You are on page 1of 10

SAP Security & Authorizations. SU25:1) How will you Initialize the SAP Security in your organization ?

2) What are the steps we have in SU25? 3) What is the purpose of SU25 in SAP Security? 4) What is the relationship between USOBT ,USOBX tables And USOBT_C , USOBX_C Tables in SAP Security? 5) Why Should we perform Initially fill the customer tables in SU25? SU01:1) What are the types of users in SAP System? 2) In which scenario we will use these users and with Example for types of users? 3) What is the use of User group field under Logondata Tab? 4) Difference between Log on data user group and User group in SU01? 5) What is the use of Parameters tab & Personalization tab? 6) What is the validity period for your end users? 7)Authorization checks for the USER? 8) How will you delete the user? 9) How to Reset the password for the Mass users at a time? 8) How to lock/unlock the Mass users at a time in sap security? **9) In which scenario you will go for Reference type user? 10)What is the purpose of Defaults tab? 11)Where we can add Reference type user id? 12)How many Max no.of profiles you can be Assigning for a particular user in SAP? 13)What is length of the User Buffer in SAP System? **14)What are the mandatory fields to create user in SAP System? 15) What is the difference between Communication & System type Users in SAP? 16)What is the use of Licensing data Tab in SU01? 17)How will you get URF in your organization? 18) How can you change Existing User id? SU10,LSMW & SECATT SCRIPTING :1)How will you create 1000 users at a time in SAP system? 2)Explain LSMW Process? 3)What is the difference between su10 and su01 ? 4)what is URF? 5)When will you get creation of Mass users at a time in SAP system? 6)In which scenario you will get Mass password reset for users in SAP? 7)Have you created Mass Users using SECATT? If yes, tell me the process? 8) While creating Mass users in SECATT what are the changes you need to do in SAP System? 9)What are the Advantages of creating Mass Users using Scripts other than SU10? 10)What are the Advantages & Disadvantages of SU10? 11)How you Share System generated password for particular user? User Related Tables (SE16):USR* tables 1)What is USR02? 2)Where you can find the user lock status at table level and under which field ? 3)In which table we can find user license data at table level? 4)In which table we can incorrect logon attempts for the user? 5)In which table you can find user buffer size? 6)Where can we find Alias name for the user at table level?

7)Where can we find user login sessions? 8)What is MODDA,MODBE,MODT fields and under which table we can find these fields? 9)Where can we find last missing Authorizations for the user at Table level? 10)Where you can find Email address of the user?

PFCG :1)Have you worked on profile generetor? 2)Have you worked on roles creation?how roles you created? 3)How will you create roles in your organazition?naming convention in your organization? 4)Why derived roles? 5)Can we add composite roles to composite role?if no then why? 6)How many profiles we can add to a single user? 7)What is difference between profile and role? 8)Can we assign profiles directly to the users?If yes,How many profiles we assign to a single user? 9)What is auth.object? 10)Why should we generate a profile? 11)Which type of roles your organization is following? 12)What is the relation ship between PFCG and SU24? 13)How will you make changes in derived roles? 14)Have you worked on Expert mode? 15)what are the types of statuses you know in profile generetaor? 16)what are the traffic signal you know in PFCG?what does it means? 17)Have you worked on SU22 Tcode? 18) What is the relation ship between SU22and PFCG? 19)Have you created Custom Authorization objects? 20)What are the system login parameters you will use as a administrator? 21)How will you find out the User Access related issues? 22)How to convert fields to organization values? 23)How to delete a role? 24)how to transport a role from Development to Production system? 25)How will you delete roles from the Production systems? 26)Why do single roles sometimes has more profile? 27) How will you delete all expired role assignments to multiple user ? 28)How to assign a single role to multiple users? 29)How will you delete multiple roles from SAP System at a time? 30)How to access for the Tables? 31) how will you restrict the reports? 32)How to Extract users list like who didn't login since 3 months? 33)What are the Authorization checks for a Dialogue user? 34)How to check weather user has locked or unlocked in SAP System? 35)Can we assign generated profiles directly to the users?If i assign what will happen? 36)Internally what will happen when user will execute a TcodeSAP System? 37)What the differnce between Short and Long description in PFCG screen? 38)What is the use of Read menues TAB in PFCG? SAP SECURITY QUESTIONS ON BI/BW 1. 2. 3. 4. 5. 6. Difference between the R/3 Security and BW Security? What are the types of users in BW System? What is info object? Define Info areas, info providers and info objects? What are the authorization objects used for reporting users in BW? What is the difference between s_rs_comp and s_rs_comp1?

7. 8. 9. 10.

What are the minimum authorizations to execute a report? How can we create authorization objects in BW? How can we trace the users in BW system? What is Workbook?

1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18.

Difference between Workbook and Queries? How we can secure the Workbooks? What are the authorization objects needed to execute a workbook? What are the authorizations required to save workbook in roles? How we can maintain Hierarchy authorizations? What is the difference between BW and BI? What is Analysis authorization object? How it is useful? What are the default mandatory info objects in BW/BI? How we can trace the users in BI system? What are the different security levels we follow in BW? How we can restrict the info object using Value authorization and Hierarchy authorizations? What is the process of assigning Analysis authorization objects to Users and roles? What are the tables useful while troubleshooting the issues in BW & BI? What is the importance of attributes tab in RSD1? What is BEX? Why it is useful? What is Authorization Relevant? why should we maintain objects as Authorization Relevant? How will you create analysis authorization? In Which table we can find list of reports? What are 3 mandatory infoobjects in BW/BI?

SAP Security Interview Questions


Q. SAP Security T-codes A. Frequently used security T-codes SU01 Create/ Change User SU01 Create/ Change User PFCG Maintain Roles SU10 Mass Changes SU01D Display User SUIM Reports ST01 Trace SU53 Authorization analysis

Q How to create users? Execute transaction SU01 and fill in all the field. When creating a new user, you must enter an initial password for that user on the Logon data tab. All other data is optional. Click here for turotial on creating sap user id

Q What is the difference between USOBX_C and USOBT_C? The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ). This table also determines which authorization checks are maintained in the Profile Generator. The table USOBT_C defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.

Q What authorization are required to create and maintain user master records? The following authorization objects are required to create and maintain user master records: S_USER_GRP: User Master Maintenance: Assign user groups S_USER_PRO: User Master Maintenance: Assign authorization profile S_USER_AUT: User Master Maintenance: Create and maintain authorizations

Q List R/3 User Types 1. Dialog users are used for individual user. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon 2. A Service user - Only user administrators can change the password. No check for expired/initial passwords. Multiple logon permitted 3. System users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on. 4. A Reference user is, like a System user, a general, non-personally related, user. Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.

Q What is a derived role? Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before. The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either. Derived roles are an elegant way of maintaining roles that do not differ in their

functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level. Follow this link for more info

Q What is a composite role? A composite role is a container which can collect several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles. Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role. Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group. The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison. Follow the link to learn more

Q What does user compare do? If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on a daily.

Q. Can we convert Authorization field to Org, field A. Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE or ZPFCG_ORGFIELD_CREATE Use SE38 or SA38 to run the above report. Organizational level fields should only be created before you start setting up your system. If you create organizational level fields later, you might have to do an impact analysis. The authentication data may have to be postprocessed in roles. The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into an organizational level field. In addition, all affected roles are analyzed and the authorization data is adjusted. The values of the authorization field which is now to become the organizational level field are removed and entered into the organizational level data of the role. Note: Table for Org Element- USORG Refer to Note 323817 for more detail.

Q. How many profiles can be assigned to any user master record. A. Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile assignments for users). This table contains both information on the change status of a user and also the list of the profile names that were assigned to the user. The field PROFS is used for saving the change flag (C = user was created, M = user was changed), and the name of the profiles assigned to the user. The field is defined with a length of 3750 characters. Since the first two characters are intended for the change flag, 3748 characters remain for the list of the profile names per user. Because of the maximum length of 12 characters per profile name, this results in a maximum number of 312 profiles per user.

Q. Can you add a composite role to another composite role? A. No Q. How to reset SAP* password from oracle database. A. Logon to your database with orasid as user id and run this sql delete from sapSID.usr02 where bname='SAP*' and mandt='XXX'; commit;

Where mandt is the client. Now you can login to the client using sap* and password pass

Q. What is difference between role and profile. A. A role act as container that collect transaction and generates the associated profile. The profile generator (PFCG) in SAP System automatically generates the corresponding authorization profile. Developer used to perform this step manually before PFCG was introduced bySAP. Any maintenance of the generated profile should be done using PFCG.

Q. What is user buffer? A. When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for that user. Each user has their own individual user buffer. For example, if user Smith logs on to the system, his user buffer contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56. A user would fail an authorization check if: The authorization object does not exist in the user buffer The values checked by the application are not assigned to the authorization object in the user buffer

The user buffer contains too many entries and has overflowed. The number of entries in the user buffer can be controlled using the system profile parameter auth/number_in_userbuffer.

Q. How to find out all roles with T-code SU01? A. You can use SUIM > Roles by complex criteria or RSUSR070 to find out this. Go to the Selection by Authorization Value. In Object 1 put S_TCODE and hit enter. And put SU01 in Transaction code and hit execute (clock with check) button. I use authorization object, as you can use this to test any object.

You can also get this information directly from table, if you have access to SE16 or SE16N. Execute SE16N Table AGR_1251 Object S_TCODE VALUE (low) SU01

Q. How to find out all the users who got SU01 ? A. You can use SUIM >User by complex criteria or (RSUSR002) to find this out. Go to the Selection by Authorization Value. In Object 1 put S_TCODE and hit enter. And put SU01 in Transaction code and hit execute (clock with check) button. I use authorization object, as you can use this to test any object.

Q. How to find out all the roles for one composite role or a selection of composite roles? A. Execute SE16N Table AGR_AGRS Composite roles You can put multiple composite roles using the more button

Q. How to find out all the derived roles for one or more Master (Parent) roles? A. Execute SE16N Table AGR_DEFINE

Use either agr_name field or Parent_agr field.

Q. How can I check all the Organization value for any role? A. Execute SE16N Table AGR_1252 Role Type in the role here and hit execute. You can always download all the information to spreadsheet also using .

Q. How do I restrict access to files through AL11? A. First create an alias. Go to t-code AL11 > configure > create alias. Let say we are trying to restrict alias DIR_TEMP which is /tmp. Open PFCG and assign t-code AL11, and change the authorization for S_DATASET as mentioned below Activity 33 Physical file name /tmp/* Program Name with Search Help *

Q. How can I add one role to many users? A. SU10. If you have less than 16 users then you can paste the userids. If you have more than 16 users Click on Authorization data and click on next to users and upload from clipboard . Hit the change button and go to the role tab and add the roles to be assigned and hit save.

Q. What are the Best practices for locking expired users? A. Lock the user. Remove all the roles and profiles assigned to the user. Move them to TERM User group.

Q. How can be the password rules enforced ? A. Password rules can be enforced using profile parameter. Follow the link to learn more about the profile parameter.

Q. How to remove duplicate roles with different start and end date from user master? A. You can use PRGN_COMPRESS_TIMES to do this. Please refer to note 365841 for more info.

Q. How come the users have authorization in PFCG, but user still complains with

no authorization? A. Make sure the user master is compared. May be the there is a user buffer overflow Also check the profile- Follow the instruction below. SUIM > User by complex criteria. Put the userid of user who is having issue. Execute Double click on the user id and expand the tree. Select the profile in question and see if the authorization is correct or not. If not do the role reorg in PFCG and see if that helps.

Q. How can I have a display all roles. A. Copy sap_all and open the role and change the activity to 03 and 08

Q. How can I find out all actvt in sap? A. All possible activities (ACTVT) are stored in table TACT (transaction SM30), and also the valid activities for each authorization object can be found in table TACTZ (transaction SE16).

Interview questions by Abbas 1. 2. 3. 4. 5. differentiate between rollout and rollin what is heap memory / extended memory explain or list out different states of dialog wp's when wp's enter priv mode, what should you do sa3e (rsparam) why do you use it for 6. explain spool work process, how it works 7. sap file system diagram, as abap , as java dual stack 8. list dvd's you got for solman install 70 and ecc 604 9. tell me products is your landscape and how big is it 10. can you link and apply lock concept and update concept and enque concept 11. how can you change no of wp's system wide 12. what are operation mode and its significance 13. what is current patch level of sapgui, how do you check, from where do you install 14. browse, help.sap.com and service.sap.com 15. explain sap architecture, how user requests flows into sap 16. explain lock enque and update concepts together 17. explain difference between CI and DI 18. why do you need DEV, QUA, PRD 19. explain sap directory structure for AS ABAP and AS JAVA 20. explain what dispatcher does 21. what is netweaver capabilities and 22. what is business suite, 23. explain various options found in service market place