SY0-701 General Security Concepts Practice Question
A payroll application allows the same user to create a vendor and approve a payment. The security team wants to reduce fraud without adding unnecessary complexity. Which principle should they apply?
⚠ Common exam trap
Many exam-takers confuse separation of duties with job rotation or defense in depth, mistakenly thinking that rotating employees or adding more technical controls will prevent internal fraud, when in fact only splitting conflicting responsibilities directly addresses the risk of a single user completing a high-risk workflow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties, so no single person can complete the entire high-risk workflow.
Separation of duties (option A) is the correct principle because it prevents a single user from both creating a vendor and approving a payment, which would allow that user to commit fraud by setting up a fake vendor and authorizing a payment to it. By splitting these high-risk tasks between two or more people, the organization enforces a dual-control mechanism that reduces the risk of internal fraud without adding complex technical controls. This aligns with the security team's goal of reducing fraud while avoiding unnecessary complexity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Separation of duties, so no single person can complete the entire high-risk workflow.
Why this is correct
Separation of duties is the best control when one person should not be able to create and approve the same payment. By splitting responsibilities across different roles or approvals, the organization reduces the chance of fraud, abuse, or accidental misuse. This principle is common in finance and payroll workflows because it provides meaningful risk reduction without requiring a complicated technical redesign of the entire application.
- ✗
Job rotation, so employees periodically switch responsibilities to learn each other’s tasks.
Why it's wrong here
Job rotation rotates employees through different roles over time, which can help uncover fraud through peer review or fresh eyes, but it does not stop a single user from completing a high-risk payment cycle during any given rotation period. Since the payroll user still holds both create and approve permissions simultaneously, the immediate fraud or error risk remains unmitigated. Job rotation is a detective administrative control, not a preventive process control, so it fails to address the core segregation-of-duties violation.
- ✗
Defense in depth, so multiple technical tools inspect every payment form.
Why it's wrong here
Defense in depth deploys multiple independent layers of security controls, such as firewalls, intrusion detection, endpoint protection, and logging, to protect the application from external attacks and internal misuse. However, the threat here is not insufficient technical tooling but a flaw in the workflow's authorization design: the same payroll user can both create a vendor and potentially approve payments. Adding more inspection tools would not change the application's access control logic, which is why a procedural control like requiring a second approver is necessary.
- ✗
Least privilege, so the payroll user can create and approve only this one vendor payment.
Why it's wrong here
Least privilege would restrict the payroll user's account to only the minimal permissions required for their job role, such as creating a vendor, but that alone does not prevent them from also holding approval rights for that same vendor. If the application still allows the same individual to perform both the creation and approval steps, the conflict remains regardless of how tightly access is scoped. Least privilege focuses on limiting the blast radius of an account, not on separating conflicting duties, so it does not solve the underlying segregation-of-duties problem.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.