The answer is separation of duties, and the best remediation is to fix the configuration to require approvals from two different managers. This security principle is circumvented because the configuration error allows a single manager to approve a high-value transaction by exploiting a specific IP address, effectively bypassing the dual-approval requirement that ensures no single individual has unchecked control over critical financial processes. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your understanding of how technical misconfigurations can undermine foundational security controls; a common trap is choosing a remediation that adds extra layers like logging or escalation instead of simply correcting the root flaw. Remember the memory tip: “Two eyes, one fix” — when a dual-approval rule is broken, the fix is always to restore the rule, not to add more rules.
ISC2 CC Security Principles Practice Question
This CC practice question tests your understanding of security principles. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A financial institution is implementing a new transaction approval process. The process requires that for any transaction over $10,000, two managers must approve: one from the sales department and one from the finance department. However, due to a system configuration error, a single manager can approve the entire transaction if they are logged in from a specific IP address. This error is discovered during a routine audit. Which security principle has been circumvented, and what is the best remediation?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties; fix the configuration to require approvals from two different managers
Correct: Separation of duties is circumvented. The best remediation is to correct the configuration to require two distinct approvals (B). Option A is wrong because it doesn't fix the flaw; Option C is wrong because it adds unnecessary complexity; Option D is wrong because it ignores the requirement for two different departments.
Key principle: Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Separation of duties; fix the configuration to require approvals from two different managers
Why this is correct
This restores the intended segregation of duties.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Authentication checks who the user is.
✗
Defense in depth; add a third approval for transactions over $50,000
Why it's wrong here
Adding more approvals does not address the immediate flaw.
✗
Accountability; log all approvals and audit monthly
Why it's wrong here
Logging is detective, not corrective.
✗
Least privilege; reduce the transaction limit to $5,000
Why it's wrong here
Reducing the limit does not fix the flawed approval process.
Common exam traps
Common exam trap: authentication is not authorization
Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.
Detailed technical explanation
How to think about this question
This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.
KKey Concepts to Remember
Authentication checks who the user is.
Authorization controls what the user is allowed to do after login.
Privilege levels affect access to EXEC and configuration commands.
AAA, TACACS+ and RADIUS can separate login success from command access.
TExam Day Tips
→Do not assume successful login means full administrative access.
→Look for words such as cannot enter configuration mode, privilege level, authorization or command access.
→Separate login problems from permission problems before choosing the answer.
Key takeaway
Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related CC questions on access control and AAA configuration.
Security Principles — This question tests Security Principles — Authentication checks who the user is..
What is the correct answer to this question?
The correct answer is: Separation of duties; fix the configuration to require approvals from two different managers — Correct: Separation of duties is circumvented. The best remediation is to correct the configuration to require two distinct approvals (B). Option A is wrong because it doesn't fix the flaw; Option C is wrong because it adds unnecessary complexity; Option D is wrong because it ignores the requirement for two different departments.
What should I do if I get this CC question wrong?
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related CC questions on access control and AAA configuration.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Authentication checks who the user is.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a security audit, it is discovered that a single employee can approve purchase orders and also receive the goods. Which security principle is being violated?
medium
✓ A.Separation of duties
B.Defense in depth
C.Least privilege
D.Need-to-know
Why A: Separation of duties requires that conflicting tasks be divided among different individuals to prevent fraud. Option A (Least privilege) is about access levels. Option B (Need-to-know) restricts data access. Option C (Defense in depth) is about layered controls.
Variation 2. An organization implements a rule that an employee cannot approve their own expenses. This is an example of which security principle?
easy
A.Least privilege
✓ B.Separation of duties
C.Defense in depth
D.Accountability
Why B: Correct: B - Separation of duties. Separation of duties prevents a single individual from having conflicting roles. Option A is wrong because least privilege limits access to only necessary resources. Option C is wrong because defense in depth uses multiple layers. Option D is wrong because accountability tracks actions to individuals.
Variation 3. A company implements a policy that requires two employees to approve any financial transaction over $10,000. Which security principle is being applied?
easy
A.Need to know
B.Defense in depth
C.Least privilege
✓ D.Separation of duties
Why D: Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error. In this scenario, requiring two approvals for large transactions institutionalizes the principle.
Variation 4. A security policy requires that all changes to production systems be approved by a change management board. Which THREE of the following principles best support this requirement?
medium
✓ A.Non-repudiation
B.Defense in depth
✓ C.Separation of duties
✓ D.Accountability
E.Least privilege
Why A: Separation of duties ensures approval and implementation are done by different people. Accountability ensures actions are traceable. Non-repudiation provides proof of approval. Least privilege and defense in depth are less directly related.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.