hardMultiple ChoiceObjective-mapped
Separation of Duties Violation: How a Configuration Error Circumvents Dual Approval
A financial institution is implementing a new transaction approval process. The process requires that for any transaction over $10,000, two managers must approve: one from the sales department and one from the finance department. However, due to a system configuration error, a single manager can approve the entire transaction if they are logged in from a specific IP address. This error is discovered during a routine audit. Which security principle has been circumvented, and what is the best remediation?
Quick Answer
The answer is separation of duties, and the best remediation is to fix the configuration to require approvals from two different managers. This security principle is circumvented because the configuration error allows a single manager to approve a high-value transaction by exploiting a specific IP address, effectively bypassing the dual-approval requirement that ensures no single individual has unchecked control over critical financial processes. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your understanding of how technical misconfigurations can undermine foundational security controls; a common trap is choosing a remediation that adds extra layers like logging or escalation instead of simply correcting the root flaw. Remember the memory tip: “Two eyes, one fix” — when a dual-approval rule is broken, the fix is always to restore the rule, not to add more rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties; fix the configuration to require approvals from two different managers
Correct: Separation of duties is circumvented because the system allowed a single manager to approve large transactions. The best remediation is to fix the configuration to require approvals from two different managers, as stated in option A. Option B (Defense in depth) is not the core principle violated, and adding a third approval does not fix the single-approval flaw. Option C (Accountability) is important but does not prevent the circumvention. Option D (Least privilege) is about reducing access, not about requiring dual approval.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Separation of duties; fix the configuration to require approvals from two different managers
Why this is correct
This restores the intended segregation of duties.
- ✗
Defense in depth; add a third approval for transactions over $50,000
Why it's wrong here
Adding more approvals does not address the immediate flaw.
- ✗
Accountability; log all approvals and audit monthly
Why it's wrong here
Logging is detective, not corrective.
- ✗
Least privilege; reduce the transaction limit to $5,000
Why it's wrong here
Reducing the limit does not fix the flawed approval process.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on CC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a security audit, it is discovered that a single employee can approve purchase orders and also receive the goods. Which security principle is being violated?
medium- ✓ A.Separation of duties
- B.Defense in depth
- C.Least privilege
- D.Need-to-know
Why A: The scenario describes a single employee having both the ability to approve purchase orders and receive goods, which creates a conflict of interest and increases the risk of fraud. This violates the principle of separation of duties, which requires that conflicting tasks be divided among different individuals. Option A (Separation of duties) is the correct principle. Option B (Defense in depth) refers to layered security controls, not task segregation. Option C (Least privilege) limits user access rights to the minimum necessary for their role, which is not the primary issue here. Option D (Need-to-know) restricts access to data only to those who require it for their job functions, which is also not directly violated.
Variation 2. An organization implements a rule that an employee cannot approve their own expenses. This is an example of which security principle?
easy- A.Least privilege
- ✓ B.Separation of duties
- C.Defense in depth
- D.Accountability
Why B: Correct: B - Separation of duties. Separation of duties prevents a single individual from having conflicting roles. Option A is wrong because least privilege limits access to only necessary resources. Option C is wrong because defense in depth uses multiple layers. Option D is wrong because accountability tracks actions to individuals.
Variation 3. A company implements a policy that requires two employees to approve any financial transaction over $10,000. Which security principle is being applied?
easy- A.Need to know
- B.Defense in depth
- C.Least privilege
- ✓ D.Separation of duties
Why D: Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error. In this scenario, requiring two approvals for large transactions institutionalizes the principle.
Variation 4. A security policy requires that all changes to production systems be approved by a change management board. Which THREE of the following principles best support this requirement?
medium- ✓ A.Non-repudiation
- B.Defense in depth
- ✓ C.Separation of duties
- ✓ D.Accountability
- E.Least privilege
Why A: Separation of duties ensures approval and implementation are done by different people. Accountability ensures actions are traceable. Non-repudiation provides proof of approval. Least privilege and defense in depth are less directly related.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.