mediumMultiple ChoiceObjective-mapped
Is Requiring Two People for a Financial Transaction an Example of Separation of Duties?
A company implements a policy where a financial transaction must be initiated by one employee and approved by a different employee. This is an example of which access control concept?
Quick Answer
The answer is separation of duties, as requiring two different people to initiate and approve a financial transaction is a textbook example of this access control concept. Separation of duties works by dividing a critical process into distinct steps performed by separate individuals, ensuring that no single person has unchecked control over a sensitive operation. This directly mitigates the risk of fraud, error, or abuse by enforcing checks and balances. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your understanding of how access control principles are applied in real-world policies; a common trap is confusing it with dual control or least privilege, but remember that separation of duties focuses on splitting responsibilities, not just requiring multiple approvals. For a quick memory tip, think “two hands on the same task, but never the same person”—if one employee can both start and finish a transaction, it’s not separation of duties.
⚠ Common exam trap
ISC2 often tests candidates by confusing separation of duties with least privilege, as both involve limiting user actions, but the key distinction is that separation of duties requires multiple people to complete a task, while least privilege only limits the permissions of a single user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties
Separation of duties (SoD) is an access control concept that requires a critical task, such as a financial transaction, to be split into multiple steps performed by different individuals. This prevents any single employee from having the authority to both initiate and approve a transaction, thereby reducing the risk of fraud or error. In this scenario, the policy directly enforces SoD by ensuring that no one person can complete the entire process alone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Need-to-know
Why it's wrong here
Need-to-know restricts data access, not task division.
- ✓
Separation of duties
Why this is correct
Separation of duties requires multiple people to complete a sensitive task.
- ✗
Least privilege
Why it's wrong here
Least privilege is about minimal permissions, not splitting tasks.
- ✗
Job rotation
Why it's wrong here
Job rotation moves people through roles over time.
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to ensure that no single employee can both request and approve a payment. Which access control principle does this enforce?
easy- ✓ A.Separation of duties
- B.Least privilege
- C.Need to know
- D.Defense in depth
Why A: Separation of duties (SoD) is the access control principle that prevents a single individual from having conflicting permissions, such as both requesting and approving a payment. By splitting the payment lifecycle into distinct roles (e.g., requester vs. approver), the organization enforces a dual-control mechanism that reduces the risk of fraud or error. This is commonly implemented in financial systems using role-based access control (RBAC) where the 'payment request' and 'payment approval' roles are mutually exclusive.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.