Exam CAS-003 topic 1 question 309 discussion

Should be...AF

Answers are A. Mandatory vacation and F. Job rotation Their collusion implies that there is already a separation of duties, so that can't be an answer.

Without continuous monitoring, job rotation and/or mandatory vacations are pointless. The question asks what would "uncovered the collusion sooner." If you don't monitor what's going on, you are not going to uncover anything.

The question is asking which of the options would have MOST likely uncovered the collusion. Since their job responsibilities were already separated, only A and F answer the question.

Maybe: C. Continuous monitoring? Maybe not: F. Job rotation? Job rotation may work fine for some jobs. Maybe staff at Walmart or McDonalds. But some sysadmin jobs can be very specialized and complex. You cannot rotate just anybody into a sysadmin job. Whatever you do to separate the sysadmins, shouldn't you also monitor for such collusion in the future? You cannot have somebody on a mandatory vacation all the time.

I think it depends on how they are colluding. Continuous monitoring could catch any unauthorized behavior, so that makes sense. I don't know if "separation of duties" is the best answer for this question. Anything to separate the sysadmins might make sense. If the admins are separated, and the system is monitored, then you might find that whatever was going on has stopped. So "Mandatory vacation" or "Time-of-day restrictions" or "Job rotation" might make sense.

I agree. AF. B Separation of duties is WHY they collude.

AF is correct.

AF Indeed. Mandatory Vacation and Job Rotation for detecting fraud and stuff.