Study. uk . com
  1. Home
  2. All questions
  3. Question 331

CompTIA Security+ study material · question 331 of 611

A payments process is split so that one person raises a payment and another approves it. Which control is this, and what does it force an attacker to do?

  1. Dual control; bypass the approval queue
  2. Separation of duties; obtain collusion from a second person
  3. Least privilege; obtain higher privileges
  4. Job rotation; wait for the next rotation
Show the answer

Answer: B. Separation of duties; obtain collusion from a second person

Splitting a sensitive activity means no single person can complete it, so fraud requires collusion.

Source: NIST SP 800-53 Rev. 5 (NIST) — SP 800-53r5 › AC-5 Separation of Duties

Challenge yourself on this topic → Study as cards