CISSP Identity and Access Management Practice Question
A financial application requires two employees to authorize a wire transfer. Which principle does this implement?
⚠ Common exam trap
Candidates often confuse separation of duties with least privilege, thinking that limiting permissions alone achieves the same goal, but least privilege does not prevent a single user from performing all steps of a critical process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties
Separation of duties (SoD) is the principle that requires two or more individuals to complete a sensitive transaction, such as a wire transfer, to prevent fraud or error. By mandating two employees to authorize the transfer, the application ensures no single person has unchecked control over the entire process, enforcing a dual-control mechanism. This directly implements the SoD principle, which is a core access control concept in identity and access management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Least privilege
Why it's wrong here
Least privilege is a fundamental security principle ensuring that users, programs, or processes are granted only the absolute minimum rights and permissions necessary to perform their legitimate functions. While crucial for minimizing the attack surface and containing breaches, this principle focuses on restricting an individual's *scope* of access. It does not directly address the requirement for multiple individuals to collectively authorize a single critical action, which is the core of the scenario.
- ✓
Separation of duties
Why this is correct
Separation of duties (SoD) is an administrative control designed to prevent fraud, error, and abuse by distributing critical functions and responsibilities among multiple individuals. This ensures that no single person has complete control over an entire sensitive process, requiring collusion to compromise it. The scenario, demanding two employees to authorize a financial transaction, is a direct and classic implementation of SoD, as it mandates shared responsibility for a high-risk action.
- ✗
Need-to-know
Why it's wrong here
The need-to-know principle dictates that individuals should only be granted access to information, resources, or systems that are directly relevant and essential for them to perform their specific job functions. This principle primarily focuses on restricting *information disclosure* and *resource access* based on operational necessity, thereby enhancing confidentiality. It does not, however, address the division of *transactional authority* or the requirement for multiple approvals for a single action, which is the focus of the question.
- ✗
Zero standing privileges
Why it's wrong here
Zero standing privileges (ZSP) is an advanced identity and access management concept where users, including administrators, possess no permanent or "standing" privileged access. Instead, elevated permissions are granted on a just-in-time (JIT) basis, for a limited duration, and only when explicitly required for a specific task. This principle primarily aims to reduce the window of opportunity for privilege misuse by eliminating persistent high-level access, which is distinct from requiring multiple individuals to co-authorize an action.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Separation of duties
Separation of duties is a security principle that splits critical tasks and privileges among multiple people to prevent fraud, errors, and abuse of power.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.