A software project manager has been provided with a requirement from the customer to place limits on the types of transactions a given user can initiate without external interaction from another…

Question

Options

• AAn administrative control
• BDual control
• CSeparation of duties
• DLeast privilege
• ECollusion

• A
  2% (1)
• C
  89% (40)
• D
  4% (2)
• E
  4% (2)

Explanation

Separation of Duties (SoD) is the correct answer. SoD is a security principle that ensures no single individual can complete a sensitive or high-risk transaction alone - it requires the involvement of at least one other person or role. The requirement described - that a user cannot initiate certain transaction types without 'external interaction from another user with elevated privileges' - is a textbook implementation of SoD. This prevents fraud, errors, and abuse by ensuring critical actions require collusion between at least two parties. Dual control (B) is similar but specifically means two people must act simultaneously (e.g., two keys turned at the same time); SoD is the broader architectural principle. Least privilege (D) restricts what permissions a user has, but doesn't require a second person. Collusion (E) is the threat that SoD is designed to prevent - it's an attack vector, not a control. Administrative control (A) is a category of control, not a specific mechanism.

No community discussion yet for this question.