SAP Security Interview Questions

Are you planning to attend an interview for the SAP Security Developer role but confused on how to crack that interview and also what would be the most probable SAP Security Interview Questions that the interviewer may ask? Well, you have reached the right place. Tekslate has collected the most frequently asked SAP Security Interview Questions which are often asked in multiple interviews.

Q1) Please explain the personalization tab within a role?

Ans: Personalization is a way to save information that could be common to users, I meant to a user role…  E.g. you can create SAP queries and manage authorizations by user groups. Now this information can be stored in the personalization tab of the role.  (I supposed that it is a way for SAP to address his ambiguity of its concept of user group and roles: is “user group” a grouping of people sharing the same access or is it the role who is the grouping of people sharing the same access).

Q2) Is there a table for authorizations where I can quickly see the values entered in a group of fields? 

Ans: In particular, I am looking to find the field values for P_ORGIN across a number of authorization profiles, without having to drill down on each profile and authorization.

Q3) How can I do a mass delete of the roles without deleting the new roles?

Ans: There is an SAP delivered a report that you can copy, remove the system type check and run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete program or manually delete and then release the transport and import them into all clients and systems.

It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS. To use it, you need to tweak/debug & replace the code as it has a check that ensures it is deleting SAP delivered roles only. Once you get past that little bit, it works well.

Q4) Someone has deleted users in our system, and I am eager to find out who. Is there a table where this is logged?

Ans: Debug or use RSUSR100 to find the info.

Run transaction SUIM and down its Change documents.

Q5) How to insert missing authorization?

Ans: SU53 is the best transaction with which we can find the missing authorizations. and we can insert those missing authorization through pfcg.

Q6) What is the difference between a role and a profile?

Ans: Role and profile go hand in hand. A profile is bought in by a role. The role is used as a template, where you can add T-codes, reports..The profile is one which gives the user authorization.  When you create a role, a profile is automatically created.

Q7) SAP Security T-codes?

Ans: Frequently used security T-codes

  • SU01 Create/ Change User
  • SU01 Create/ Change User
  • PFCG Maintain Roles
  • SU10 Mass Changes
  • SU01D Display User
  • SUIM Reports
  • ST01 Trace
  • SU53 Authorization analysis

Q8) What is the difference between USOBX_C and USOBT_C?

Ans: The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ). This table also determines which authorization checks are maintained in the Profile Generator.  The table USOBT_C  defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.

Q9) What authorization is required to create and maintain user master records?

Ans: The following authorization objects are required to create and maintain user master records: S_USER_GRP: User Master Maintenance: Assign user groups

  • S_USER_PRO: User Master Maintenance: Assign authorization profile
  • S_USER_AUT: User Master Maintenance: Create and maintain authorizations

Q.List R/3 User Types:

  • Dialog users are used for individual users. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon
  •  A Service user – Only user administrators can change the password. No check for expired/initial passwords. Multiple logins permitted
  •  System users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on.
  •  A Reference user is, like a System user, a general, non-personally related, user. Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.

Q10) What is a derived role?

Ans: derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.

  • The higher-level role passes on its authorizations to the derived role as default values which can be changed afterward. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either.
  • Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.

Q11) What is a composite role?

Ans: A composite role is a container that can collect several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.

  • Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role.
  • Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group.
  • The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during the comparison.

SAP Security Tutorial

Q12) What does the user compare do?

Ans: If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on.

Q13) What is the difference between C (Check) and U (Unmentioned)?

Ans: Background: When defining authorizations using Profile Generator, the table USOBX_C defines which authorization checks should occur within a transaction and which authorization checks should be maintained in the PG. You determine the authorization checks that can be maintained in the PG using Check Indicators. It is a Check Table for Table USOBT_C.

In USOBX_C there are 4 Check Indicators.

CM (Check/Maintain):

  • An authority check is carried out against this object.
  • The PG creates an authorization for this object and field values are displayed for changing.
  • Default values for this authorization can be maintained.

C (Check):

  • An authority check is carried out against this object.
  • The PG does not create an authorization for this object, so field values are not displayed.
  • No default values can be maintained for this authorization.

N (No check):

  • The authority check against this object is disabled.
  • The PG does not create an authorization for this object, so field values are not displayed.
  • No default values can be maintained for this authorization.

U (Unmaintained):

  • No check indicator is set.
  • An authority check is always carried out against this object.
  • The PG does not create an authorization for this object, so field values are not displayed.
  • No default values can be maintained for this authorization.

For In-depth knowledge on SAP Security click on: