Sec+ 601 Flashcards
A CSO is interested in determining the security posture of a cloud provider
who may provide service to their organization in the future. Which of the
following would the CSO want to review?
PCI DSS standards
SOC 2 report
CSF framework
SLA contract
SOC 2 report
A service organization controls (SOC) report (not to be confused with the other SOC acronym,
security operations center) is a way to verify that an organization is following some specific best practices before you outsource a business function to that organization.
What type of control would make an organization aware of an intrusion or
compromise?
Detective
Corrective
Protective
Preventive
Detective
What control type resolves a previously discovered issue and mitigates a
risk going forward?
Corrective
Detective
Preventative
Finalized
Corrective
Which ISO standard is specifically designed for certifying privacy?
