Correct Answer: A. A SOC2 report is focused on IT services; mainly, confidentiality, integrity, and availability, and there are two types. Type 1 and Type 2. A Type1 confirms controls exist. A Type 2 confirms controls exist and that work as intended. The question is asking for a point in time as that would just show that controls are in place. C is incorrect. A SOC2 report is focused on IT services; mainly, confidentiality, integrity, and availability, and there are two types. Type 1 and Type 2. A Type1 confirms controls exist. A Type 2 confirms controls exist and that work as intended. B is incorrect. A SOC1 report is a company’s internal control over financial reporting, i.e. accounting and financial controls. A SOC1 Type1 pertains to the audit taken place on a specific single date. D is incorrect. A SOC1 report is a company’s internal control over financial reporting, i.e. accounting and financial controls. A Soc Type2 is concerned with a more extended period of time.