CISSP Identity and Access Management Practice Question
A financial institution requires that no single employee can approve a transaction and also reconcile the account. This is an example of which security principle?
⚠ Common exam trap
Many exam-takers confuse 'separation of duties' with 'least privilege' because both involve limiting access, but separation of duties specifically addresses conflicting tasks to prevent fraud, not just minimizing permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separation of duties
Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both approving a transaction and reconciling the account. This reduces the risk of fraud or error by requiring collusion between two or more people to subvert a process. In a financial system, SoD is enforced through access control mechanisms that assign distinct roles (e.g., 'Transaction Approver' and 'Account Reconciler') with mutually exclusive permissions, often implemented via Role-Based Access Control (RBAC) or attribute-based policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Separation of duties
Why this is correct
Separation of duties is a control designed to prevent fraud, error, and abuse by ensuring that no single individual has complete control over a critical process from start to finish. It mandates that different individuals perform distinct parts of a sensitive task, such as authorizing, recording, and reconciling transactions. This structure prevents a single employee from both initiating and approving a financial transaction, thereby mitigating the risk of unauthorized actions.
- ✗
Least privilege
Why it's wrong here
Least privilege dictates that users, programs, or processes should be granted only the minimum necessary rights and permissions to perform their legitimate functions. While crucial for security, this principle focuses on limiting the scope of access for each individual or entity, rather than distributing responsibilities across multiple individuals to prevent a single point of control over a process. It does not inherently address the division of tasks among employees.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a security strategy that employs multiple, overlapping security controls and mechanisms to protect assets. This layered approach ensures that if one security control fails, others are in place to provide continued protection, creating a robust security posture. However, it is an architectural philosophy concerning the breadth of security measures, not a specific operational control dictating how responsibilities are divided among personnel to prevent a single point of failure.
- ✗
Need to know
Why it's wrong here
Need to know is a security principle that restricts access to sensitive information only to those individuals whose job functions explicitly require it. This principle ensures that even if an individual has the necessary clearance or permissions, they can only access data essential for their current tasks. While vital for information confidentiality, it focuses on limiting information exposure rather than structuring operational processes to distribute critical duties among multiple employees.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.