SAP Security Interview Questions And Answers Part - 3

1. What is reference user type?

Reference username used to assign delegation/temp access to a user
i.e example a user is going for a holiday during that time we need to assign another employee to take responsibility to avoid business impact, so that can be achieved using reference user type, You can assign a ref user in roles tab

2. How do you create an authorization object?

Go to SU21 and select authorization class and create an authorization object and maintain authorization fields and maintain authority check for it

3. Is it possible to convert authorization fields into organization fields and what are the exception/restrictions for it?
ABAP report PFCG_ORGFIELD_CREATE used to convert authorization fields into ORG level, similarly report PFCG_ORGFIELD_DELETE used to convert org level field into non org fields

a.    Only create Organizational level fields before you start setting up your system. If you create organizational level fields later, the authorization data for roles may have to be post processed.

b.    The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into an organizational level field.
Refer: OSS note 323817

4. How do you extract user email address?
USR21 and ADR6 tables are used to get user email address in SAP.

Enter the username in USR21 tcode and execute it, now you will get “person number” and copy it which users email address required and enter those person numbers to ADR6 table and execute it and you will get the email address

5. How to extract parent and derived role relation?
Table AGR_DEFINE used to check parent and derived role relationship

6. How do you create authorization groups?
SE54 tcode used to create authorization groups for tables and programs

7. How do you restrict a table to particular person or team?
Create an authorization group for the table which needs to be protected and add the auth group to S_TABU_DIS auth object filed value and give it activities like, create, delete, display, etc..

8. In which table you will check authorization group created for a particular table?
TBRG table used to check available authorization groups and TBRGT holds auth group with description

9. What are the ORG fields in sap?
1.    Company code
2.    Controlling area
3.    Division
4.    Sales organization
5.    Plant
6.    Business area
7.    Purchasing organization
8.    Credit control area
9.    Account type

10. What are status light in authorization page for authorization fields in PFCG?
1.    Red – Org level not maintained
2.    Yellow – atleast one filed left open
3.    Green – all fields are maintained

11. What is the difference between R/3 security and BW security?
R/3 security mainly based on transaction and controlled via authorization objects using profiles and roles
BW security is mainly based on analysis authorization using RSECADMIN tcode and very few tcodes compare to R/3 and we should secure Info objects, info cubes, ODS and quires

BW authorizations are primarily focused on data not on transaction codes and divided into two main areas authorization for administrator workbench and authorization for business explorer
Authorization objects for field level security in reporting are created as and when needed.

12. Which authorization object gives end user to execute/view a query in BW?
-    S_RS_COMP
-    S_RS_COMP1
-    S_RS_FOLD

13. What is the use of SU24 tcode?
SU24(check indicator) holds the relationship between tcode and authorization objects in customer tables USOBX_C and USOBT_C tables which values are pulled during role creation
SU24 used to maintain all the objects that are checked during tcode execution

14. How do you check authorization check for a tcode?
Check SU24 for authorization object and its proposal also we can check the ABAP report as well

15. What is the authorization object which gives developer debug authorization?
S_DEVELOP with activity 01, 02 or 03

16. How do you secure/give access to a custom report to users without  giving SE38 tcode access?
Create an authorization group for that report to secure it and give SA38 tcode authorization for execution of the custom report or create a custom transaction code and maintain authority check and assign to users via role.

17. How do you create a custom tcode?
SE93 is the tcode used to create a custom tcode

18. How do you create a transport request?
SE01, SE09, SE10 tcodes are used to create a transport request and also we can create during customization time like, PFCG, SE38, BD54, etc..

19. What are the types of transport requests?
-    Custom transport request
-    Workbench transport request
-    Transport of copies
-    Relocation

20. What is the difference between custom and workbench transport requests?
-    Workbench requests are those involve changes to cross client customizing and repository objects, those objects are independent of the client and the requests are used to transport changed repository objects and changed system settings from cross client tables
-    Customizing requests involve changes to client dependent objects, so custom transport request used to copy and transport requests that are client specific


21. How do you schedule a background job
SM36 used to schedule background jobs

22. Have you worked on upgrade and steps involved?
Yes
2A. Compare with SAP values
2B. Compare affected transaction codes
2C. Roles to be checked
2D. Display changed transaction codes

23. What is expert mode in PFCG?
Expert mode in PFCG used to maintain existing roles it has following options
-    Delete and recreate authorization and profiles
-    Edit old status
-    Read old status and merge with new data

24. Which table you can check the relation between composite roles and child roles?
AGR_AGRS

25. What are the license types you assign to end users while creating it?
-    Application professional users
-    Application limited professional users
-    Application ESS user

26. You are not allowed to assign any roles to user profile further what would be the reason for it?
User must have exceeded the limitation for profiles assignment i.e 312

27. Have you worked with auditors?
Yes with internal auditors and explain it

28. Which table used to view roles and org level values?
Table AGR_1252 maintains relationship between roles and org field values

29. Which table used to view roles and authorization objects and its values?
Table AGR_1251 maintains relationship between roles, authorization objects and its field values

30. Where do you delete old audit logs?
SM18

31. Where do you look lock entries?
SM12

32. Which authorization object gives you SM12 authorization other than S_tcode?
S_ENQUE

33. Where do you reset user buffer?
SU56

34. What is the mandatory field in address tab in SU01?
Last Name

35. How do you lock a tcode?
SM01 tcode used to lock a tcode

36. Which table stores all ABAP reports?
TRDIR

37. How do you lock users who didn’t log in to SAP more than 90 days?
USR02 tables we can get last login date and time

38. Which table holds all valid activity fields?
TACTZ

39. ABAP report which is used for user reconciliation?
PFCG_TIME_DEPENDENCY

40. Table which holds all possible authorization fields as variables
USVAR

Part -1
Part - 2 

SAP Security Interview Questions And Answers Part -2

1. How do you identify SAP standard roles?

SAP standard roles will start with “SAP*”

2. How do you assign SAP standard role to user or what is the procedure to assign SAP standard role?

It’s good to avoid direct assignment of SAP standard roles and copy SAP standard role to a new role and assign it to the users.

3. There is no authorization profile assigned to a role whether its considered as composite role?

No its not considered as composite role and it’s a incomplete single role

4. What are the role types available?

• Single role
• Composite role
• Derived role
• Master role
• Copy role

5. What is the relationship between parent role and derived role?

Parent role is the place where we maintain list of tcodes and derived role will inherit all the authorizations from parent role except Org values.

6. What are the values for user lock?

• 00 - not locked
• 32 – Locked Globally by administrator
• 64 – Locked by administrator
• 128 – Locked due to incorrect logon attempt

7. How do you deactivate a authorization object globally?

Goto tcode SU25 and select step 5. Deactivate authorization object globally

8. If all users are locked mistakenly and how do you login to sap system

Check link how to unlock SAP* at OS level

9. Which authorization object used to check transaction codes?

S_tcode

10. Which authorization object is used to check HR transaction codes?

P_tcode

11. Why do we need to create a TR for a role?

Roles are developed in development system and tested in quality system and moved to production system, so that’s why we need to create a transport request for a role when its created/changed

12. List out important security tcodes

PFCG                 Role Maintenance

SM19                 Security Audit Configuration

SM20                 Security Audit Log Assessment

ST01                 System Trace

SU01                 User Maintenance

SU02                 Maintain Authorization Profiles

SU03                 Maintain Authorizations

SU10                 User Mass Maintenance

SU21                 Maintain Authorization Objects

SU24                 Auth. Obj. Check Under Transactions

SU25                 Upgrade Tool for Profile Generator

SU53                 Display Check Values

SUIM                 User Information System

13. What are the mandatory fields while creating a username?

Password and lastname

14. What is the difference between USOBX_C and USOBT_C?
Table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ) when its executed. This table also determines which authorization checks are maintained in the Profile Generator.
Table USOBT_C  defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.

15. How do you create usernames in SAP?
Goto transaction SU01 and creating a new username, you must enter an initial password for that user on the Logon data tab and last name in address tab

16. What are the authorization objects are required to create and maintain user master records?

• S_USER_GRP: User Master Maintenance: Assign user groups
• S_USER_PRO: User Master Maintenance: Assign authorization profile
• S_USER_AUT: User Master Maintenance: Create and maintain authorizations

17. List R/3 User Types

• Dialog - users are used for individual user. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon
• Service user - Only user administrators can change the password. No check for expired/initial passwords. Multiple logon permitted
• System - users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on.
• Reference - user is, like a System user, a general, non-personally related, user. Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.
• Communication data – GUI logon not possible and and check for expired/initial passwords and its used for RFC connections

18. What does user compare do?
If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on.

19. What is the difference between the table buffer and the user buffer?
The table buffers are in the shared memory. Buffering the tables increases performance when accessing the data records contained in the table. Table buffers and table entries are ignored during startup. A user buffer is a buffer from which the data of a user master record is loaded when the user logs on. The user buffer has different setting options with regard to the 'auth/new_buffering' parameter.

20. How do you find out who has deleted a user from your system, Is there a table where this is logged?
Debug or use RSUSR100 to find the info's.
Run transaction SUIM and down its Change documents.

21. What is the difference between role and a profile?
Role and profile go hand in hand, Profile is bought in by a role.

Role is used as a template, where you can add T-codes, reports. Profile is one which gives the user authorization.  When you create a role, a profile is automatically created.

22. What is system profile version?
Profile versions are nothing but when you modify a profile parameter in RZ10 and generates a new profile is created with a different version and it is stored in the database and physical backup file is created as .bak.

23. What is the use of role templates?
User role templates are predefined activity groups in SAP consisting of transactions, reports and web addresses.

24. What is the different between single role & composite role?
A role is a container that collects the transaction and generates the associated profile.  A composite roles is a container which can collect several different roles

25. Is it possible to change role template? How?
Yes, we can change a user role template. 

• we can use it as they are delivered in sap
• we can modify them as per our needs through PFCG
• we can create them from scratch

SAP Security Interview Questions And Answers Part -1
SAP Security Interview Questions And Answers Part - 3

Please do share if you like this post:)

SAP Security Interview Questions And Answers Part - 1

1. What is derived role?

Derived roles are called child roles and its derived from another role which is already exist which is called as master role.

Derived roles inherits menu structure and functions like transactions, reports, weblinks and etc from master role

You need to maintain organization levels in derived role.

2. What is the use of SU56 transaction code?

SU56 tcode used to display current user buffer which authorization is assigned in user master record.

Administrators can able to reset other user buffer when its required.

3. How to lock large number of users at a time?

SU10 tcode used to lock large number of users at a time or check our earlier post for mass user change here

4. How do you check whether CUA is configured in your system?

Go to SU10d tcode and display a usernames which is exist in the particular system and check whether there is a “System” tab before “Roles” Tab which means CUA is configured in it.

5. How GRC landscape designed?

It will be designed a 2 system landscape

GRCDEVàGRCPRD

6. Which ABAP report used for user master reconciliation?

PFCG_TIME_DEPENDENCY 

7. What is the tcode to create authorization groups?

SE54

8. List out some of the critical security transaction codes

SU01, PFCG, ST01, SU24, SU25, SU10

9. List out some security critical authorization objects

S_USER_PRO

S_USER_AGR

S_USER_AUT

S_USER_GRP

S_TABU_DIS

S_TABU_CLI

10. Why does user comparison required?

Security administrators need to perform user comparison when authorization changes required immediate effect 

11. How many profiles/roles can be assigned to a user?

312

12. Maximum how many authorization objects can be assigned to a role?

Max 150 authorization can be assigned to a role

13. What is the use of profile generator/PFCG?

Profile generator used to create/modify/copy/transport/user assignment to a role

14. What is the difference between PFCG, PFCG_TIME_DEPENDENCY and PFUD transaction code?

PFCG is used to create/maintain roles

PFCG_TIME_DEPENDENCY is used to perform mass user comparison

PFUD transaction code does same function like PFCG_TIME_DEPENDENCY report mass user comparison which can be scheduled as background job

15. Transaction codes which is used for security audit?

SM19 and SM20

16. What is the usage of personalization tab in a role?

Personalization tab used to save common information to all users.

17. In which table all activities are stored?

TACT

18. In which table all valid activities for each authorization objects are available?

TACTZ

19. Which ABAP report used to delete mass roles?

AGR_DELETE_ALL_ACTIVITY_GROUPS

20. Table used to roles in composite role?

AGR_AGRS

Security Q & A Part - 2

Click here for GRC questions and answers Part-1 and Part-2