SAP GRC Access Controls Questions and Answers

 SAP GRC Access Controls Questions and Answers

1. What is SAP GRC?

Governance, Risk and Compliance id the full form of GRC. It provides a solution that enables organizations to maintain regulations and compliance and remove any risks in maintaining organizations key operations.

2. How many modules present in GRC?

a. Access Control (AC)

b. Process Control (PC)

c. Risk Management (RM)

d. Environment, Health and Safety (EHS)

e. Global Trade Services (GTS)

3. What is the software of GRC Financial compliance?

GRCFND_A

4. What is the plugin used for HR backend?

GRCPIERP – Used for HR function

5. What is the plugin used for NHR backend?

GRCPINW – Used for Non-HR functions

6. What is the periodic process that allows role owner to remove roles from the users?

UAR Review

7. Where can you define a mitigating control?

a. Mitigating controls workset in Access Control

b. Access Control risk analysis result screen

c. Central process hierarchy in process control

8. What is the process of  importing roles from back-end system for role maintenance using BRM?

Roles can be imported by using the standard import template.

9. What is the purpose of role mining?

Role mining is used to consolidate roles by taking actions after running comparisons.

10. Which attributes are mandatory when creating business role definition details in BRM?

a. Landscape

b. Project release

c. Application type

11. What information contains in the audit trail log for access rules?

When the change was made and who made the changes

12. What is the purpose of organizational value mapping?

Organizational value mapping is used to maintain derived roles with organizational units.

13. Which RFC connection type is used for the establishment of a connection between GRC and SAP ERP backend system?

ABAP Connection type

14. Which of the role provisioning types does Access Control user provisioning support?

a. Direct

b. Indirect

c. Combined

15. For user Access review which users are selected using AC config parameter 2006?

Manager

Role Owner

16. In MSMP workflow what rule types are available?

a. ABAP Class-based rule

b. Function module-based rule

c. BRFplus rule

17. What does an agent rule determine?

The approvers/recipients for the workflow

18. Which type of rule is used when creating an access request workflow for a role assignment that will have two or more approval steps?

BRFplus Flat rule

19. After a workflow has been initiated, how to enable stage configurations changes to get effective?

Activate the Runtime Configuration Changes OK indicator

20. Which indirect provisioning types are supported in user provisioning?

a. Organization type

b. Job

c. Position

21. Which agent purposes are available in MSMP workflow?

Approval

Notification

22. What are business configuration (BC) sets for Access Control?

It is a collection of configuration settings designed to populate SAP tables with content.

It is a set of predefined customizing settings.

23. What are the actions in BRM require a connection to a target system?

a. Generation

b. Authorization maintenance (Actions and Permissions)

c. Risk analysis

24. What transaction code is used to monitor the background jobs in access control repository sync?

SM37 (Overview of job selection)

25. Which background job is used to synchronize the Firefighter ids and their role assignments in AC?

GRAC_REPOSITORY_OBJECT_SYNC

26. What are the integration scenarios available in AC?

a. Provisioning (PROV)

b. Superuser Privilege Management (SUPMG)

c. Authorization Management (AUTH)

27. Which auto provisioning options are available in the global provisioning configuration?

a. Manual Provisioning

b. Auto-provisioning at the End of Request

c. No Provisioning

28. What data is synchronized when GRAC_REPOSITORY_OBJECT_SYNC job run?

a. Profiles

b. Roles

c. Users

29. What is the sequence of executing the sync jobs to synchronize the Access Control repository with data from different clients?

a. PFCG Authorization sync

b. Repository object sync (Profile, Role, User)

c. Action usage sync

d. Role usage sync

30. What are the application types in EAM (Emergency Access Management)?

ID based Firefighting: In this concept each Firefighter ID contains own user master record and roles are directly assigned to the Firefighter ID. The advantage is that one Firefighter ID can be used by multiple users.

Role based Firefighting: In this scenario each Firefighter role can be assigned directly to a user. User doesn’t require a separate ID to use Firefighter access.

The advantage is transactions and change histories are logged with users own ID. 

One application type can be possible to configured at a given time.

31. What users are created in EAM?

In the AC system:

Firefighter User  - SAP_GRAC_SUPER_USER_MGMT_USER

Firefighter Owner - SAP_GRAC_SUPER_USER_MGMT_OWNER

Firefighter Controller - SAP_GRAC_SUPER_USER_MGMT_CNTLR

In the target system:

Firefighter ID - SAP_GRAC_SPM_FFID

32. What is the log collecting background job in EAM?

The background job for log collection is GRAC_SPM_LOG_SYNC_UPDATE. This Job is scheduled via SM36 transaction code on a periodic basis.

33. What is the BC set related to EAM?

GRAC_SPM_CRITICALITY_LEVEL

34. What are the steps required to configure Firefighter ID?

a. Maintain Access Control Owners

b. Assign an Owner to a Firefighter ID

c. Firefighter ID is assigned to Controllers and Firefighters

d. Create the Reason Codes

35. What are the important parameters in configuring EAM?

4000 – Application Type

4001 – Default Firefighter ID validity period(in days)

4003 – Retrieve change log

4005 – Retrieve audit log

4010 – Firefighter ID role name

36. What is the most critical module in GRC?

Access Risk Analysis (ARA) is the most critical module in GRC, because It contains the “RuleSet” which is used for risk analysis.

Watch below video for more SAP GRC Security questions and answers