hardMultiple SelectObjective-mapped
Separation of Duties: Enforcement Methods
Which THREE of the following are valid methods for enforcing separation of duties in an IT environment? (Select the three best answers.)
Quick Answer
Using RBAC to assign permissions enforces separation of duties because roles can be deliberately designed so that no single role bundles together conflicting responsibilities, for example keeping the ability to initiate a financial transaction separate from the ability to approve it, so that no one person holding a single role can complete a sensitive process entirely on their own. This is the structural, policy-driven way separation of duties gets enforced in an IT environment: rather than trusting individuals to voluntarily split tasks, the system itself is configured so that completing a high-risk action requires cooperation across roles. It works alongside other enforcement methods that accomplish the same underlying goal through different mechanisms, such as the two-person rule, which requires two distinct individuals, often filling different roles, like one approving and another implementing a change, to jointly complete a critical action, ensuring that no single compromised or malicious account has both the authority and the technical ability to execute the action alone. Whether enforced through carefully scoped RBAC roles, dual-authorization workflows, or similar controls, the common thread is always the same: preventing any one person or account from having end-to-end control over a sensitive process. When a question asks about separation-of-duties enforcement methods, look for answers describing structural splits in authority and execution, not answers about monitoring, logging, or single-person controls.
⚠ Common exam trap
Watch out — candidates often confuse monitoring and logging (Option D) as a direct enforcement method rather than a detective control, or think that RBAC (Option E) alone enforces separation of duties without considering that RBAC must be combined with workflow rules to prevent role conflicts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing a two-person rule for critical changes
The two-person rule requires two authorized individuals to perform a critical change, ensuring that no single person has both the authority and the ability to execute a high-risk action. This directly enforces separation of duties by dividing the task into two distinct roles, such as one person approving and another implementing the change, which prevents fraud or errors from a single compromised account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sharing administrative passwords among team members
Why it's wrong here
Sharing passwords violates separation of duties as it allows one person to act as another.
- ✗
Having the same person approve and implement a change
Why it's wrong here
This violates separation of duties.
- ✓
Implementing a two-person rule for critical changes
Why this is correct
The two-person rule requires approval from a second person, enforcing separation.
- ✓
Monitoring and logging all privileged actions
Why this is correct
Logging provides an audit trail but does not directly enforce separation; however, it is a detective control that supports separation by allowing review.
- ✓
Using role-based access control (RBAC) to assign permissions
Why this is correct
RBAC can enforce separation by ensuring that no one role includes conflicting permissions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are valid reasons for implementing a separation of duties policy? (Choose two.)
medium- A.To reduce the workload on individual employees.
- ✓ B.To detect errors through independent verification.
- C.To simplify training requirements.
- D.To comply with regulatory requirements.
- ✓ E.To prevent fraud by requiring collusion.
Why B: Separation of duties (SoD) is a security control that divides critical tasks among multiple individuals to prevent any single person from having excessive control. Option B is correct because independent verification is a core benefit: when one person performs a task and another reviews it, errors are more likely to be caught before they cause damage. This is especially important in financial transactions or system configuration changes where a single mistake could have significant consequences.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.