SY0-701 Question 308

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  When a security analyst requests a SOC 2 report from a SaaS vendor, they are performing due diligence to evaluate the vendor’s security controls, compliance posture, and risk before adopting the service.

• Chose D1

  Due Diligence is a type of practice. it verify and assess various aspects, including security, compliance, and risks. The security analyst is performing due diligence by asking for a SOC 2 report from the SaaS vendor to make an informed decision.

• Chose D9

  D. Due diligence In this context, due diligence refers to the process of evaluating the security, compliance, and risk associated with a third-party vendor or service, such as a SaaS application. Requesting a SOC 2 report is a common part of the due diligence process to assess the vendor's controls related to security, availability, processing integrity, confidentiality, and privacy. Internal audit (A) refers to an organization's internal review of its own processes, not an external vendor. Penetration testing (B) involves actively testing for vulnerabilities by simulating attacks, which is not applicable here. Attestation (C) refers to a third-party audit or certification, such as the SOC 2 report itself, but the analyst is conducting due diligence by requesting the report.