At a cloud provider's facility, a single operations administrator can both approve requests for access to customer equipment racks and issue and activate the badges that grant that access. Which control is missing?
Select an answer to reveal the explanation.
Short Explanation
If you can write yourself a permission slip and sign it too, nothing's stopping you. Separation of duties splits approving access from granting it, so one person can't quietly let themselves or a friend in. The other choices are real principles, but they don't fix one person holding both ends of the process.
Full Explanation
Separation of duties divides a sensitive process among two or more people so that no individual can complete it alone, which reduces the risk of fraud, error and insider abuse. In data center access control, approving a request and provisioning the credential are distinct duties; when one administrator holds both, that person could approve and activate access for themselves or an accomplice with no independent check, and the audit trail would show a properly approved request. Assigning approval to customer representatives or security management and provisioning to a separate badging function closes the gap. Least privilege limits the rights an individual holds to what the role needs, but even a minimal role that includes both approval and issuance still lets one person complete the process. Defense in depth adds layers of controls, such as an additional fence, yet a corrupt insider who controls the badge workflow would pass through every layer legitimately. Need to know restricts access to information, and concealing rack ownership would not prevent the administrator from granting access. Exam caveat: separation of duties is usually paired with job rotation and mandatory reviews to detect collusion. Operational check: sample recent rack access grants and confirm the approver and the issuer were different people in every case.