems more focused on financial controls, so I doubt it would be the right answer for public trust assurances.

upvoted 0 times

...

Lorrine

4 months ago

I vaguely recall SAS-70 being relevant, but I thought it was outdated now? Maybe it’s not the best choice anymore.

upvoted 0 times

...

Willow

4 months ago

I think SOC 3 is specifically designed for public consumption, right? It’s like a summary of SOC 2, which makes it easier to understand.

upvoted 0 times

...

Talia

5 months ago

I remember SOC 2 being important for service organizations, but I'm not sure if it's the best for public trust.

upvoted 0 times

...

Bettina

5 months ago

I remember learning about SAS-70 reports in class, but I thought those were being phased out in favor of the newer SOC standards. I'll have to double-check which one is the current standard for public-facing cloud audits.

upvoted 0 times

...

Izetta

5 months ago

The key here is that the question is asking about audit reports that can be used for public trust, not just internal audits. I think SOC 3 reports are the ones designed for public disclosure, so that's my best guess.

upvoted 0 times

...

Elli

5 months ago

Hmm, I'm a bit confused on the differences between the various SOC reports. I'll need to review my notes to make sure I understand which one is used for general public trust.

upvoted 0 times

...

Sylvie

5 months ago

I'm pretty sure the answer is SOC 2 reports, since those are the standard for public trust assurances when cloud providers can't disclose their internal details.

upvoted 0 times

...

Leonida

5 months ago

This looks like a straightforward question about lambda functions in Python. I'm pretty confident I can handle this one.

upvoted 0 times

...

Craig

5 months ago

I'm not entirely sure, but I remember there was a practice question that asked something similar about defining tenants. I should have reviewed those again.

upvoted 0 times

...

Jesusita

10 months ago

C) SOC 3 sounds like the winner to me. I mean, if the auditors have a good reputation, that's gotta count for something, right?

upvoted 0 times

Eliseo

9 months ago

C) SOC 3 seems like the best bet. Trust in the auditors is crucial for public assurance.

upvoted 0 times

...

Shala

9 months ago

B) I agree, SOC 3 is a solid option. It's all about that assurance from reputable auditors.

upvoted 0 times

...

Annalee

9 months ago

A) SOC 3 is definitely a good choice. The reputation of the auditors is key for public trust.

upvoted 0 times

...

Simona

10 months ago

Haha, I bet the cloud providers wish they could just give us the keys to their data centers. But hey, at least they're trying to be transparent with these audit reports!

upvoted 0 times

Josefa

9 months ago

D) SOC 1

upvoted 0 times

...

Antonio

9 months ago

C) SOC 3

upvoted 0 times

...

Kristin

9 months ago

B) SAS-70

upvoted 0 times

...

Gracia

10 months ago

A) SOC 2

upvoted 0 times

...

Arlene

10 months ago

Hmm, I'm not sure. Maybe B) SAS-70 since it's a well-established standard, but I'm not confident that's the right answer here.

upvoted 0 times

...

Chery

10 months ago

I think the correct answer is C) SOC 3. It's specifically designed for public trust assurance, unlike the other options which are more for internal controls and audits.

upvoted 0 times

...

Stephanie

10 months ago

I believe SOC 3 can also be used for general public trust assurances, as it focuses on security, availability, processing integrity, confidentiality, and privacy.

upvoted 0 times

...

Jackie

11 months ago

I agree with Jaime, SOC 2 is commonly used for that purpose.

upvoted 0 times

...

Jaime

11 months ago

I think SOC 2 can be used for general public trust assurances.

upvoted 0 times

...