SY0-701 General Security Concepts Practice Question
To reduce fraud, a finance system requires one user to create a payment batch, a different user to approve it, and a third role to release it to the bank. An audit recommends adding a "super-user" who can perform all three steps to speed month-end close. Which principle would that recommendation most directly weaken?
⚠ Common exam trap
A common mix-up: candidates confuse least privilege with separation of duties, because both involve limiting access, but separation of duties specifically addresses the division of conflicting tasks to prevent fraud, while least privilege focuses on minimizing permissions for a single role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties
The recommendation to create a super-user who can create, approve, and release payment batches directly violates the separation of duties principle. This principle requires that critical tasks be divided among multiple individuals to prevent any single person from having the ability to commit fraud without collusion. By allowing one user to perform all three steps, the system loses the fraud-prevention control that requires independent actors for each stage of the payment lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Least privilege
Why it's wrong here
Least privilege is a control that restricts each user to the minimum permissions required for their specific role, such as read-only access for a teller. However, the fraud-reduction flaw here is not excessive permission granted to one role, but rather the failure to partition incompatible transaction steps. A super-user who can both create and approve a payment would still be operationally efficient under a least-privileged model, because each action individually might be minimal. Therefore, least privilege does not address the need to force independent review through role separation, making it an incorrect answer.
- ✓
Separation of duties
Why this is correct
Keeping creation, approval, and release in different roles reduces the chance that one compromised account or one dishonest employee can move money without oversight. The recommended super-user would concentrate those powers into one role and remove the control that forces independent review. That is a direct violation of separation of duties, which is designed to reduce fraud and abuse.
- ✗
Need-to-know
Why it's wrong here
Need-to-know is an information access control that limits data visibility to only those whose job requires specific business details, typically protecting sensitive records like customer PII. While reducing information exposure can indirectly deter misuse, it does not control the ability to execute transactional actions such as creating or approving a payment. In this finance system, the super-user might correctly access all necessary data, but the fraud risk stems from one person having authority over multiple workflow steps. Thus, need-to-know is wrong because it concerns confidentiality, not the segregation of conflicting responsibilities.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a security architecture that layers multiple independent controls, such as firewalls, antivirus, and auditing, so that a failure in one layer does not compromise the whole system. Although separation of duties could be one of those layers, the scenario specifically highlights the absence of that particular role-based control, not a lack of additional layers like logging or anomaly detection. Adding more monitoring or encryption would not prevent a trusted insider from combining creation and approval if those abilities remain in a single role. Therefore, defense in depth is incorrect because it addresses resilience across many controls rather than the mandatory division of duties.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.