What Are Separation of Duties and Need-to-Know?
In the finance workflow, one employee can create a payment batch but cannot approve it, and the same person also cannot view employee records that are unrelated to the task. Which two principles are being enforced? Select two.
Quick Answer
The answer is separation of duties and need-to-know, because the finance workflow enforces both principles simultaneously. Separation of duties prevents fraud by dividing payment creation and approval between different roles, ensuring no single employee can complete a fraudulent transaction without collusion. Need-to-know restricts access to only the employee records directly relevant to the assigned finance task, limiting unnecessary exposure of sensitive data. On the Security+ SY0-701 exam, this combination tests your understanding of how these two principles work together to enforce both process integrity and data confidentiality—a common trap is confusing need-to-know with least privilege, but need-to-know specifically ties access to a defined job function rather than just minimal permissions. Remember the mnemonic: “Split the task, lock the data” to recall that separation of duties divides actions while need-to-know limits visibility.
⚠ Common exam trap
Watch out — candidates often confuse 'need-to-know' with 'least privilege' — need-to-know limits access to specific data based on job necessity, while least privilege limits the overall permissions (e.g., read vs. write) a user has, and candidates often pick least privilege when the scenario describes data restriction rather than permission minimization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties, because creation and approval are split between different roles.
Separation of duties is enforced by splitting the payment creation and approval functions between different roles, preventing a single employee from committing fraud by creating and approving a payment without oversight. This principle reduces the risk of unauthorized or malicious actions by requiring collusion for abuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Separation of duties, because creation and approval are split between different roles.
Why this is correct
Splitting initiation and approval reduces the chance that one person can commit fraud alone.
- ✓
Need-to-know, because the employee sees only records relevant to the assigned finance task.
Why this is correct
Access is limited to information necessary for the job, not to unrelated employee records.
- ✗
Least privilege, because every user should have no more than one permission overall.
Why it's wrong here
Least privilege is broader than a single-permission rule and is not the specific control being emphasized.
- ✗
Defense in depth, because multiple security technologies are layered around the finance system.
Why it's wrong here
No layered technical stack is described; the item focuses on role and information restrictions.
- ✗
Zero trust, because the employee must always be treated as untrusted by the network.
Why it's wrong here
Zero trust may influence access design, but the key issue here is role separation and data scoping.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network team wants no single person to both approve and deploy a production firewall rule, and they also want the approval path to be defensible during an investigation. Which two control concepts best address the stated risk? Select two.
hard- ✓ A.Separation of duties between the person requesting the change and the person implementing it.
- ✓ B.Dual control requiring a second person to approve the rule.
- C.Least privilege for the production change account.
- D.Job rotation for every engineer each quarter.
- E.Risk transference to the firewall vendor.
Why A: Separation of duties (A) ensures that the person who approves a change cannot be the same person who implements it, directly preventing a single individual from both approving and deploying the firewall rule. Dual control (B) requires a second person to independently approve the rule, so no two steps are controlled by one person alone. Together, these controls create an auditable approval path that can be defended during an investigation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.