ISC2 Certified in Cybersecurity (CC) Practice Question

Dividing critical payroll responsibilities among multiple individuals exemplifies the segregation of duties principle. By ensuring that no single person can initiate, approve, and review the same transaction, an organization greatly reduces the risk of fraud and errors. Least privilege limits each user's permissions but does not necessarily require multiple people for a task. Discretionary access control involves resource owners deciding who can access objects. The need-to-know principle restricts information disclosure to those who require it, yet it does not mandate separating duties among different individuals.