To reduce fraud, a finance system requires one user to create a payment batch, a different user to approve it, and a third role to release it to the bank. An audit recommends adding a "super-user" who can perform all three steps to speed month-end close. Which principle would that recommendation most directly weaken?

Least privilege

Least privilege is about granting only the permissions needed, but the core issue here is separating incompatible business functions.

Need-to-know

Need-to-know limits access to information, but this scenario is primarily about dividing responsibilities across people and roles.

Defense in depth

Defense in depth uses multiple layers of controls, but the specific fraud-reduction issue here is role separation within the workflow.

What does this SY0-701 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Separation of duties — Keeping creation, approval, and release in different roles reduces the chance that one compromised account or one dishonest employee can move money without oversight. The recommended super-user would concentrate those powers into one role and remove the control that forces independent review. That is a direct violation of separation of duties, which is designed to reduce fraud and abuse. Why others are wrong: Least privilege is related, but it focuses on minimizing permissions rather than splitting incompatible responsibilities. Need-to-know applies to limiting data visibility, not approval workflow design. Defense in depth refers to layered safeguards, which is not the central issue in this finance-process scenario. The key risk is concentrating all payment authority in one person.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.