When segregation of duties concerns exists between IT support staff and end users, what would be a suitable compensating control?

When segregation of duties concerns exists between IT support staff and end users, what would be a suitable compensating control?
A . Restricting physical access to computing equipment
B . Reviewing transaction and application logs
C . Performing background checks prior to hiring IT staff
D . Locking user sessions after a specified period of inactivity

View Answer

Answer: B

Explanation:

Only reviewing transaction and application logs directly addresses the threat posed by poor segregation of duties. The review is a means of detecting inappropriate behavior and also discourages abuse, because people who may otherwise be tempted to exploit the situation are aware of the likelihood of being caught. Inadequate segregation of duties is more likely to be exploited via logical access to data and computing resources rather than physical access. Choice C is a useful control to ensure IT staff are trustworthy and competent but does not directly address the lack of an optimal segregation of duties. Choice D acts to prevent unauthorized users from gaining system access, but the issue of a lack of segregation of duties is more the misuse (deliberately or inadvertently} of access privileges that have officially been granted.