CCAR-P

Question

You are auditing a procurement-assistant agent whose defined responsibility is drafting purchase requests for review. For each currently configured tool, select Yes if it should remain after a least-privilege audit. Otherwise, select No if it should be removed.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Yes or No

Statements	Yes	No
a read-only catalog lookup tool that returns vendor and SKU information
an inbox-send tool that emails purchase requests to vendors directly
a draft-write tool that creates purchase-request drafts in the review queue
a production-database admin tool unrelated to procurement
A read-only policy-document tool that returns the relevant procurement policies

Explanation

Least privilege permits the read-only catalog and policy lookups needed to prepare compliant purchase-request drafts, plus the draft-write capability required to place drafts in the review queue. Direct vendor email sending exceeds the review-only responsibility, and unrelated production-database administration is unnecessary and overly privileged.

CCAR-P

AstroTutor

Notes

Readiness

QuestionQ65

Community Discussion