hardMultiple Choice
ISC2 CC Practice Question: Designing a new application that processes credit…
A company is designing a new application that processes credit card payments. They want to ensure that no single administrator can bypass security controls to approve a fraudulent transaction. Which principle should be implemented?
⚠ Common exam trap
ISC2 often tests separation of duties by presenting a scenario about preventing fraud or abuse, and the trap is that candidates confuse it with least privilege, thinking limiting permissions alone solves the problem, when in fact the core issue is splitting conflicting tasks across different people.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties
Separation of duties ensures that no single administrator has the authority to both initiate and approve a credit card transaction. By dividing critical functions among multiple individuals, the company prevents a single compromised account from authorizing fraudulent payments. This principle directly addresses the risk of insider threats or credential misuse in payment processing systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Separation of duties
Why this is correct
Separation of duties splits transaction authorisation across multiple people, so no single administrator holds enough privilege to approve a fraudulent payment alone. This directly satisfies the stem's requirement that one administrator cannot bypass security controls.
- ✗
Defense in depth
Why it's wrong here
Defence in depth layers independent controls so one failure does not expose the system, but it does not prevent a single administrator from authorising a transaction alone. It is tempting because layered controls sound protective, yet the requirement is splitting authority so no individual can approve unilaterally.
- ✗
Least privilege
Why it's wrong here
Least privilege limits each administrator's own permissions but does not stop one administrator holding both approval and execution rights from acting alone. It is tempting because it is a core access-control principle, and it would be correct for constraining standing entitlements, not for enforcing separation of duties across a transaction.
- ✗
Need to know
Why it's wrong here
Need to know limits data access to what a role requires, addressing confidentiality rather than authorisation workflow. It is tempting because it restricts administrators, but it does not stop one person approving a fraudulent transaction; separation of duties does, by requiring independent approval.
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Separation of duties
Separation of duties is a security principle that splits critical tasks and privileges among multiple people to prevent fraud, errors, and abuse of power.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.