• USA : +1 973 910 5725
  • INDIA: +91 905 291 3388
  • info@tekslate.com
  • Login

SAP Security Interview Questions and Answers

1) Explain what is SAP security?

SAP security is providing correct access to business users with respect to their authority or responsibility and giving permission according to their roles.

2) Explain what is “roles” in SAP security?

“Roles” is referred to a group of t-codes, which is assigned to execute particular business task. Each role in SAP requires particular privileges to execute a function in SAP that is called AUTHORIZATIONS.

3) Explain how you can lock all the users at a time in SAP?

By executing EWZ5 t-code in SAP, all the user can be locked at the same time in SAP.

4) Mention what are the pre-requisites that should be taken before assigning Sap_all to a user even there is an approval from authorization controllers?

Pre-requisites follows like

– Enabling the audit log- using sm 19 tcode

– Retrieving the audit log- using sm 20 tcode

5) Explain what is authorization object and authorization object class?

– Authorization Object: Authorization objects are groups of authorization field that regulates particular activity. Authorization relates to a particular action while Authorization field relates for security administrators to configure specific values in that particular action.

– Authorization object class: Authorization object falls under authorization object classes, and they are grouped by function area like HR, finance, accounting, etc.

6) Explain how you can delete multiple roles from QA, DEV and Production System?

To delete multiple roles from QA, DEV and Production System, you have to follow below steps

– Place the roles to be deleted in a transport (in dev)

– Delete the roles

– Push the transport through to QA and production

This will delete all the all roles

7) Explain what things you have to take care before executing Run System Trace?

If you are tracing batch user ID or CPIC, then before executing the Run System Trace, you have to ensure that the id should have been assigned to SAP_ALL and SAP_NEW. It enables the user to execute the job without any authorization check failure.

8) Mention what is the difference between USOBT_C and USOBX_C?

– USOBT_C: This table consists  the authorization proposal data which contains the authorization data which are relevant for a transaction

– USOBX_C: It tells which authorization check are to be executed within a transaction and which must not

9) Mention what is the maximum number of profiles in a role and maximum number of object in a role?

Maximum number of profiles in a role is 312, and maximum number of object in a role is 150.

Inclined to build a profession as SAP Security Developer? Then here is the blog post on
 SAP Security Training in Hyderabad.

10) What is the t-code used for locking the transaction from execution?

For locking the transaction from execution t-code SM01, is used.

11) Mention what is the main difference between the derived role and a single role?

For the single role, we can add or delete the t-codes while for a derived role you cannot do that.

12) Explain what is SOD in SAP Security?

SOD means Segregation of Duties; it is implemented in SAP in order to detect and prevent error or fraud during the business transaction. For example, if a user or employee has the privilege to access bank account detail and payment run, it might be possible that it can divert vendor payments to his own account.

13) Mention which t-codes are used to see the summary of the Authorization Object and Profile details?

– SU03: It gives an overview of an authorization object

– SU02: It gives an overview of the profile details

14) Explain what is User Buffer?

A user buffer consists of all authorizations of a user. User buffer can be executed by t-code SU56 and user has its own user buffer.  When the user does not have the necessary authorization or contains too many entries in his user buffer, authorization check fails.

15) By which parameter number of entries are controlled in the user buffer?

In user buffer number of entries are controlled by the profile parameter“Auth/auth_number_in_userbuffer”.

16) How many transactions codes can be assigned to a role?

To a role maximum of 14000 transaction codes can be assigned.

17) Mention which table is used to store illegal passwords?

To store illegal passwords, table USR40 is used, it is used to store pattern of words which cannot be used as a password.

18) Explain what is PFCG_Time_Dependency ?

PFCG_TIME_DEPENDENCY is a report that is used for user master comparison.  It also clears up the expired profiles from user master record. To directly execute this report PFUD transaction code can also be used.

19) Explain what does USER COMPARE do in SAP security?

In SAP security, USER COMPARE option will compare the user master record so that the produced authorization profile can be entered into the user master record.

20) Mention different tabs available in PFCG?

Some of the important tab available in PFCG includes

– Description: The tab is used to describe the changes made like details related to the role, addition or removal of t-codes, the authorization object, etc.

– Menu: It is used for designing user menus like addition of t-codes

– Authorization: Used for maintaining authorization data and authorization profile

– User: It is used for adjusting user master records and for assigning users to the role

21) Which t-code can be used to delete old security audit logs?

SM-18 t-code is used to delete the old security audit logs.

22) Explain what reports or programs can be used to regenerate SAP_ALL profile?

To regenerate SAP_ALL profile, report AGR_REGENERATE_SAP_ALL can be used.

23) Using which table transaction code text can be displayed?

Table TSTCT can be used to display transaction code text.

24) Which transaction code is used to display the user buffer?

User buffer can be displayed by using transaction code AL08

25) Mention what SAP table can be helpful in determining the single role that is assigned to a given composite role?

Table AGR_AGRS will be helpful in determining the single role that is assigned to a given composite role.

26) What is the parameter in Security Audit Log (SM19) that decides the number of filters?

Parameter rsau/no_of_filters are used to decide the number of filters.

27)   Please explain the personalization tab within a role?

Personalization is a way to save information that could be common to users, I meant to a user role…  E.g. you can create SAP queries and manage authorizations by user groups. Now this information can be stored in the personalization tab of the role.  (I supposed that it is a way for SAP to address his ambiguity of its concept of user group and roles: is “usergroup” a grouping of people sharing the same access or is it the role who is the grouping of people sharing the same access).

28)  Is there a table for authorizations where I can quickly see the values entered in a group of fields? 

 In particular I am looking to find the field values for P_ORGIN across a number of authorization profiles, without having to drill down on each profile and authorization.

29)  How can I do a mass delete of the roles without deleting the new roles ?

There is a SAP delivered report that you can copy, remove the system type check and run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete program or manually delete and then release the transport and import them into all clients and systems.

It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS. To used it, you need to tweak/debug & replace the code as it has a check that ensure it is deleting SAP delivered roles only. Once you get past that little bit, it works well.

30)  Someone has deleted users in our system, and I am eager to find out who. Is there a table where this is logged?

Debug or use RSUSR100 to find the info’s.

Run transaction SUIM and down its Change documents.

31)  How to insert missing authorization?

SU53 is the best transaction with which we can find the missing authorizations.and we can insert those missing authorization through pfcg.

32)   What is the difference between role and a profile?

Role and profile go hand in hand. Profile is bought in by a role. Role is used as a template, where you can add T-codes, reports..Profile is one which gives the user authorization.  When you create a role, a profile is automatically created.

 33)   SAP Security T-codes?

Frequently used security T-codes

SU01 Create/ Change User SU01 Create/ Change User

PFCG Maintain Roles

SU10 Mass Changes

SU01D Display User

SUIM Reports

ST01 Trace

SU53 Authorization analysis

34)  What is the difference between USOBX_C and USOBT_C?

 The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ). This table also determines which authorization checks are maintained in the Profile Generator.  The table USOBT_C  defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.

Interested in mastering SAP Security? Learn more about SAP Security Tutorials in this blog post.

35)  What authorization are required to create and maintain user master records?

 The following authorization objects are required to create and maintain user master records: S_USER_GRP: User Master Maintenance: Assign user groups

S_USER_PRO: User Master Maintenance: Assign authorization profile

S_USER_AUT: User Master Maintenance: Create and maintain authorizations

Q.List R/3 User Types

1. A Dialog users are used for individual user. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon

2. A Service user – Only user administrators can change the password. No check for expired/initial passwords. Multiple logon permitted

3. System users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on.

4. A Reference user is, like a System user, a general, non-personally related, user. Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.

36)   What is a derived role?

 erived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.

-The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either.

-Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.

37)  What is a composite role?

 A composite role is a container which can collect several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.

– Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role.

– Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group.

– The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison.

38)  What does user compare do?

If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on.

39)  What is the difference between C (Check) and U (Unmentioned)?

 Background: When defining authorizations using Profile Generator, the table USOBX_C defines which authorization checks should occur within a transaction and which authorization checks should be maintained in the PG. You determine the authorization checks that can be maintained in the PG using Check Indicators. It is a Check Table for Table USOBT_C.

In USOBX_C there are 4 Check Indicators.

  1. CM (Check/Maintain)

-An authority check is carried out against this object.

-The PG creates an authorization for this object and field values are displayed for changing.

-Default values for this authorization can be maintained.

  1. C (Check)

-An authority check is carried out against this object.

-The PG does not create an authorization for this object, so field values are not displayed.

-No default values can be maintained for this authorization.

  1. N (No check)

-The authority check against this object is disabled.

-The PG does not create an authorization for this object, so field values are not displayed.

-No default values can be maintained for this authorization.

  1. U (Unmaintained)

-No check indicator is set.

-An authority check is always carried out against this object.

-The PG does not create an authorization for this object, so field values are not displayed.

-No default values can be maintained for this authorization.

40)  How can I do a mass delete of the roles without deleting the new roles ?

 There is a SAP delivered report that you can copy, remove the system type check and run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete program or manually delete and then release the transport and import them into all clients and systems.

It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS. To used it, you need to tweak/debug & replace the code as it has a check that ensure it is deleting SAP delivered roles only. Once you get past that little bit, it works well.

For Indepth knowledge on SAP Security click on:
Summary
Review Date
Reviewed Item
SAP Security Interview Questions and Answers

“At TekSlate, we are trying to create high quality tutorials and articles, if you think any information is incorrect or want to add anything to the article, please feel free to get in touch with us at info@tekslate.com, we will update the article in 24 hours.”

0 Responses on SAP Security Interview Questions and Answers"

    Leave a Message

    Your email address will not be published. Required fields are marked *

    Site Disclaimer, Copyright © 2016 - All Rights Reserved.

    Support


    Please leave a message and we'll get back to you soon.

    I agree to be contacted via e-mail.