Access Control & Separation of Duties interview questions

Least privilege, privileged access, approval flows and toxic combinations.

3 questions in Regulation & Compliance.

Regulation & ComplianceA 22-minute read on how the topic fits together, before the questions.Regulation and compliance fundamentals58 short answers on one page, for revising rather than studying.

medium1

mediumConceptDesignScenario

What does least privilege look like in practice, and what is separation of duties there to prevent?

Least privilege is a lifecycle problem rather than a grant: narrow entitlements, time-bound elevation instead of standing admin rights, and reviews that can revoke. Separation of duties exists to stop toxic combinations, where two individually reasonable permissions let one person both act and conceal it.

6 minmid, senior, staff

hard2

hardScenarioDesign

A release goes out and afterwards users can see records they were never entitled to. How would you find out, and how long would it take?

Entitlements change through deployment paths that no access review inspects, so the only reliable detection is a snapshot of effective permissions diffed on every release, with the diff cleared by someone who did not ship it.

6 minsenior, staff, lead

hardDesignScenarioConcept

Nobody has write access to production, but the deploy pipeline can change anything. Where does separation of duties live now?

Removing humans from production moves the privilege into the pipeline, so the boundary becomes who can change what it runs and which identity it assumes. Duties are separated by branch protection, environment approvals and deploying by digest, and it fails when one change alters both code and workflow.

5 minsenior, staff, lead