SAP C_SEC_2405 Practice Test Questions Answers

In a Central User Administration (CUA) scenario, the table PRGN_CUST is used to configure settings for role and user management during transports. The correct setting for user assignments when transporting roles is USER_REL_IMPORT = NO. This setting ensures that user assignments linked to roles in the source system are not imported into the target system during the transport process. In CUA, user assignments are centrally managed in the CUA master system, and importing user assignments from a child system could lead to inconsistencies or overwrites, disrupting centralized control. By setting USER_REL_IMPORT to NO, the system preserves the CUA’s authority to manage user-role assignments, ensuring that only role definitions are transported. The options related to SET_IMP_LOCK_USERS control user locking during imports, not user assignments, and USER_REL_IMPORT = YES would incorrectly allow user assignments to be transported, which is undesirable in a CUA setup. This configuration maintains the integrity of centralized user administration in SAP landscapes.

In SAP role maintenance, a status text value of "Old" indicates that the field values for an authorization in an existing role were unchanged and no new authorizations were added. This status appears during PFCG role maintenance when comparing or updating authorizations, showing that the authorization object or field values have not been modified since the last maintenance and no additional permissions have been included. It reflects a stable state, ensuring that the role’s existing permissions remain intact without unintended changes. Option A is less precise, as it does not address the absence of new authorizations. Option B describes a scenario where changes were made but reverted, which is not "Old." Option C relates to merged authorizations, not the "Old" status. The "Old" status helps administrators confirm that no updates were applied, supporting consistent role management and preventing accidental modifications during maintenance in SAP systems.

The authorization object S_START is required to define the start authorization for an SAP Fiori legacy Web Dynpro application. S_START controls access to starting applications, including Web Dynpro apps, in the SAP Fiori launchpad by checking the application’s technical details, such as its component or alias. This object ensures that only authorized users can launch specific Fiori-based Web Dynpro applications, providing granular control over application access. S_SERVICE is used for OData service authorizations, typically for Fiori apps using Gateway services, not legacy Web Dynpro apps. S_SDSAUTH is not a standard SAP authorization object, and S_TCODE governs transaction code access, which is irrelevant for Web Dynpro applications in the Fiori context. By using S_START, SAP ensures that legacy Web Dynpro applications integrated into the Fiori launchpad are securely accessed, aligning with the system’s authorization framework and supporting a consistent user experience across modern and legacy applications.

In SAP S/4HANA, the user types that can log on in interactive mode are Dialog User and Service User. Dialog Users are designed for human interaction, allowing individuals to log on via the SAP GUI or Fiori launchpad to perform tasks like data entry or reporting. They support full interactive access, including personalized sessions and user-specific settings. Service Users, while primarily used for web-based or anonymous access (e.g., via Fiori apps or web services), can also support limited interactive logon in specific scenarios, such as testing or administrative tasks, depending on system configuration. System Users are intended for background processes, like batch jobs, and do not support interactive logon. Communication Users are used for machine-to-machine interactions, such as API calls, and are not configured for interactive access. These distinctions ensure that interactive access is restricted to appropriate user types, enhancing security by limiting human logon capabilities to Dialog and Service Users while aligning with SAP’s user management framework.

To enforce an additional authorization check when a user starts an SAP transaction, you must assign the relevant authorization object and its permissions to the transaction code using transaction SE93. This transaction allows you to define or modify the properties of a transaction, including specifying authorization objects that must be checked when the transaction is executed. By linking the authorization object directly to the transaction in SE93, the system enforces the additional check at the point of transaction execution, ensuring that only authorized users can proceed. Transactions SU24 and SU22 are used for maintaining authorization defaults, but they do not directly enforce checks at transaction start, and S_START is specific to Fiori app authorizations, not general transactions.