c-sec-2405 Sample Questions & Answers

Transaction SU25 is crucial for post-upgrade authorization adjustments. Steps 2a, 2b, and 2c are used to compare the authorization default values (from SU24) of the old release with the new S/4HANA release. This process helps administrators identify which of their existing PFCG roles contain transactions with changed authorization data, allowing them to manually review and merge the new defaults to ensure the roles function correctly in S/4HANA.

False. The recommended best practice in SAP S/4HANA Cloud, Public Edition, is to copy the standard business role templates provided by SAP and then adjust the copy. This approach ensures that the role is based on a tested and supported foundation, simplifies future upgrades, and leverages the pre-configured business catalogs and applications associated with the template.

SAML 2.0 integration relies on a trust relationship established by exchanging metadata. The SAP Gateway system acts as the Service Provider (SP). Its SP metadata must be exported and given to the Identity Provider (IdP). Conversely, the IdP's metadata must be imported into the SAP system (using transaction SAML2). Additionally, the core SICF services for SAML processing (/sap/public/bc/sec/saml2 and /sap/bc/webdynpro/sap/saml2) must be active.

In transaction PFCG, a yellow status light on the Authorizations tab indicates that the authorization data has been modified (e.g., by adding new transactions or manually changing objects) but the corresponding authorization profile has not yet been generated. The administrator must enter the authorization data in expert mode to maintain the values and then generate the profile, which will turn the light green.

The reginfo (registration info) file controls which external RFC server programs are allowed to register themselves with the SAP Gateway using a specific Program ID. The secinfo (security info) file defines which clients (based on host and user) are permitted to start external programs via the Gateway. Together, they form a critical access control list (ACL) for protecting the Gateway from unauthorized external program execution and registration.

The User Information System (SUIM) is a powerful reporting toolset designed for comprehensive authorization analysis. It allows administrators to run a wide variety of reports, such as finding users by role or profile assignment, finding roles that contain a specific authorization object, or even searching for users who have an authorization object with a particular value. It is the primary tool for this kind of analysis.

This correctly separates the functions. The Identity Authentication service (IAS) is a cloud-based Identity Provider (IdP) that handles user login, SSO, MFA, and trust relationships. The Identity Provisioning service (IPS) is responsible for identity lifecycle management; it reads users and groups from a source system (like a corporate directory) and provisions (creates, updates, deletes) them into various target systems (both cloud and on-premise).

System-wide password and logon policies, such as the number of failed attempts before an account is locked, password length, and complexity rules, are controlled by profile parameters. These parameters are maintained using transaction RZ10 (for static profiles) or RZ11 (for dynamic changes) and apply to all users in the system. The specific parameter for this requirement is login/fails_to_user_lock.

The SAP Fiori Launchpad has built-in capabilities to collect detailed usage statistics, such as which apps are launched, how long they are used, and by which users. This functionality needs to be activated and configured. The collected data is stored in the backend system and can be extracted to a data warehouse (like SAP BW) for detailed analysis, providing valuable insights into user behavior and app popularity.

The standard and most scalable method in S/4HANA Cloud, Public Edition is to use a single business role that grants access to the app (via a business catalog) and then apply granular restrictions. Using the 'Maintain Business Role' or 'Maintain Business User' apps, an administrator can define access restrictions for specific fields (like Company Code and Plant) and assign different values to different users, all under the same role. This avoids role proliferation and simplifies maintenance.