35+ Tricky SAP Security Interview Questions with SMART ANSWERS

Last updated on 04th Jul 2020, Blog, Interview Questions

SAP security is a module that keeps certain kinds of data under lock and key while allowing access to others, working to ensure your SAP system is secure from both external and internal threats. This is a comprehensive introduction to SAP security: what it is, how it works, and how to best use it in your organization.

1)  Please explain the personalization tab within a role?

Ans:

• Personalization is a way to save information that could be common to users, I meant to a user role…  E.g. you can create SAP queries and manage authorizations by user groups. Now this information can be stored in the personalization tab of the role. 
• (I supposed that it is a way for SAP to address his ambiguity of its concept of user group and roles: is “usergroup” a grouping of people sharing the same access or is it the role who is the grouping of people sharing the same access).

2)How to create users?

Ans:

Execute transaction SU01 and fill in all the field. When creating a new user, you must enter an initial password for that user on the Logon data tab. All other data is optional.

3)Frequently used security T-codes

Ans:

• SU01 Create/ Change User SU01 Create/ Change User
• PFCG Maintain Roles
• SU10 Mass Changes
• SU01D Display User
• SUIM Reports
• ST01 Trace
• SU53 Authorization analysis

4)What is the difference between USOBX_C and USOBT_C?

Ans:

• The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ). This table also determines which authorization checks are maintained in the Profile Generator.
• The table USOBT_C defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.

5)Authorization are required to create and maintain user master records?

Ans:

The following authorization objects are required to create and maintain user master records:

• S_USER_GRP: User Master Maintenance: Assign user groups
• S_USER_PRO: User Master Maintenance: Assign authorization profile
• S_USER_AUT: User Master Maintenance: Create and maintain authorizations

6)List R/3 User Types

Ans:

• Dialog users are used for individual user. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon
• A Service user – Only user administrators can change the password. No check for expired/initial passwords. Multiple logon permitted
• System users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on.
• A Reference user is, like a System user, a general, non-personally related, user.
• Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.

7)What is a derived role?

Ans:

• Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.
• The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either.
• Derived roles are an elegant way of maintaining roles that do not differ in their
• functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level. 

8)What is a composite role?

Ans:

• A composite role is a container which can collect several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.
•  Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role.
• Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group.
• The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison.

9)What does user compare do?

Ans:

If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on a daily.

10)Can we convert Authorization field to Org, field

Ans:

Authorization field can be changed to Organization field using

PFCG_ORGFIELD_CREATE or ZPFCG_ORGFIELD_CREATE

Use SE38 or SA38 to run the above report. 

• Organizational level fields should only be created before you start setting up your system. If you create organizational level fields later, you might have to do an impact analysis. The authentication data may have to be postprocessed in roles.
• The fields “Activity”, “ACTVT” and “Transaction code”, “TCD” cannot be converted into an organizational level field.
• In addition, all affected roles are analyzed and the authorization data is adjusted. The values of the authorization field which is now to become the organizational level field are removed and entered into the organizational level data of the role.

11)How many profiles can be assigned to any user master record.

Ans:

• Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile assignments for users). This table contains both information on the change status of a user and also the list of the profile names that were assigned to the user.
• The field PROFS is used for saving the change flag (C = user was created, M = user was changed), and the name of the profiles assigned to the user.
• The field is defined with a length of 3750 characters. Since the first two characters are intended for the change flag, 3748 characters remain for the list of the profile names per user. Because of the maximum length of 12 characters per profile name, this results in a maximum number of 312 profiles per user.

12)Can you add a composite role to another composite role?

Ans:

• No Q. How to reset SAP* password from oracle database.
• Logon to your database with orasid as user id and run this sql delete from sapSID.usr02 where bname=’SAP*’ and mandt=’XXX’; commit;
• Where mandt is the client.
• Now you can login to the client using sap* and password pass
• SAP Security Interview Questions     SAP Security Interview Questions and Answers

13)What is difference between role and profile.

Ans:

A role act as container that collect transaction and generates the associated profile. The profile generator (PFCG) in SAP System automatically generates the corresponding authorization profile. Developer used to perform this step manually before PFCG was introduced bySAP. Any maintenance of the generated profile should be done using PFCG.

14)What is user buffer?

Ans:

• When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for that user. Each user has their own individual user buffer.
• For example, if user Smith logs on to the system, his user buffer contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56. A user would fail an authorization check if:

15)The authorization object does not exist in the user buffer

Ans:

The values checked by the application are not assigned to the authorization object in the user buffer

16)Is there a table for authorizations where I can quickly see the values entered in a group of fields? 

Ans:

In particular, I am looking to find the field values for P_ORGIN across a number of authorization profiles, without having to drill down on each profile and authorization.

17) How can I do a mass delete of the roles without deleting the new roles?

Ans:

• There is an SAP delivered a report that you can copy, remove the system type check and run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete program or manually delete and then release the transport and import them into all clients and systems.
• It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS. To use it, you need to tweak/debug & replace the code as it has a check that ensures it is deleting SAP delivered roles only. Once you get past that little bit, it works well.

18)Someone has deleted users in our system, and I am eager to find out who. Is there a table where this is logged?

Ans:

Debug or use RSUSR100 to find the info’s.

Run transaction SUIM and down its Change documents.

19) How to insert missing authorization?

Ans:

SU53 is the best transaction with which we can find the missing authorizations. and we can insert those missing authorization through pfcg.

20)What is the difference between role and a profile?

Ans:

Role and profile go hand in hand. A profile is bought in by a role. The role is used as a template, where you can add T-codes, reports..The profile is one which gives the user authorization.  When you create a role, a profile is automatically created.

21) What authorization is required to create and maintain user master records?

Ans:

The following authorization objects are required to create and maintain user master records: S_USER_GRP: User Master Maintenance: Assign user groups

S_USER_PRO: User Master Maintenance: Assign authorization profile

S_USER_AUT: User Master Maintenance: Create and maintain authorizations

Q.List R/3 User Types

• A Dialog users are used for individual user. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon
• A Service user – Only user administrators can change the password. No check for expired/initial passwords. Multiple logon permitted
• System users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on.
• A Reference user is, like a System user, a general, non-personally related, user. Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.

22) What does the user compare do?

Ans:

If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on.

23)What is the difference between C (Check) and U (Unmentioned)?

Ans:

Background: When defining authorizations using Profile Generator, the table USOBX_C defines which authorization checks should occur within a transaction and which authorization checks should be maintained in the PG. You determine the authorization checks that can be maintained in the PG using Check Indicators. It is a Check Table for Table USOBT_C.

In USOBX_C there are 4 Check Indicators.

CM (Check/Maintain)

• An authority check is carried out against this object.
• The PG creates an authorization for this object and field values are displayed for changing.
• Default values for this authorization can be maintained.

C (Check)

• An authority check is carried out against this object.
• The PG does not create an authorization for this object, so field values are not displayed.
• No default values can be maintained for this authorization.

N (No check)

• The authority check against this object is disabled.
• The PG does not create an authorization for this object, so field values are not displayed.
• No default values can be maintained for this authorization.

U (Unmaintained)

• No check indicator is set.
• An authority check is always carried out against this object.
• The PG does not create an authorization for this object, so field values are not displayed.
• No default values can be maintained for this authorization.

24) How to find out all roles with T-code SU01?

Ans:

You can use SUIM > Roles by complex criteria or RSUSR070 to find out this.

Go to the Selection by Authorization Value.

In Object 1 put S_TCODE and hit enter.

And put SU01 in Transaction code and hit execute (clock with check) button.

I use authorization object, as you can use this to test any object.

You can also get this information directly from table, if you have access to SE16 or

• SE16N. Execute SE16N
• Table AGR_1251
• Object S_TCODE
• VALUE (low) SU01

25)How to find out all the users who got SU01 ?

Ans:

You can use SUIM >User by complex criteria or (RSUSR002) to find this out.

Go to the Selection by Authorization Value.

In Object 1 put S_TCODE and hit enter.

And put SU01 in Transaction code and hit execute (clock with check) button.

I use authorization object, as you can use this to test any object.

26)How to find out all the roles for one composite role or a selection of composite roles?

Ans:

• Execute SE16N
• Table AGR_AGRS
• Composite roles You can put multiple composite roles using the more button

27)How to find out all the derived roles for one or more Master (Parent) roles?

Ans:

• Execute SE16N
• Table AGR_DEFINE
• Use either agr_name field or Parent_agr field.

28)How can I check all the Organization value for any role?

Ans:

• Execute SE16N
• Table AGR_1252
• Role Type in the role here and hit execute.
• You can always download all the information to spreadsheet also using .

29)How do I restrict access to files through AL11?

Ans:

• First create an alias. Go to t-code AL11 > configure > create alias. Let say we are trying to restrict alias DIR_TEMP which is /tmp. Open PFCG and assign t-code AL11, and change the authorization for S_DATASET as mentioned below Activity 33
• Physical file name /tmp/*
• Program Name with Search Help *

30)How can I add one role to many users?

Ans:

•   SU10. If you have less than 16 users then you can paste the userids.
• If you have more than 16 users – Click on Authorization data and click on next to users and upload from clipboard .
• Hit the change button and go to the role tab and add the roles to be assigned and hit save.

31)What are the Best practices for locking expired users?

Ans:

Lock the user. Remove all the roles and profiles assigned to the user. Move them to TERM User group.

32)How can be the password rules enforced ?

Ans:

Password rules can be enforced using profile parameter. Follow the link to learn more about the profile parameter.

33)How to remove duplicate roles with different start and end date from user master?

Ans:

You can use PRGN_COMPRESS_TIMES to do this. Please refer to note 365841 for more info.

34)How come the users have authorization in PFCG, but user still complains with no authorization?

Ans:

Make sure the user master is compared. May be the there is a user buffer overflow

Also check the profile- Follow the instruction below.

SUIM > User by complex criteria.

Put the userid of user who is having issue.

Execute

35)How can I have a display all roles.?

Ans:

Copy sap_all and open the role and change the activity to 03 and 08

36)How can I find out all actvt in sap?

Ans:

All possible activities (ACTVT) are stored in table TACT (transaction SM30), and also the valid activities for each authorization object can be found in table TACTZ (transaction SE16).

37)How many fields can be present in one Authorization object?

10 fields.

38)How to check the table Logs ?

Ans:

First, we need to check if the logging is activated for table using tcode SE13. If table logging is enabled then we can see the table logs in t-code SCU3.

39)What’s the basic difference in between SU22 & SU24 ?

Ans:

SU22 displays and updates the values in tables USOBT and USOBX, while SU24 does the same in tables USOBT_C and USOBX_C. The _C stands for Customer. The profile generator gets its data from the _C tables. In the USOBT and USOBX tables the values are the SAP standard values as shown in SU24. With SU25 one can (initially) transfer the USOBT values to the USOBT_C table.

40) Which Authorization Objects are Checked in Role Maintenance ?

Ans:

The role maintenance functions (and the profile generator) check the following authorization objects.

Authorization Object	Description
S_USER_AUT	User master maintenance: AuthorizationsThis authorization object defines which authorizations the administrator can process. You can use the activities to specify the types of processing (such as creating, deleting, displaying change documents).
S_USER_GRP	User master maintenance: User groupsThe authorization object is used in role maintenance when assigning users to roles and during the user master comparison.You can divide user administration between several administrators with this authorization object, by assigning only a certain user group to an administrator. You can use the activities to specify the administrator’s processing types for the group (such as creating, deleting, and archiving).
S_USER_PRO	User master maintenance: Authorization profilesProfiles are protected with this authorization object. You can use the activities to specify the administrator\’s processing types for the profile (such as creating, deleting, and archiving).
S_USER_AGR	Authorization system: Check for rolesThis authorization object protects roles. The roles combine users into groups to assign various properties to them; in particular, transactions and authorization profiles.You can use this authorization object together with the authorization objects S_USER_GRP, S_USER_AUT, S_USER_PRO, S_USER_TCD, and S_USER_VAL to set up a distributed user administration.
S_USER_TCD	Authorization system: Transactions in rolesThis authorization object determines the transactions that an administrator can assign to a role, and the transactions for which he or she can assign transaction authorization (object S_TCODE).Note that a user can only maintain ranges of transactions for the S_TCODE authorization object in the Profile Generator if he or she has full authorization for the S_USER_TCD authorization object. Otherwise, he or she can only maintain individual values for the S_TCODE object.
S_USER_VAL	Authorization system: Field values in rolesThis authorization object allows the restriction of values that a system administrator can insert or change in a role in the Profile Generator.This authorization object relates to all field values with the exception of the values for the object S_TCODE.The authorization to include transactions in a role or to change the transaction start authorization in a role is linked to the authorization object S_USER_TCD.
S_USER_SYS	Authorization object for system assignment in the Central User Administration (CUA).You can distribute users from a central system to various child systems of a system group. The object S_USER_SYS is used to check the systems to which the user administrator can assign the users. This authorization object is also checked when setting up the CUA.
S_USER_SAS	User master maintenance: System-specific assignmentsThe authorization object S_USER_SAS is checked in transactions SU01, SU10, PFCG, and PFUD when you assign roles, profiles, and systems to users. It represents a development of the authorization objects S_USER_GRP, S_USER_AGR, S_USER_PRO, and S_USER_SYS, which the system previously checked when users made assignments. If you do not activate the authorization object S_USER_SAS using the Customizing switch, the previously-used authorization objects are checked.To activate authorization object S_USER_SAS, use transaction SM30 to create the Customizing switch CHECK_S_USER_SAS with the value YES in the table PRGN_CUST. All authorization checks for the objects S_USER_AGR, S_USER_PRO, S_USER_GRP, and S_USER_SYS with the activity assign are replaced by authorization checks for the object S_USER_SAS.
S_USER_ADM	Administration functions for user and authorization administration.The authorization object S_USER_ADM protects general Customizing and administration tasks for user and authorization administration. It consists solely of the authorization field S_ADM_AREA.Until now, there was only the fixed value CHKSTDPWD, with which special users (such as SAP*) could be displayed, including their default passwords. SAP extends additional fixed values as required for other general administration functions in the area of user and authorization administration, which are listed in SAP Note 704307.

41) Which T-Codes are used to see overview of the Authorization Object and Profile details?

Ans:

SU03 – overview of any authorization Object

SU02 – to see the details of profiles.

SU21 also provides the same editing structure as SU03 but we can create a new authorization object using SU21. Here, we need to click on “Display Object Documentation“ button to see the documentation for the authoriztion Object and we need to click on “Permitted activity values“ to see the list of permitted activities for the fields.

These details are fetched from table TACT.

42)How to restrict the user access to one particular table in display mode ?

Ans:

If the system is BASIS 700, we can use the authorization object S_TABU_NAM. In this auth. Object, we can maintain the values for required activity and the table name.

If the system version is lower than 700, and the table is z* table then

• Create a new authorization Group using SE54.
• Assign the table in question to the newly created authorization Group in table TDDAT using SM30.

If the table is SAP standard table then we can restrict user access by creating new tcode in SE93.

43)What is a user buffer ?

Ans:

When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for that user. Each user has their own individual user buffer. For example, if user Smith logs on to the system, his user buffer contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56.

A user would fail an authorization check if:

•  The authorization object does not exist in the user buffer
• The values checked by the application are not assigned to the authorization object in the user buffer
• The user buffer contains too many entries and has overflowed. The number of entries in the user buffer can be controlled using the system profile parameter auth/number_in_userbuffer.

44) What is the user type for a background jobs user?

Ans:

• System User
• Communication User

45) How to troubleshoot problems for background user?

Ans:

using system Trace ST01

46)There are two options in the PFCG while modifying a role. One change authorizations and another expert mode-what is the difference between them?

Ans:

Change authorization: This option we will use when we create new role and modify old role

Expert mode: i. Delete and recreate authorizations and profile

(All authorizations are recreated. Values which had previously been maintained, changed or entered manually are lost. Only the maintained values for organizational levels remain.)

• Edit old status(The last saved authorization data for the role is displayed. This is not useful if transactions in the role menu have been changed.)
• Read old data and merge with new data(If any changes happen in SU24 Authorizations we have to use this)

47)If we give Organizational values as * in the master role and want to restrict the derived roles for a specific country, how do we do?

Ans:

We have to maintain org level for the country based on the plant and sales area etc in the derived Role.

48)What is the table name to see illegal passwords?

Ans:

USR40

49)What is the table name to see the authorization objects for a user?

Ans:

USR12

50)What are two main tables to maintain authorization objects?

Ans:

USOBT, USOBX

51) How to secure tables in SAP?

Ans:

Using Authorization group (S_TABU_DIS, S_TABU_CLI) in T.Code SE54

52)What are the critical authorization objects in Security?

Ans:

S_user_obj,s_user_grp, s_user_agr , s_tabu_dis, s_tabu_cli , s_develop ,s_program

53)Difference between USOBT and USOBX tables?

Ans:

• USOBT-Transaction VS Authorization objects
• USOBX- Transaction VS Authorization objects check indicators

54)Use of Firefighter application

Ans:

Whenever the request coming from the user for new authorization .the request goes to firefighter owner. FF owner proved the FF ID to the normal user then the user (security admin) will assign the authority to those users (end user)

55)Where do we add the FF ids to the SAP user ids?

Ans:

Go to Tcode /n/virsa/vfat >>goto fireFighter tab the give the ffID to firefighter with validity

56)Different types of users

Ans:

• Diolag user
• service user
• system user
• communication user
• refrences user

57)Different types of roles?

Ans:

• Single role
• Composite role
• Derived role

58) Can a single role be used as a master role?

Ans:

yes

59)How to create a derived role?

Ans:

Go to PFCG type the Role name starting with Z .click on create role icon. Then right side you will find derived from here types the parent Role name 

60) How to copy 100 roles from a client 800 to client 900?

Ans:

Add all 100 roles as one single composite Role and Transfer the Composite role automatically the 100 Role will transfer to the target client (Using SCC1)

61)User reports that they lost the access. We check in SUIM and no change docs found. How do you troubleshoot

Ans:

Maybe user buffer full or role expired

62)What is the correct procedure for Mass Generation of Roles?

Ans:

Using T.Code –SUPC

63)What is the T.Code SQVI? What is the main usage of this SQVI?

Ans:

SQVI -Quick View

64) How can we maintain Organizational values? How can we create Organizational?

Ans:

PFCG_ORGFIELD_CREATE in t-code SA38

65) I want to see the list of roles assigned to 10 different users. How do you do it?

Ans:

• Goto se16 > agr_users then mention the 10 users name
• Goto SUIM > role by complex selection > type user names

66)What do you mean by User Buffer? How does it work with the user’s Authorizations?

Ans:

User buffer means user context it contains user related information i.e.) authorizations, parameters, reports, earlier acceded screens .We can see the user context using T.Code –SU56

67)What is the advantage of CUA from a layman/manager point of view?

Ans:

CUA used for maintaining and manage the users centrally.

68) What is the purpose of these Org. values?

Ans:

Values: it’s used to restrict the user by values e.g. Sale order value (1-100) it means the user can  create only 100 sales orders not more than that

69) What is the main purpose of Parameters Groups & Personalization tabs in SU01 and Miniapps in PFCG?  

Ans:

Parameter tab: it’s used to auto fills some of the values during the creation of orders

• Personalization tab is used to restrict the user in selection criteria E.g.: while selecting pay slip it will show only last month pay slip by default. If u select the attendances it will show current month by default
• Miniapps- we can add some mini-applications like calculator, calendar etc

70)How many maximum profiles we can assign to one user?

Ans:

312

71)How do you identify SAP standard roles?

Ans:

SAP standard roles will start with “SAP*”

72)How do you assign SAP standard role to user or what is the procedure to assign SAP standard role?

Ans:

It’s good to avoid direct assignment of SAP standard roles and copy SAP standard role to a new role and assign it to the users.

73) There is no authorization profile assigned to a role whether its considered as composite role?

Ans:

No its not considered as composite role and it’s a incomplete single role

74)What are the role types available?

Ans:

• Single role
• Composite role
• Derived role
• Master role
• Copy role

75) What is the relationship between parent role and derived role?

Ans:

Parent role is the place where we maintain list of tcodes and derived role will inherit all the authorizations from parent role except Org values.

76)What are the values for user lock?

Ans:

• 00 – not locked
• 32 – Locked Globally by administrator
• 64 – Locked by administrator
• 128 – Locked due to incorrect logon attempt

77)How do you deactivate a authorization object globally?

Ans:

Goto tcode SU25 and select step 5. Deactivate authorization object globally

78) If all users are locked mistakenly and how do you login to sap system

Ans:

Check link how to unlock SAP* at OS level

79) Which authorization object used to check transaction codes?

Ans:

S_tcode

80) Which authorization object is used to check HR transaction codes?

Ans:

P_tcode

81)Why do we need to create a TR for a role?

Ans:

Roles are developed in development system and tested in quality system and moved to production system, so that’s why we need to create a transport request for a role when its created/changed

82)List out important security tcodes

Ans:

• PFCG                 Role Maintenance
• SM19                 Security Audit Configuration
• SM20                 Security Audit Log Assessment
• ST01                 System Trace
• SU01                 User Maintenance
• SU02                 Maintain Authorization Profiles
• SU03                 Maintain Authorizations
• SU10                 User Mass Maintenance
• SU21                 Maintain Authorization Objects
• SU24                 Auth. Obj. Check Under Transactions
• SU25                 Upgrade Tool for Profile Generator
• SU53                 Display Check Values
• SUIM                 User Information System

83)What are the mandatory fields while creating a username?

Ans:

Password and last name

84)How do you create usernames in SAP?

Ans:

Goto transaction SU01 and creating a new username, you must enter an initial password for that user on the Logon data tab and last name in address tab

85)What are the authorization objects are required to create and maintain user master records?

Ans:

• S_USER_GRP: User Master Maintenance: Assign user groups
• S_USER_PRO: User Master Maintenance: Assign authorization profile
• S_USER_AUT: User Master Maintenance: Create and maintain authorizations