The correct answer is SOC 3 is intended for broad public distribution and provides a concise non technical summary while SOC 2 is restricted to designated users and contains detailed control testing.

SOC 3 is a general use report that is written for broad public distribution and it summarizes whether the service organization meets the AICPA trust services criteria without exposing the detailed control testing. SOC 2 is intended for specified or trusted users and it contains detailed descriptions of controls and the auditor's testing results so that customers and stakeholders can perform their own risk assessments.

SOC 3 is mandated by law for publicly listed companies while SOC 2 is a voluntary attestation is incorrect because SOC reports are attestation engagements by CPAs and are generally voluntary. They are not a statutory filing required of publicly listed companies under securities law.

SOC 3 concentrates only on financial control testing while SOC 2 evaluates security availability processing integrity and privacy is incorrect because financial control testing is the focus of SOC 1, not SOC 3. SOC 2 and SOC 3 map to the trust services criteria such as security, availability, processing integrity, confidentiality, and privacy, and SOC 3 simply provides a higher level summary of those criteria.

SOC 3 commonly includes an AICPA trust services seal for public marketing while SOC 2 is typically not distributed with a public seal is misleading and therefore incorrect as the distinguishing factors are distribution and level of technical detail rather than the presence of a seal. SOC 3 is suitable for public marketing and may accompany a seal or summary, while SOC 2 is restricted and is not usually published widely, but the presence or absence of a seal is not the primary difference.

Full AWS Practitioner Certification Question