SAP has done nothing less than change the entire systems landscape for enterprises. The benefits it can bring have led to widespread adoption across the globe. One of the key benefits SAP brings to an enterprise is the ability to integrate the data both within the enterprise, and between it and it’s partners / competitors. In many cases organizations today are both partners and competitors at the same time. Think of wholesalers and distributors, SAP and Oracle, AT&T and BT, or two oil giants who have an upstream joint venture. These companies use SAP to integrate process between themselves for their mutual benefit. This ability to integrate, however, brings with it a particular risk – that of exposing their data to the un-authorized outside world.

Entire companies have been built up around highly guarded intellectual property and process secrets ... and could easily fall if this was breached. Therefore, keeping the security of the organization intact is one of the vital aspects of any SAP implementation.

SAP BASIS addresses all security issues by incorporating an authorization module. With increased potential for security breaches in the computer systems around the world, BASIS consultants face a tough task of maintaining the integrity and administering the security of SAP systems. Interoperability features of a SAP system makes this task a bit more difficult.

SAP security in an integrated environment can be viewed in the form of discrete components as shown below (figure 1).

Tight security is required for each of the above components (Network, Workstation, Operating System and Database) as a breach made in one area can compromise the entire system.

The scope of this article is SAP Application Security, which can be achieved with the help of SAP’s BASIS security application through the concept of authorization.

In SAP, security is administered for objects (profiles and authorizations). Users are only authorized to see or change the parts of the system required by their respective job responsibilities.

2.1 SAP Authorization Concept

The SAP authorization concept is based upon the logical relationship between a user ID and the range of system authorizations with which it can be associated. The architecture of the authorization system is based upon the utilization of several individuals but related logical components: Profiles, Objects, Fields, and Authorizations. The user ID refers exclusively to profiles. Each profile grants a set of specific system access authorizations to user. Figure 2 illustrates the hierarchical authorization concept in SAP.

Composite profiles refer to the various employee roles available in the corporation (for instance: Purchasing / Receiving Clerk or Accounts Agent). As the name suggests, composite profiles may contain multiple user IDs necessary to perform all the business operations associated with a particular role. A composite profile may encapsulate another composite profile(s). In practice, a model composite profile should be recognized for each possible role in the organization, which may be used to produce hybrid composite profiles. The over-existence of the hybrids can defy the very purpose of composite profiles and they should be created only when specific needs arise.

User ids allow access to SAP applications.

Each user must have a corresponding profile specifically assigned. In many situations, multiple composite profiles can be assigned to a user ID, depending on the role(s) an individual user is responsible for, in the business processes.

Authorizations are the key building blocks of SAP security. Authorization is the process of assigning values to fields present in authorization objects. In SAP, access to all system functionality is achieved through a complex array of authorizations. Sometimes users find that they lack the necessary authorizations to perform a certain function in the system, in which case the message: "You are not authorized..." is displayed at the bottom of the screen.

An authorization process may ask for second associated authorization process which in turn asks for third and so on. For example, the task of paying a vendor invoice may require 10 different authorizations.

3.0 Security Configuration in SAP

Security configuration and administration in SAP is a multi-phase process. Four key security components are required to ensure the adequate security, privacy, and integrity of information. The phases are as follows:

The first phase comprises confirmation of user identity and results in authentication of user. Unauthorized access to SAP system is prevented through this initial check. This ensures system integrity by regulating secure access through genuine user authentication.

A Profile Generator (PG) is used to automatically generate and assign authorization profiles. This tool was released with SAP version 3.1g and above. The administrator can also create authorization profiles manually.

The authorization objects can be selected using the SAP Profile Generator. Administrators can automatically generate authorization profiles for function-specific access to SAP users after configuring initial settings.

The entire authorization functionality of SAP signifies a new approach to authorization. The administrator can define user authorization based on SAP functions. Based on the selected function, the PG groups objects in administrator-created authorization profiles.

Authorization profiles created by a Profile Generator are based on the given authorizations. It also speeds up the process and simplifies administrator/user communication facilitating both the administrator and users to use the same SAP function terminology. To auto-generate an Authorization profile, an Activity Group needs to be created.

Activity Groups contain simple profiles and usually represent employee or job roles. They are user-defined and allow administrator to organize and maintain system activities. Activity group when used as an information database reduces data entry time. Administrators can define activity groups in two steps:

1. Selecting the criteria, such as access controls.
2. Dividing the activities into appropriate groups.

For example, activities can be organized by functions, such as human resources, payroll, or administration or by job classes, such as computer programming activities, or accounting activities. A combination of function-specific activity and job-specific activity can also be implemented.

Security implementation with the new Profile Generator is based on the creation of activity groups or a collection of linked or associated activities, such as tasks, reports, and transactions.

Consider a business situation involving a company, ABC Inc. faced with transaction security hiccups in business dealings with its dealers. To address this problem, the company can create authorization profiles for its dealers using the profile generator features. This can be done by implementing the following instruction set:

• Instruction 1: A dealer activity group should be created. Name this activity group as Dealer.

• Instruction 2: All dealer-specific business transactions should be included in the activity group.

• Instruction 3: Generate an authorization profile for Dealers.

• Instruction 4: Assign Dealer to a "new user" or in your system and update master records.

Following this procedure will ensure complete functional access to the new user using the system as Dealer.

3.3 Auditing and Monitoring

In this subsequent phase, a track of the authorizations created (previous phase) is kept. Detailed accounts of system events are used to record the actions of a user corresponding to that unique user account identifier. Auditing/Monitoring activities should be in compliance with enterprise’s overall IT strategy and should be performed on a weekly, monthly, quarterly, and yearly basis.

There are some key tasks that should be included in a monitoring plan. The following reviews should be a part of an ideal monitoring plans.

Reviewing User Activity
All SAP system users must be continuously monitored so that their problems can be rectified as soon as they occur. The timely attention to user problems can reduce administration overheads.

For example, if a SAP administrator wants to check for unrecognizable user Ids or the users trying to use non-permitted transactions, administrator can execute transaction AL08 and review user activity.

The BASIS users in a SAP system have access to sensitive areas of an organization. Therefore it is vital to monitor their access. Following instructions can be performed to check the access of BASIS User group.

Instruction Set

• Enter transaction SUIM to view Repository Information of the system.
• Follow the Menu Path:
  • User > Lists of users (according to selection criteria) > user IDS (Double Click).

All change requests need to be properly reviewed and controlled prior to being applied. This formal process needs to be detailed enough to ensure that separation of duties and other control features are not breached. Strong integration knowledge of the SAP system is required for this review. Critical profiles, authorizations, and transactions need to be identified and treated even more carefully.

Administrators must check that default profiles act a template for user defined profiles and are not directly used in production. Default profiles contain values, which apply to all application servers. These include: SAP_ALL, SAP_NEW, S_A.ADMIN, S_A.CUSTOMIZ, S_A.DEVELOP, S_A.DOKU, S_A.SYSTEM, S_A.USER, S_ENT_IMG_GE, S_WF_ALL, and P_ALL.

SAP comes with some pre-configure clients (independent business units). They are client 000, 001 and 066 in the non-IDES system. In the IDES system, client 800 is the default client. SAP installation process automatically creates default user Ids and their corresponding passwords. SAP administrators must ensure that they are not used to access the system. The following table explains default user Ids in various SAP clients.

• Change all default passwords and verifying the password change by logging into various client areas.

• Assign SAP* to the Super user group.
  • Enter transaction SE16.
  • Enter SAP* into the field called BNAME.
  • Click "Execute" and verify.

• As a final step, check that the secret super user has been created (with a different user ID and password). All of the authorizations assigned to SAP* should then be removed (an empty profile list followed by a password change.

SAP Audit Information System (AIS) serves as a centralized repository for reports, queries, and views of interest to auditors. It is designed to address the overall system configuration as well as SAP business processes and their related control features, providing audit and security practitioners with the critical information they need to conduct effective reviews of their SAP systems. SAP administrators can use AIS for security auditing. The AIS plays a supportive role in providing security services for SAP systems. The primary function of AIS is auditing but auditing features can derive the measures that help in developing the security policy for SAP systems.

A successful security set up of a SAP system concludes with proper management and administration of user IDs, password resetting, audit trails, audit logs, access control list, and personnel responsibilities.

Security administration in SAP includes maintenance of the overall SAP security environment using the SAP Profile Generator, creating user-level activity groups and creating user master records.

The concept of SAP security is flexible as well as complex. SAP has a multi-layered integrated framework. To ensure adequate protection, security measures must be factored into all layers of the SAP infrastructure. With client/server architecture, SAP systems include many components that exchange information, each of which constitutes a layer of the SAP security infrastructure. Security is often not a priority in an implementation and as a result, the default security is not strong. SAP security functionality could be enhanced using various measures as discussed above.

Enterprises must develop a security strategy to ensure a secure and functional SAP system. A business critical application like SAP needs continuous monitoring and improvement of its security features.

• How would you measure your success or failure in this job?
• What skills and personal qualities are essential for success in this role?
• What would you like to know about this organisation?
• What do you believe you can contribute to this organisation?
• What do you know about our industry?
• What do you know about our organisation?
• Why are you interested in working for our organisation?
• Why should I hire you?

• Tell us about a time when you had more to do than you could complete in the time allocated: tell us what you did about it and what the outcome was.

• What are your short and long-term goals?
• When and why did you establish these goals and how are you preparing yourself to achieve them?
• What are the most important things you are seeking in a career?

• Tell me about a difficult decision that you have made.
• Tell me about an unpopular decision you have made.
• What significant problems have you faced in the project and how you handled them ?
• How do you work under pressure?
• Tell me about a time when you had to make a quick decision.
• What were the circumstances and what did you do?

Take a test on this question

When entering a document using a foreign currency, which date is used to determine the exchange rate if the translation date is not entered ?(Single)

A. Posting date

B. Document date

C. Entry date

D. Baseline date

I got the answer wrong the first time. Write your answer. Check the solution at the end of the post.

26. Choose the correct statements regarding recurring documents. (Multi)

A. When creating a recurring document, the valid time period must be defined.

B. The posting date is determined by either the run date or the run schedule.

C. Field values can be changed in recurring document.

D. After running the recurring document posting, the next run date cannot be displayed.

E. The original recurring document can be deleted from the batch input menu.

27. In manual bank statement customizing, you must (Multi)

A. Define an internal activity

B. Define a posting rule

C. Define a posting type

D. Define a currency

E. Define an account symbol

28. Which of the following statements about manual planning are correct?(Multi)

A. The planning type determines which bank accounts the plan amount to be inputted to.

B. The expiration date shows how long the payment advice is included in planning.

C. The payment advices for editing can be changed, archived, or reactivated.

D. Archived payment advices are included in planning till the value date.

E. The retention periods are determined by the bank account name.

29. Bank accounts should be controlled as follows when Cash Management is in use:(Multi)

A. Open items are managed for both the main bank account and the bank clearing account.

B. Both the main bank account and the bank clearing account permit line item displays.

C. The main bank account and the bank clearing account use the same sort key.

D. The value date in the field status string for both the main bank account and the bank clearing account must accept entry.

E. The cash-relevance flag in the master records for both the main bank account and the bank clearing account must be set.

30. Which of the following statements about creating customer master records are correct? (Multi)

A. An account group always gets assigned to a customer.

B. The company code is always a required entry.

C. The account number may be assigned by the user externally.

D. Information on each screen may be defined in configuration as mandatory, suppressed or optional, depending upon the account group.

E. Information on each screen may be defined in configuration as mandatory, suppressed or optional, depending upon the company code.

31. Which of the following statements are correct? (Multi)

A. A customer master is divided by client level and company code level.

B. In case of one-time customer you have to enter the customer's address in the document itself.

C. Address, control data, and reconciliation account are included in the client level of the customer.

D. The most efficient way to create master records is to work with the external number range not internal number range.

32. Which of the following statements are correct? (Multi)

A. If a customer is also a vendor, the system can include outstanding Accounts Receivable invoice items in payment program.

B. If a customer is also a vendor, the system can include outstanding Accounts Payable invoice items when you clear incoming
payment receipts for the customer.

C. The reconciliation account defined on the customer master record is an account used to reconcile CO transactions back to FI.

D. All customer belonging to the same account group must be assigned to the same reconciliation account.

E. The alternative payer is used to transfer outstanding receivable item to the alternative payer's account.

33. Bulk change of line item - this function allows you to change a whole group of line items simultaneously, instead of having to change individual items in the documents. What data can you change using this function?(Multi)

A. The reconciliation account

B. The company code

C. The payment terms and payment block

D. The house bank and payment method

34. Which of the following order types are internal orders?(Multi)

A. Result analysis orders for posting accrual costs in CO.

B. Capital investment orders for creating assets.

C. Maintenance orders.

D. Sales orders for make-to-order function

E. CO production orders.

35.Which of the following statements are correct regarding Internal Orders?(Single)

A. Planning transactions are allowed under any status.

B. Once an order has been released, only closing entries can be made.

C. Transactions can be allowed or disallowed depending in the
order status.

D. Additional order status categories can be created in the order master.

36.Which of the following statements is true about CO production orders?(Multi)

A. It is an internal order used to control production from a cost accounting point of view.

B. Bills of materials and routings are required.

C. It is not possible to post goods movements to and from the order.

D. You can post primary costs from Financial Accounting to the order.

E. You can post secondary costs from overhead calculation to the order.

37.Which statements are true regarding direct and indirect activity allocations? (Multi)

A. If both the amount of the activity used by the receiver and the total output activity quantity of the sender can be measured, then indirect activity allocation is used.

B. If the amount of activity consumed by the receiver is not measured, then indirect activity allocation is used.

C. Manual activity input planning cannot be performed if actual activities are allocated indirectly.

D. If direct activity allocation is used, the total output activity quantity is determined by summing all of the activity quantities allocated.

38. The primary cost element is one type of master data in Controlling. Before you can create a new primary cost element, certain prerequisites need to be fulfilled.

Which of the following conditions must be fulfilled BEFORE you can create primary cost elements?(Multi)

A. The controlling area must be defined.

B. The cost center must be defined.

C. The G/L account must be defined.

D. The plant must be in the system.

E. The business areas have been defined.

39. What is the difference between distribution and assessments? (Multi)

A. Distribution can be made for both planned and actual figures; assessments cannot.

B. Distributions can be made using statistical key figures; assessments cannot.

C. Distributions are used when the original cost information is necessary on the receiver; assessments are used when this information is not necessary on the receiver.

D. Distributions are made using the original primary cost elements; assessments are made using secondary cost elements.

You should remain calm and relaxed on the SAP Certification Examination. The examination will be computer based and will consist of singe as well as multiple choice questions. I had finished my answers in first one and hour of the examination but stayed there to check my answers again. I revised lot of my answers particularly the multiple choice ones. So it is a good idea to stay in the examination hall for allotted hours. The moment your time is up, you get the results.

The key to pass SAP certification is to read the SAP training documentation, try out the exercises and revise. You will pass the certifications. Good Luck.

The answer to the question

Q. When entering a document using a foreign currency, which date is used to determine the exchange rate if the translation date is not entered ?

A. B. Document Date

Any queries, please comment on the blog post.

Regards,

Santosh Puthran

• Can I appear for SAP Certification examination without undergoing the training program ?
• I have experience as end user of SAP, can I do SAP certification ?

The answer is available on SAP website on Examination Policies and Procedures.

Participants

• Partners and customers may register suitably qualified employees as candidates for the certification examination.
• Participants in training courses that are given by SAP or SAP's authorized training partners and that include the certification examination may attempt the certification examination. For all Academy tracks that contain Case Studies, full participation of the student is mandatory to qualify to take the certification exam.

13. Integration with MM: An asset purchase order is created in Purchasing. The goods receipt is posted on a value basis. Invoice verification then posts the invoice.

What is the name of the auxiliary account used for all of these transactions?(Single)

A. MM/FI clearing account.

B. GR/IR clearing account.

C. Asset purchasing clearing account.

D. Asset acquisition clearing account.

E. Vendor asset acquisition clearing account

14. What additional functions do asset classes offer?(Multi)

A. Specify required entry fields for asset master data
B. Enter default values for asset master data
C. Enter default values entries for depreciation area
D. Enter allowed entries for user fields
E. Define allowed company codes

15. Which of the following statements about manual depreciation (for example unplanned depreciation in FI-AA) area true?(Multi)

A. You cannot post manual depreciation in FI-AA.

B. Manual depreciation is posted immediately after entry(real time).

C. Manual depreciation is initially shown as a planned value after entry and only posted when the depreciation posting report is run.

D. Manual depreciation usually only applies to depreciation areas which you choose when you enter the document.

E. After entering manual depreciation in FI-AA., you also need to enter it manually in FI/CO.

16 .Which correspondence extracts all items in the chosen period from a customers account displays the balance carried forward balance and a closing balance of the Account ?(Single)

A. Payment advice

B. Payment notice

C. Account statement

D. Dunning notice

17. Which of the Following statements about automatic payment are correct ? (Multi)

A. In automatic payment procedures, all incoming invoices as of the second dunning level are paid automatically

B. Direct debiting or bank collection can be used in automatic payment procedures to clear customer invoices

C. Open items posted to G/L accounts can be cleared using the payment program

D. Special G/L transactions(down payment)can be posted using the payment program

E. The payment program can pay vendor invoices using wire transfers and checks

18. Imagine the following scenario:A company wants to execute a payment run on a daily basis and process several company codes at the same time. If the amount exceeds US$ 1000, the vendors are to be paid by bank transfer, amounts less than US$ 1000 are to be paid by check. The customer has two house banks and wants all checks to be processed by bank A and all (Multi)

A You store variants for print programs within customizing. Here you can specify that the information is to be output to a data carrier

B. You specify, per house bank, whether payments are to be made by check only or also by transfer

C. You specify the payment method from within the application,in the master record

D. The payment proposal of the automatic payment program can only be displayed

E. You can precisely schedule the print program from within the application

19. According to which criteria does the payment program determine and select open items (Single)

A. posting date and baseline date

B. document date and posting date

C. baseline date and payment terms

D. posting date and cash discount periods

E. posting date and payment terms

20. Which of the following statements are true with regard to the customizing setting for banks in the automatic payment run ? (Multi)

A. The sequence of the banks for processing outgoing payments is selected randomly

B. You can only determine one payment method per house bank

C. You can select several payment methods per country

D. You can specify by bank and method the anticipated number of days before the bank account is debited

E. You can determine the banks to be used for payments according to postal code

21. Which of the following factors does the systems take into account in a payment run ?(Multi)

A. Fiscal year variant

B. Payment method specifications in the IMG

C. Specifications in the vendor master records

D. Information in the documents(incoming invoices)

E. Specifications made when maintaining the payment run parameters

22. Which of the following statements are correct ?(Multi)

A. When creating a House bank, you do not need to specify the country.

B. The payments program can use a different House bank for each different payment method

C. A House bank account can be defined in more than one currency

D. House bank master data must be created in advance, before assigning the House bank to a payment method in the payment program
configuration

E. A house bank can be assigned to a business area within the payment program configuration

23. When entering a document using a foreign currency, which date is used to determine the exchange rate if the translation date is not entered ?(Single)

A. Posting date

B. Document date

C. Entry date

D. Baseline date

24. where are posting periods defined?(Multi)

A. Posting period variant.

B. Fiscal year variant.

C. Field status variant.

D. Closing period variant.

25. which of the following statements supports the reversal of a document?(Multi)

A. The original document contains no cleared line items.

B. Documents originating in other modules should be corrected there to allow the changes to flow naturally through to financial accounting.

C. If a reversal date is not specified, the system reverses the document using the posting date of the document to be reversed.

D. A new document number is created for the reversal document.

1. A chart of accounts ( Multi Choice)

A. can be allocated to multiple company code

B. can be defined as the group chart of accounts

C. only contains definitions for G/L accounts

D. can only allocated to one company code.

2. A client. ( Single Choice)

A. may only contain a single chart of accounts

B. may contain multiple charts of accounts

C. may only use one currency type

D. may only have one controlling area

3. Identify the correct statement(s) relating to how the main business processes are integrated in the SAP R/3 System. ( Multi Choice)

A. A purchase requisition is a documented request to purchase goods or services. In SAP it can be created manually or automatically.

B. A goods receipt is the recording of the movement of materials into the warehouse. In SAP, a financial document which updates the inventory account and an accrued liability account is created

C. The Invoice receipt and verification process compares the vendor invoice with the purchase order and goods receipt. However, the corresponding financial transaction must be entered through the financial module of R/3.

D. In SAP, payment processing reduces the liability to a vendor and a company's cash balance, records discounts taken and disburses
payment.

E. A customer delivery is the transfer of the ownership of goods. A customer delivery includes, creation of a delivery document, picking the goods for shipment; physically transferring the goods to the customer and financially recording the goods issue.

4. Identify the correct statement(s) regarding organizational elements within the R/3 System. ( Multi Choice)

A. The Sales area combines the sales organization, distribution channel, and division.

B. The Purchasing Organization is responsible for the purchasing for the only one plant.

C. A plant is a location in which inventory quantities and values are stored or manufactured.

D. A Controlling area can comprise several company codes using different chart of accounts but must operate in the same currency.

E. A profit center is used to generate income statements and operating profit statements.

5. Which of the following statements is true ? ( Single Choice)

A. A Company code can belong to more than one controlling area.

B. A plant must be allocated to a company code

C. A controlling area and a company code must have the same local currency.

D. A business area and a company code are assigned to each other in the corporate structure IMG

6 . Which of the following statements about year-end closing are correct?(Multi)

A. You carry out year-end closing before the fiscal year change.

B. During year-end closing, the program checks if the year-end closing can be carried out.

C. Once the year-end closing was successfully completed, the system automatically changes certain entries in Customizing (closed fiscal year)

D. You cannot create and post to new fixed assets until The year-end closing is successfully completed

E. You can only conduct year-end closing on June 30 or December 31 of each year.

7. What steps have to be completed before you can generate asset classes form G/L accounts? (Multi)

A. Account selection

B. Account determinations

C. Number range intervals

D. Screen layout variants

E. Asset classes

8. For each depreciation area you need to specify whether you want to (Multi)

A. post depreciation at periodic intervals to the general ledger

B. post asset values at periodic intervals

C. automatically post values online

D. use index classes

E. post to business areas

9. Please click on the button next to the correct answer.(Multi)

A. The business area can run across many company codes, i.e. all company codes can post in all business areas.

B. A company code may belong to more than One Controlling Area.

C. Each company codes uses exactly one chart of accounts and one chart of depreciation.

D. Business areas are used to create internal balance sheets and income statements.

10. The time of the first acquisition posting to the asset sets the following fields in the master of asset(Multi)

A. the depreciation start date per depreciation area

B. the cost enter to be hit through depreciation

C. the date of capitalization

D. the depreciation key

11. Usually one Chart of Depreciation is defined for each country. At which level is the chart of Depreciation created?(Single)

A. at Company Code level

B. at Client level.

C. at Chart of accounts level.

D. at Business area level.

E. at System level.

12. What are the functions asset class?(Multi)

A. Asset number assignment.

B. Cost Center determination.

C. Screen layout

D. Account allocation