問題文
Guidance asks that the role which applies a time-bound lock be held by someone other than the person who runs the daily protection schedule. An operations lead asks why the two duties are separated when both people are trusted. What is the reason?
選択肢
- One account that both sets a lock and reads the data appears twice in the audit trail, so separating the duties keeps each entry attributable to one person.
- One account that both sets a lock and holds the keys encrypts each snapshot twice, so separating the duties keeps the stored copy protected under a single key.
- One account which both sets a lock and runs the schedule finishes the nightly work in fewer steps, so separating the duties keeps the protection window from growing longer.
- One account that both sets a lock and lifts it can undo the protection it applied, so separating the duties leaves a single stolen account short of what a deletion needs.