Exam CCAK topic 1 question 229 discussion

The most important document for an external auditor to review to verify that a cloud service provider's controls are designed and operating effectively is the SOC 2 Type 2 report (option C). A SOC 2 Type 2 report provides an assessment of the effectiveness of a service organization's controls over a period of time, typically six months to a year. This report includes a detailed description of the service organization's system and the suitability of the design and operating effectiveness of its controls. This is in contrast to a SOC 2 Type 1 report, which only assesses the design of controls at a specific point in time. Therefore, the SOC 2 Type 2 report is more comprehensive and provides a better basis for verifying that controls are both designed properly and operating effectively.