1. VMware or virtual machine is used in penetration testing to enable the running of tools that may be running on operating systems other than the one that our primary system (laptop or host system) runs on. Is this true or false?
2. Name two examples of service providers that require SSAE 18 report to be prepared on the state of design and operating effectiveness of their internal controls.
3. What is the goal of service providers in preparing SSAE 18 reports to their clients?
4. What two other names is SSAE 18 report called?
5. Is SSAE 18 report prepared by the service organization or a third party/independent organization?
6. Name the service organization controls (SOC) report that is focused on information security controls and most useful to IT Security professionals.
7. Which of the SOC reports is focused on financial controls and are more useful to IT Auditors?
8. Which of SOC-2 and SOC-3 reports are:
9. provided to the clients by the service organization upon their request?
10. made available on the service organization's website?
11. Which of type 1 or type 2 SOC report is more detailed, goes beyond control design and contains test of controls including the sample of transactions tested?
12. Are Service Level Agreements (SLAs) primarily used to document service vendors' security responsibilities or used to document their key service expectations?