SY0-301 · Question #232
While rarely enforced, mandatory vacation policies are effective at uncovering:
The correct answer is D. Acts of gross negligence on the part of system administrators with unfettered access to system and no oversight. Mandatory vacation policies force another employee to cover the duties of an absent worker, which exposes gross negligence or misconduct that may otherwise remain hidden when a single administrator operates without oversight.
Question
While rarely enforced, mandatory vacation policies are effective at uncovering:
Options
- AHelp desk technicians with oversight by multiple supervisors and detailed quality control systems.
- BCollusion between two employees who perform the same business function.
- CActs of incompetence by a systems engineer designing complex architectures as a member of a team.
- DActs of gross negligence on the part of system administrators with unfettered access to system and no oversight.
How the community answered
(41 responses)- B2% (1)
- C5% (2)
- D93% (38)
Why each option
Mandatory vacation policies force another employee to cover the duties of an absent worker, which exposes gross negligence or misconduct that may otherwise remain hidden when a single administrator operates without oversight.
Help desk roles already have multiple supervisors and quality control systems in place, so a vacation policy adds little additional detection capability.
Mandatory vacation would expose one employee's actions at a time but would not reveal collusion between two employees who coordinate their cover stories.
Engineering incompetence in a team setting is typically visible through normal peer review and project outcomes, not through forced absences.
When a system administrator with unfettered access and no day-to-day oversight is forced to take mandatory leave, a substitute must take over their responsibilities. This handover reveals undocumented changes, misconfigurations, or negligent practices that the absent administrator may have concealed, since no second party previously reviewed their work.
Concept tested: Mandatory vacation as an administrative security control
Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.