Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SAP > SAP Security > Flashcards

SAP Security Flashcards

Prepare for SAP Security interview.

1
Q

How do you determine who deleted another user’s session?

A

Use STAD to determine who used SM04

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the return codes for ST01?

A
  • 0 – Authorization check passed
    • 1 – No Authorization
    • 2 – Too many parameters for authorization check
    • 3 – Object not contained in user buffer
    • 4 – No profile contained in user buffer
    • 6 – Authorization check incorrect
    • 7,8,9 – Invalid user buffer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is SU25 used for?

A

Research needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How do you assign multiple roles to more than 20 users in one-shot using tcode SU10?

A

To perform this mass role assignment, we need to follow below steps in SU10:

* In SU10 home screen, click on the button “Authorization Data”
* This will take to the new screen similar to screen in t-code SUIM -> User by complex search criteria. Enter the search criteria for users needed to be changed in SU10 and execute the same
* Once the list of users is reflected, click on “select all” button on left top corner of the list and click on “Transfer” button. This will take us back to SU10 screen with all the selected users in users
* Now, click on select all button in SU10 home screen and then click on change button.
* Above step will take us to the next screen where you can perform the role assignment as in normal case of SU10 t-code
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How do you generate a list of roles having authorization objects with status “maintained”?

A

The list can be generated by using table AGR_1251

  1. Execute tcode SE16
  2. Enter table name AGR_1251
  3. Enter the field value as “G” in field “Object Status” and click on execute.

Other status:
Modified = M
Manuel = U

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How do you check the transport request created by another user?

A

Use tcode SE10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How do you find the transport requests containing a specific role?

A
  1. Execute SE03
  2. Select “Search for Objects in requests/tasks” under node “Requests”
  3. In the object selection screen enter the field value as ACGR and check the checkbox.
  4. Enter the role name for which we need the list of transport request.
  5. Execute
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How do you create a user group?

A
  1. Execute tcode SUGR
  2. Enter the name of the user group
  3. Click Create
  4. Enter the description
  5. Save
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the difference between USOBX_C and USOBT_C?

A

The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority- check command programed). This table also determines which authorization checks are maintained in the Profile Generator.
The table USOBT_C defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is one use for SU25?

A

You can use tcode SU25 to transfer the USOBT values to the USOBT_C table/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the difference betwen SU22 and SU24?

A

SU22 displays and updates the values in tables USOBT and USOBX, while SU24 does the same in tables USOBT_C and USOBX_C. The _C stands for Customer. The profile generator gets its data from the _C tables. In the USOBT and USOBX tables the values are the SAP standard values as shown in SU24. With SU25 one can (initially) transfer the USOBT values to the USOBT_C table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do you check table logs?

A
  1. Make sure they are activated using tcode SE13.

2. Use tcode SCU3 to view the logs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How do you restrict access to one table in display mode?

A

We can use the authorization object S_TABU_NAM. In the authorization object we can maintain the values for required activity and the table name.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which tcodes are used to see an overview of an authorization object and profile?

A

SU03 - overview of an auth object

SU02 - overview of a profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many fields can be present in one authorization object?

A

10 fields

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is table RFCDES used for?

A

Research needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is table DEVACCESS used for?

A

Table of development users including developer keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is table TACT used for?

A

Table for available activities in SAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is table TOBJ used for?

A

Table for authorization obects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are parameter IDs used for?

A

Research needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is table TPARA used for?

A

List of parameter IDs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is table E070 used for?

A

Store information about transport requests and tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is table DDBTABLOG used for?

A

Log records for tables changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is table TSTCA used for?

A

Contains information related to tcodes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is table TSTC used for?

A

It is a list of tcodes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is table T000 used for?

A

It is a list of defined clients.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is table TRDIR used for?

A

Table for program to authorization group relation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is an authorization group?

A

Research needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is table TBRG used for?

A

Table authorization groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is table TDDAT used for?

A

Table authorization group to table relation

It is the relationship between authorization groups and tables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is table AGR_TIME used for?

A

Time stamp role (including profile)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is an authorization profile?

A

A collection of authorization objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is table USR10 used for?

A

Table for authorization profiles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is table USR04 used for?

A

User master authorization

… what does that mean?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is table USOBX_C used for?

A

Check table for table USOBT_C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is table USOBT_C used for?

A

Relation transaction to authorization (customer)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is a “check table”?

A

Needs research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is table USOBX used for?

A

Check table for table USOBT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is a relation transaction?

A

Needs research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is table USOBT used for?

A

Relation transaction to authorization object (SAP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

How does role menu maintenance work?

A

Needs research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is a menu node?

A

Needs research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is table AGR_OBJ used for?

A

Table for assignment of menu nodes to role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is table USH02 used for?

A

Table for change history of logon data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is the relationship between a profile and a role?

A

Needs research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is table AGR_PROF used for?

A

Table for the profile name of a role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is an activity group profile?

A

Needs research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is table AGR_1016 used for?

A

Table for the name of the activity group profile.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are user groups and how do you maintain them?

A

Needs research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is table USRGRP used for?

A

Table for user groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is table USR40 used for?

A

Table for illegal passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is table AGR_DEFINE used for?

A

Role defintion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is table AGR_AGRS used for?

A

What is table AGR_AGRS used for?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is a derived role?

A

research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is a composite role?

A

research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is table AGR_1252 used for?

A

Organizational elements for authorizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is an organizational element for an authorization?

A

research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is an “activity” group?

A

research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is table AGR_1250 used for?

A

Authorization data for activity group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is table USER_ADDR used for?

A

Maintains address data for users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is table AGR_USERS used for?

A

The assignment of roles to users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is table USR02 used for?

A

Logon data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

List the types of users

A 
Dialog
Service
System
Communication
Reference
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What is RZ20 used for?

A

need to research more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is SA38 used for?

A

Run report RSUSR006 for account lockouts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What is SE16 used for?

A

It is used for table browsing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is a client?

A

research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is SCC4 used for?

A

Use this tcode to verify client lock settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is STAD used for?

A

research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What is a logon group?

A

reserarch

71
Q

What is SMLG used for?

A

It is used to maintain logon groups.

72
Q

What is an authorization object?

A

research

73
Q

What is SM21 used for?

A

It is used to create an authorization object.

74
Q

What is an authorization field?

A

research

75
Q

What is SU20 used for?

A

It is used to create an authorization field.

76
Q

What is PFUD used for?

A

It is used for user master record comparison.

77
Q

What is used to search and display IDOCS.

A

research

78
Q

What is used for mass profile generation?

A

research

79
Q

What is TU02 used for?

A

It lists active parameters for application servers.

It is important to review the security parameters for changes.

80
Q

What is SM59 used for?

A

It is a BASIS tool for maintaining RFC destinations.

81
Q

What is asynchronous RFC?

A

research

82
Q

What is SM58 used for?

A

It provides access to asynchronous RFC error logs.

83
Q

What is SM18 used for?

A

It is used to purge old audit files.

84
Q

What is SM04 used for?

A

Used to manage users logged into a system.

85
Q

What is a parameter transaction?

A

research

86
Q

What is SE93 used for?

A

It is a developer’s tcode but it useful for troubleshooting parameter transactions.

87
Q

What is SCUL used for?

A

It is used to check the records submitted to CUA. It is a CUA log.

88
Q

What is RZ11 used for?

A

It provides documentation for system parameters.

89
Q

What is RZ10 used for?

A

It is used to manage system security parameters.

… needs more explanation

90
Q

What is BDM2 used for?

A

It is used for IDOC troubleshooting.

91
Q

What is AL08 used for?

A

It is used to monitor the users logged into a system.

92
Q

What is SU3 used for?

A

It is used for the maintenance of address and parameters.

93
Q

What is SU03 used for?

A

Used to manually maintain authorizations.

94
Q

What is SU02 used for?

A

This tcode was used to manually create profiles but has been replaced by PFCG.

95
Q

What is SUIM used for?

A

The tcode is used to crate custom reports, research and troubleshoot.

It is also important for reviewing who has SAP_ALL assigned to them and how they are using it.

96
Q

What is SUGR used for?

A

The tcode is used to create user groups.

… needs more explanation.

97
Q

What is SU53 used for?

A

The tcode is used for immediate-point-in-time error troubleshooting.

98
Q

What is ST01 used for?

A

This tcode is used for user traces

… needs more explanation.

99
Q

What is a Remote Function Call (RFC)?

A

research

100
Q

What is a function module?

A

research

101
Q

What is SM20 used for?

A

Use this tcode to monitor the audit log …

* Dialog logon attempts
* RFC logon attempts
* RFC calls to function modules
* User master record changes
* Transaction starts
* Changes to audit configuration
102
Q

What is SM19 used for?

A

You define the events to write to the log in the Security Audit Log’s filters (transaction SM19) and you can analyze the log’s contents in the audit analysis report (transaction SM20).

103
Q

What us SU24 used for?

A

It is used to control what authorizations objects are associated with transaction.

104
Q

What is PFCG used for?

A

Used to create and maintain user roles and profiles.

105
Q

What is SU01d used for?

A

This tcode is used to display a user.

106
Q

What is SU01 used for?

A

It is used to create, maintain and delete users. You can also unlock users.

107
Q

Explain the composition of a role.

A

1) Role: A role is a container for authorization objects.
2) Authorization Profile: A collection of authorizations.
3) Authorization: An instance of an authorization object.
4) Authorization Field: Defined as the smallest authorization unit against which a check is made.
5) Authorization Class: A logical grouping of similar authorization objects.
6) Authorization Object: A collection of 1-10 authorization objects.

108
Q

What tcodes should be used for monthly tasks and why?

A

TU02 – Parameter Changes

* Review security parameters for changes.

SUIM – User Information

* For users with SAP_ALL assigned, open the “Where Used” section, and then go to “Profiles” > “In Users”. Enter the SAP_ALL profile name in the screen field and exec
109
Q

Security for SAP Web AS ABAP should be addressed on which layers?

A

Presentation - SAP graphical user interface, web browsers
Application - The ABAP application logic
Transport - SNC and SSL are used for secure network transportation

110
Q

How do you assign an authorization group to a program?

A

In the attributes section of tcode SE38.

111
Q

What three sections should be included when creating custom authorization object documentation?

A

Definition - The purpose of the object
Defined Fields - List of values to be used
Procedure - How to use the object

112
Q

Which tcode used to create an authorization object?

A

Tcode SU21 can be used to create the authorization object as well as the documentation.

It’s important to group the custom authorization objects into classes.

113
Q

How do you assign an authorization group to a table?

A
  1. Execute tcode SM30
  2. In the table/view field , enter the maintenance view name V_DDAT_54 and press the maintain button.
  3. Click the new entries button and enter the table name and authorization group name (the auth group can only be 4 characters long)
114
Q

How do you see the tables in an authorization group?

A

You can see which tables are in a given group by querying table TDDAT with tcode SE16.

115
Q

What tcodes should be used for weekly tasks?

A

SE16 – Table Browser

* Review AGR_DEFINE for new roles, who created it and when.
* Review AGR_TCODES for critical/restricted tcode assigments in the roles
* Review AGR_1251 for critical/restricted authorization assignments in the roles
* Review USR02 for new users and who created them.
* Review USR02 for users not assigned to a user group if you use user groups.
* Review USR02 for users that have not logged on for a specific period of time.
* Review AGR_USERS for invalid role assignments to user IDs.

SCC4 – Client Administration

* Verify client lock settings.

SCU3 – Table History

* Check for table T000 to review client lock changes and who is making the changes.

PFCG – Role Maintenance

* Go to Utilities > Overview Stats. Review the resulting list for red or yellow lights and make corrections.
116
Q

Explain the tcodes used for AIS?

A

research

117
Q

What is S_DATASET and S_RFC used for?

A

research

118
Q

What is a logon group?

A

research

119
Q

Which tcodes should be used for daily tasks and why?

A

SM04/AL08 – User Overview

* Are all users using the defined logon groups?
* Are users logging on using multiple machines?
* Are there any unrecognizable user IDs (incorrect name convention)?

SM21 – The System Log

* Review failed logon attempts
* “Failed to activate authorization check for user xxx”

SM19 – AIS Configuration

* Make sure that AIS is running

RZ20 – CCMS Monitoring

* Review and acknowledge all alerts

SUIM – User Information

* Run change document reports
* Check for repeated password locks or resets

ST22 – ABAP Dump Analysis

* Review all dump logs for potential security issues.
* Look for authorization check errors for S_DATASET and S_RFC

SA38 – Run Report RSUSR006

* Check for user accounts that are locked.
120
Q

How do you unlock a user?

A

Use tcode SU01

121
Q

What is the user buffer?

A

A user buffer contains all authorizations of a user. The user buffer can be viewed using tcode SU56.

122
Q

What is PFCG_TIME_DEPENDENCY?

A

PFCG_TIME_DEPENDENCY is a report which is used for user master record comparison. It should be a practice to do user master comparison after every role change and profile generation so that the user’s master record gets updated with the correct authorization. This report also cleans up expired profiles from user-master record. Role names still remains in the SU01 tab of the user. Tcode PFUD can also be used to directly execute this program.

123
Q

Where can I find all activities performed in SAP?

A

All activities in SAP are stored in table TACT. All valid activities are stored in table TACTZ. The tables can be accessed via SE16.

124
Q

What do the different color lights represent in PFCG?

A

Red - It means that some organizational value has not been maintained in PFCG.

Yellow - It means that there are some or all fields in certain authorization instances which are blank (not maintained)

Green - It means that all authorization fields are maintained (values are assigned)

125
Q

How do you create a user?

A
  1. Execute SU01
  2. Provide a username
  3. In the “address tab” enter the user info (the last name is required)
  4. In the “logon data” tab select the “user type” and enter the initial password.
  5. Fill in the information for tabs “default”, “parameters”, “systems” and “roles”.
  6. Save
126
Q

Explain the authorization process.

A
  1. The system checks the table TSTC (a list of all tcodes) to confirm that the tcode exists.
  2. If the tcode exists, the system checks whether the tcode is locked or unlocked by referencing field CINFO in the TSTC table.
  3. The system them checks to see if the tcode is present in authorization object S_TCODE.
  4. Next, the system checks table TSTCA for additional checks added through tcode SE93.
  5. Lastly, additional checks take place based on the values present in the source code under “authority-check.”
127
Q

An object class contains what?

A

One of more authorization objects.

128
Q

Explain the process for creating a specific authorization field, create the authorization class and authorization object for which the field will be added, create a new role and profile that will contain the actual authorization for data, assign the role to the user master data, execute the tcode that will call the authorization object in code.

A
  1. Use tcode SU20 to create authorization fields.
  2. Use tcode SU21 to create an authorization class (object class).
  3. Use tcode SU21, select the object class and then create an authorization object Under the “Authorization Fields” section enter the Authorization Fields you created and then define the activity values.
  4. Use tcode PFCG to create a Role.
  5. Use tcode PFCG to assign a Profile and Authorization to a role. Go to Maintain Authorization Data and Generate Profiles”. Select the Authorizatiobn Object you created.
  6. Select the line of the tcode and enter SE01 and Save.
  7. Use the generate button to generate the authorizaiton. We now have a profile assigned to our role.
129
Q

How do you transport roles to a different system?

A

You wont transport the roles to different systems … you will transport the roles to different clients.

130
Q

What is an activity group profile?

A

Research

131
Q

What is the secret?

A

Ask, Believe, Receive

132
Q

What is a composite role?

A

Unlike a single role, does not contain aothorization data. It is merely a reference point to group related single roles. Users who are assigned to a composite role are automatically assigned to the corresponding single roles during a user comparison.

133
Q

What is a derived role?

A

Refers to roles that already exists; it inherits the menu structure and transactions from the referenced role. Default values may be passed on; however the organization values and user assignments are not passed on.

134
Q

What is an organization unit?

A

research

135
Q

What is table USR01 used for?

A

User master

136
Q

What is table USR02 used for?

A

Logon data

137
Q

What is table USR03 used for?

A

User address data

138
Q

What is table USR04 used for?

A

User master authorizations

139
Q

What is table USR05 used for?

A

User Master Parameter ID

140
Q

What is table USR10 used for?

A

User master authorization profiles

141
Q

What is table UST12 used for?

A

User master: Authorizations

142
Q

What is table USR21 used for?

A

Assign user address key

143
Q

What is table USOBT used for?

A

Transaction > Authorization object

144
Q

What is table TSTCA used for?

A

Transaction > Authorizations

145
Q

What is table TOBJ used for?

A

Authorization objects

146
Q

What is table TOBC used for?

A

Class assignment of authorization objects

147
Q

What is table DEVACCESS used for?

A

Table for development users

148
Q

What is table USR41 used for?

A

User logon data (sm04)

149
Q

What is table UST04 used for>

A

User > Profile

150
Q

What is table USR40 used for?

A

Prohibited passwords

151
Q

What is table ADCP used for?

A

Person / Address assignment

152
Q

What is table AGR_1016 used for?

A

Role and Profile

153
Q

What is table AGR_1016B used for?

A

Role and Profile

154
Q

What is table AGR_1250 used for?

A

Role and authorization data

155
Q

What is table AGR_1252 used for?

A

Organizational elements for authorizations

156
Q

What is AGR_AGRS used for?

A

Roles in composite roles

157
Q

What is table AGR_DEFINE used for?

A

To see all roles (role definition)

158
Q

What is table AGR_HIER2 used for?

A

Menu structure

159
Q

What is table AGR_HIERT used for?

A

Role menu texts

160
Q

What is table AGR_OBJ used for?

A

Assignment of menu nodes to role

161
Q

What is table AGR_PROF used for?

A

Profile name for role

162
Q

What is table AGR_TCDTXT used for?

A

Assignment of roles to tcodes

163
Q

What is table AGR_TEXTS used for?

A

File structure for hierarchical menu - Cus

164
Q

What is table AGR_TIME used for?

A

Time stamp for role: including profile

165
Q

What is table AGR_USERS used for?

A

Assignment of roles to users

166
Q

What is table DD02L used for?>

A

SAP tables

167
Q

What is table TSTC used for?

A

SAP transaction codes

168
Q

What is table TSTCA used for?

A

Transaction code, object, field and value

169
Q

What is table USER_ADDR used for?

A

Address data for users

170
Q

What is table USGRP used for?

A

User groups

171
Q

What is table USGRPT used for?

A

Text table for USGRP

172
Q

What is table USH02 used for?

A

Change history for logon data

173
Q

What is USOBT used for?

A

Relation transaction to authorization object

174
Q

What is table USOBX used for?

A

Check table for table USOBT

SAP (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions