SY0-701 General Security Concepts Practice Question
Exhibit
Access review summary User: Alicia M. Assigned roles: - Payroll Administrator - Finance Approver Effective permissions: - Modify payroll records - Approve payroll release - Export payment file Control note: - No secondary approval is required when Alicia approves her own prepared payroll batch.
Based on the exhibit, what is the primary security concern with the current access assignments, and what concept is being violated?
⚠ Common exam trap
CompTIA often tests the distinction between authentication mechanisms (like MFA) and authorization principles (like separation of duties), tempting candidates to select a plausible-sounding but irrelevant option about multifactor authentication when the core issue is conflicting access assignments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The configuration violates separation of duties by letting one person prepare and approve the same payroll activity.
The exhibit shows a single user account with permissions to both prepare and approve payroll transactions. This violates the security principle of separation of duties, which requires that no single individual has control over all phases of a critical process. The primary concern is that this configuration enables fraud or error without independent oversight, as the same person could create and authorize a fraudulent payroll entry.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The system is missing multifactor authentication for payroll users.
Why it's wrong here
Enabling MFA would harden the login process against credential theft, but it would not address the underlying flaw: the same authenticated user is still permitted to both prepare and approve payroll. MFA verifies identity, not authorization, and an insider with valid credentials could continue the fraudulent path. The exhibit’s core issue is a role design problem, not an authentication gap, so adding MFA alone would leave the separation-of-duties violation intact.
- ✓
The configuration violates separation of duties by letting one person prepare and approve the same payroll activity.
Why this is correct
The same user can change payroll data, approve the release, and export the payment file. That concentration of authority creates a clear separation-of-duties failure because one person can both create and authorize a sensitive financial action.
- ✗
The account should be converted to a shared group account for the finance team.
Why it's wrong here
Converting to a shared group account would merge all finance team members into a single identity, which destroys non-repudiation and makes it impossible to determine which individual prepared or approved a payroll run. Auditors rely on unique user accounts to enforce accountability; a shared account would also allow any team member to approve their own hidden changes. This would exacerbate the separation-of-duties failure rather than remedy it, because no single person can be held responsible for a combined action.
- ✗
The permissions are acceptable because payroll users always need full access to related finance functions.
Why it's wrong here
The claim that payroll users always need full access confuses necessary business functionality with proper security design. While users may need access to payroll data, the sensitive sub-tasks of preparing, approving, and exporting a payment file should never be combined in one role. The principle of least privilege and segregation of conflicting duties still applies to finance teams; full access across all related functions creates an unnecessary risk of accidental errors and intentional fraud.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.