When planning an authorization concept for your SAP S/4HANA Cloud Public Edition implementation, what rules must you consider? Note: There are 2 correct answers to this question.
Correct Answer: B,D
Question 17
What must you do before you can use transaction PFCG? Note: There are 2 correct answers to this question.
Correct Answer: A,C
Before using transaction PFCG (Role Maintenance) in SAP systems, two prerequisites must be met. First, tables USOBT (Authorization Object Defaults) and USOBX (Check Indicators) must be filled with SAP- delivered authorization default values, which provide the standard authorization objects and check indicators for transactions. These tables, maintained via transaction SU25, ensure that PFCG can propose appropriate authorizations when building roles. Second, the system profile parameter auth/no_check_in_some_cases must be set to Y, enabling the system to bypass authorization checks for certain transactions, which is necessary for PFCG to function correctly during role creation and maintenance. Setting this parameter to N would enforce stricter checks, potentially restricting PFCG functionality. Tables USOBT_C and USOBX_C are customer- specific and not required for initial PFCG setup, as they store customized values rather than SAP defaults. These steps ensure that PFCG operates effectively, supporting secure and efficient role management in SAP environments.
Question 18
Your developer has created a new custom transaction for your SAP S/4HANA on-premise system and has provided you a list of the authorizations needed to execute the new ABAP program."What must you do to ensure that each required authorization is automatically created every time this new custom transaction is added to a PFCG role?
Correct Answer: A
* Context:Transaction SU24 is used to maintain the link between transactions and authorization objects, ensuring automated role generation. * Solution Explanation: * By setting theDefault Status to "Yes"in SU24, the system automatically includes required authorizations when the custom transaction is added to a role in PFCG. SAP Security References: * SAP SU24 Maintenance Guide * SAP Custom Transaction Authorization Guidelines
Question 19
What can be assigned directly to a user when using the SAP Launchpad service in SAP BTP?
Correct Answer: A
In theSAP Launchpad servicein SAP Business Technology Platform (BTP), users can be assigned Launchpad rolesdirectly. These roles define the permissions and functionalities available to the user within the Launchpad. SAP Security References: * SAP Launchpad Service User Guide * SAP BTP Role Management Documentation
Question 20
Which log types are available in the Administration Console of Cloud Identity Services? Note: There are 2 correct answers to this question.
Correct Answer: B,C
In the Administration Console of SAP Cloud Identity Services, the available log types are Troubleshooting logs and Change logs. Troubleshooting logs provide detailed information about system errors, authentication failures, or integration issues, enabling administrators to diagnose and resolve technical problems efficiently. Change logs record modifications to user identities, system configurations, or security settings, offering an audit trail for tracking administrative actions and ensuring compliance with security policies. These logs are critical for maintaining system integrity and supporting forensic analysis in identity management. Usage logs, which might track user activity, and Performance logs, which monitor system performance metrics, are not standard log types in the Cloud Identity Services Administration Console, as its focus is on identity-related diagnostics and auditing. By providing Troubleshooting and Change logs, SAP Cloud Identity Services ensures administrators have the tools needed to monitor and secure identity management processes effectively, aligning with best practices for cloud-based security governance.
