Academy Catalog|CTE-SOC2 · Cybersecurity SOC 2 Evidence & IT General Controls Walkthrough
CISA Exam Prep →
CTE-SOC20/3 Modules VerifiedBridges into: CISA, CISSP, CISM, CRISC, CCSP, COMPTIASECURITY, CIA, CPA
~85 min total · Module 1 Free Preview

Cybersecurity SOC 2 Evidence & IT General Controls Walkthrough

Perform a complete SOC 2 Type II ITGC examination: terminated-user IAM/CloudTrail triage (CC6.2), CI/CD change-management sampling (CC8.1), and Section IV deviation reporting.

Audit & Telemetry Triage Console~30 min · SOC 2 Engagement #SOC-101: CloudVault Inc. Terminated-User Audit

Module 1: Logical Access Revocation (CC6.2) & Post-Termination Egress Triage

Cross-examine CloudVault's HRIS termination extract against Okta SSO and AWS CloudTrail logs under Control CC6.2 (24-Hour Access Revocation SLA).

Logical Access Sample Extract · Unedited Primary Source PacketInspect figures carefully for Stage 2 Workpaper

Exhibit 1A: HRIS Termination Roster vs. Okta/AWS IAM Telemetry

Sample #08 — Emp #402 (Backend Eng)HRIS Term: May 12 17:00 UTC · Okta/AWS Disabled: May 12 17:14 UTC · Last Login: May 12 16:40 UTC
Sample #14 — Emp #419 (Database Admin)HRIS Term: Aug 04 16:00 UTC · Okta Disabled: Aug 04 16:30 UTC · Direct AWS IAM Key Active Until Aug 19 (S3 GetObject logged Aug 07)

Governing Statutory Authorities & Practitioner Rules

Population Completeness & Orphaned Credential Testing (AICPA TSC CC6.2)

AICPA SSAE 18 (AT-C §205) · TSC CC6.2 · ISACA ITAF

Auditors must reconcile HRIS terminations against ALL authentication paths (including direct AWS IAM access keys/SSH keys, not just SSO) and inspect activity logs across any exposure gap.

Fieldwork Tip: Disabling Okta SSO leaves long-lived AWS IAM access keys active unless key rotation/revocation is automated.