ISC2 Certified Cloud Security Professional (CCSP) Practice Question

A SOC 1 Type II report describes the controls operated and tested at the service-provider level. Physical security of the datacenter, patch management of the virtualization hosts, and configuration of the perimeter firewalls are all provider-managed controls that have already been independently assessed in the CSP's report. Provisioning and de-provisioning user accounts inside the ERP application, however, is a logical access control exercised by the customer's own administrators. Because that activity directly affects the integrity of the customer's financial records and is not performed by the provider, it must be tested by the customer's internal auditors to satisfy SOX requirements. The other options are provider-side controls that can be relied upon through the external SOC report and therefore do not normally require additional internal testing.