SSCP Security Operations and Administration Practice Question
A security administrator is implementing a mandatory vacation policy for employees in sensitive roles. The administrator needs to ensure that the policy supports the detection of fraudulent activities. Which control should be implemented alongside mandatory vacations to maximize its effectiveness?
⚠ Common exam trap
The trap here is selecting a preventive or educational control like background checks or training, when the scenario requires a detective control that provides ongoing oversight to uncover fraud.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Job rotation
Job rotation ensures that multiple employees perform the same duties, increasing the likelihood that fraudulent transactions or irregularities are noticed. When paired with mandatory vacations, it removes the single-person dependency that allows fraud to remain hidden. This combination is a classic segregation of duties and detective control pairing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security awareness training
Why it's wrong here
Security awareness training educates employees about risks and policies, but it does not independently detect fraud. It may encourage reporting, but it lacks the structural oversight that job rotation provides. It is not the control that maximizes the effectiveness of mandatory vacations for fraud detection.
- ✗
Acceptable use policy
Why it's wrong here
An acceptable use policy defines allowed and prohibited behaviors, serving as a preventive and disciplinary tool. It does not actively detect fraud or provide oversight when an employee is on vacation. It is a policy document, not a detective control that complements mandatory vacations.
- ✓
Job rotation
Why this is correct
Job rotation requires other employees to perform the duties of a role, which increases the chance of detecting fraud or errors that a single individual might conceal. Combined with mandatory vacations, it ensures that another person gains visibility into the role's transactions. This dual control strengthens detection and deterrence.
- ✗
Background checks
Why it's wrong here
Background checks are a preventive control performed before hiring or during periodic reinvestigations. They do not provide ongoing detection of fraudulent activity during employment. While valuable, they do not complement mandatory vacations in detecting fraud that occurs over time.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.