FREE CPA ISC PRACTICE
CPA ISC Controls, Security and SOC Practice
These original teaching exercises focus on the reasoning behind information-system controls, security decisions, and SOC-report review. They are public learning material, separate from any protected prediction report or secure examination content.
Work each scenario by naming the asset or process, the risk, the control objective, and the evidence that would show the control operated. Use the explanations to identify a precise concept to revisit rather than treating a result as an official score or pass prediction.
Practice the skill, then review the reasoning
A production configuration change must be made urgently to restore a broken customer portal. Which approach best preserves change-control evidence?
A SOC 2 report says customers must review a weekly user-access exception report. A customer receives the report but does not document any review. What is the best conclusion?
Over a 30-day month, a service is unavailable for 90 minutes. What is its availability percentage, rounded to two decimal places?
Start with the risk and control objective
A control answer is strongest when it directly addresses the stated risk. For example, a fictitious supplier risk points to separation of supplier setup, approval, and payment; a missing-interface-record risk points to reconciled counts, totals, and exception handling. A familiar technology word is not enough if it does not change the likelihood or impact described in the facts.
Classify the objective before choosing the control. Confidentiality limits unauthorized disclosure. Integrity supports accurate, complete, and authorized information. Availability supports timely use of systems and data. Then ask whether the proposed control prevents, detects, or supports recovery from the condition.
Turn security activities into evidence
Security controls become more useful when they leave evidence. An access review may leave reviewer sign-off and remediation tickets. A patch process may leave asset records, priority decisions, approvals, deployment evidence, and retest results. An incident response process may leave containment decisions, logs preserved, recovery validation, and assigned corrective actions.
Do not confuse completion of an activity with achievement of its objective. A backup job that reports success still needs restoration testing. A security tool that is purchased still leaves residual risk. The useful question is what evidence demonstrates the control worked for the population, period, and risk under review.
Read SOC reports within their stated boundaries
SOC 1 is about controls likely relevant to user entities’ internal control over financial reporting. SOC 2 addresses Trust Services Criteria for specified users, and SOC 3 is for general use. Report choice depends on the assurance need and intended users, not on which label sounds more comprehensive.
A report only supports what its scope describes. Check the report type, period, services, locations, subservice organizations, criteria, opinion, tests, exceptions, and complementary user entity controls. If the user entity must reconcile a report or configure a setting, it should perform that work and retain evidence rather than assuming the service organization did it.
Use misses to choose a focused next step
After a missed scenario, write one sentence in the form: “Because the risk is __, the objective is __, so the best control or report consideration is __.” This turns a wrong option into a reusable reasoning rule. Then create one different example before revisiting the subject.
Useful remediation is narrow and observable. Review one concept such as a recovery-time objective, a controlled emergency change, processing integrity, or a complementary user entity control. Then test yourself on a new scenario that changes the business process while preserving the underlying objective.
Questions about this practice
Are these official CPA Exam questions or a scaled-score calculator?
No. These are original public teaching exercises. They do not reproduce secure exam content; use the feedback to identify a concept to revisit.
How should I choose between a SOC 1, SOC 2, and SOC 3 concept?
Start with the assurance need and intended users. SOC 1 concerns controls likely relevant to user entities’ ICFR. SOC 2 concerns Trust Services Criteria for specified users. SOC 3 is a general-use Trust Services Criteria report.
What should I do after missing a controls question?
Identify the asset, risk, objective, control category, and evidence of operation. Then work one fresh scenario with different facts. This shows whether you learned the control logic rather than only an answer.
Does a vendor SOC report remove the need for my organization’s controls?
No. Review scope, report period, exceptions, and complementary user entity controls. Your organization may still need to perform controls such as access configuration, reconciliations, or review of provider reports.
References
- AICPA: Learn what to study for the CPA Exam
- NIST: Cybersecurity Framework 2.0
- NIST SP 800-53 Rev. 5: Security and Privacy Controls
- CISA: StopRansomware Guide
- AICPA: System and Organization Controls suite
Updated October 25, 2026 · PassPredictor