Your SecOps instance has roles Tier 1, Tier 2, Tier 3. New requirement: restrict access to Tier 3 cases from other tiers. What should you do?

• A. Ask Tier 1/2 to filter queue to exclude Tier 3 cases.
• B. Revoke additional role access from Tier 1/2 analysts.
• C. Configure Cross Environment Policy to move Tier 3 cases to an environment only Tier 3 analysts can access.
• D. Assign cases to a user in Tier 3 role.

Answer: (C)

Isolating sensitive work through environment-based access control. By configuring a Cross Environment Policy to move Tier 3 cases into a separate environment that only Tier 3 analysts can access, you enforce who can see and work on those cases at the system level. This provides scalable, auditable enforcement of the access restriction, so Tier 1/2 users won’t have visibility or ability to interact with Tier 3 cases.

The other options rely on user behavior or broad permission changes rather than enforcing separation. Filtering queues depends on analysts’ actions and can be bypassed or forgotten; revoking extra role access from Tier 1/2 is disruptive and may hinder legitimate work; assigning cases to a Tier 3 user is manual and does not guarantee that access is restricted across the system.