ISC2 CC Security Principles Practice Question
A financial services firm wants to ensure that a single employee cannot initiate and approve a large wire transfer alone. The firm implements a process where one employee creates the transfer and a different employee must approve it. Which security principle is being applied?
⚠ Common exam trap
The trap here is thinking that any control involving multiple people is separation of duties, when in fact mandatory vacation and job rotation also involve others but do not split a single task into separate authorizations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties
Separation of duties ensures that a critical task requires more than one person to complete, preventing a single individual from abusing the process. By having one employee create the wire transfer and another approve it, the firm applies this principle directly. Least privilege, job rotation, and mandatory vacation serve different purposes and do not enforce dual control over a single transaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Least privilege
Why it's wrong here
Least privilege limits a user's access rights to only what is needed for their job. In this scenario, the employees may already have the necessary access to perform their roles; the concern is not excessive permissions but rather preventing one person from completing a sensitive transaction alone. Therefore, least privilege does not address the dual-control requirement described.
- ✓
Separation of duties
Why this is correct
Separation of duties divides a critical task among multiple people so that no single individual can complete it alone, reducing the risk of fraud or error. Requiring one employee to create and another to approve the wire transfer directly implements this principle. It ensures that a single person cannot both initiate and authorize a high-risk financial action.
- ✗
Mandatory vacation
Why it's wrong here
Mandatory vacation requires employees to take time off so that others can review their work and uncover irregularities. It is a detective control that might reveal fraud after the fact, but it does not prevent a single employee from initiating and approving a wire transfer in the first place. The firm needs a preventive control, which separation of duties provides.
- ✗
Job rotation
Why it's wrong here
Job rotation periodically moves employees through different roles to detect fraud and cross-train staff. While it can complement separation of duties, it does not enforce the requirement that two different people handle the same transaction. In this scenario, the firm needs a control that prevents one person from completing the transfer alone, not a rotation schedule.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Separation of duties
Separation of duties is a security principle that splits critical tasks and privileges among multiple people to prevent fraud, errors, and abuse of power.
Key term
Mandatory vacation
Mandatory vacation is a security control that requires employees to take a consecutive period of leave so that any unauthorized activities or irregularities in their work can be detected by others.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.