SY0-701 Security Architecture Practice Question
Exhibit
Exhibit: Payroll application roles: - HR-Editor: can update employee records - Payroll-Approver: can release payment batches - Audit-Reader: can view reports only Current assignment: User Lisa has both HR-Editor and Payroll-Approver because she "handles payroll end to end." Management wants to reduce the chance of one person creating and approving a fraudulent payment.
Based on the exhibit, which access design change best reduces fraud risk without stopping the payroll process?
Exhibit: Payroll application roles: - HR-Editor: can update employee records - Payroll-Approver: can release payment batches - Audit-Reader: can view reports only
Current assignment: User Lisa has both HR-Editor and Payroll-Approver because she "handles payroll end to end." Management wants to reduce the chance of one person creating and approving a fraudulent payment.
⚠ Common exam trap
Many candidates choose a detective control (like post-payment review) thinking it reduces risk, but the question specifically asks for a change that 'best reduces fraud risk' without stopping the process, and only a preventive control like separation of duties directly addresses the root cause of the conflict of interest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Split duties so record updates and payment approval require separate roles or separate accounts.
It enforces separation of duties (SoD) by ensuring that no single user can both create and approve a payment. Splitting the HR-Editor and Payroll-Approver roles into separate accounts or requiring separate users for record updates and payment approval directly mitigates the fraud risk of a single insider creating a fake employee record and then approving a fraudulent payment batch. This aligns with the principle of least privilege and the NIST SP 800-53 AC-5 control for separation of duties, without halting the payroll workflow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keep both roles assigned but require a manager to review the batch after payment completes.
Why it's wrong here
Post-payment review is useful for detection, but it does not prevent the same person from creating and approving a fraudulent payment in the first place. The control happens too late to fully address the fraud risk described in the exhibit.
- ✓
Split duties so record updates and payment approval require separate roles or separate accounts.
Why this is correct
This is the best design because it enforces separation of duties, which directly reduces fraud risk. The same person should not be able to create a payment and approve it without independent review. Separate roles or accounts preserve workflow continuity while making collusion or abuse harder, and they provide a cleaner audit trail for accountability.
- ✗
Remove the audit role and let payroll staff self-review their own work to save time.
Why it's wrong here
Deleting the audit role eliminates the only independent check on payroll transactions, not just an efficiency step. Self-review is inherently biased because the person who created or modified records is unlikely to catch their own errors or intentional fraud, so the control becomes cosmetic. Without a separate reviewer, the organization also loses the audit trail needed to demonstrate accountability to regulators and external auditors, making the risk worse, not better.
- ✗
Use a single shared payroll account so the workflow never pauses for approvals.
Why it's wrong here
Using one shared payroll account collapses all individual identities into a single set of credentials, eliminating non-repudiation and making it impossible to determine who actually approved a payment. Even when the workflow technically includes an approval step, any of several users can act without personal accountability, so the control is bypassed in practice. This also violates least privilege and can obscure the attack source during incident investigation, increasing rather than reducing fraud risk.
Go deeper
Related to this question
Learn chapter
Secure Network Design Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.