Architecture of Security Roles

There are two types of security role in the SAP J2EE Engine:

· Application J2EE security roles that are based on the J2EE standard and which you can use to protect resources such as URLs or EJB methods.

· Server J2EE security roles with which you can protect any resources defined by the relevant service, such as Keystore Views.

Characteristics of the application J2EE security roles:

· The role is an abstract logical grouping of users that is defined by the developer.

· The role is defined in the deployment descriptor (XML files) of a particular application.

· The role consists of only a name and a description.

· The role relates only to the application for which it was defined.

Characteristics of the server J2EE roles:

· These roles can be created automatically by a service or manually by the administrator.

Purpose

The application J2EE security roles are suitable for purely static, activity-related access control. This concept is based on the assignment of authorizations by activity (such as the activity financial accountant), but not by instances (such as by cost centers). This means that all users to which the role Financial Accountant is assigned can post for all cost centers.

With the J2EE security roles, the developer can of an application can additionally decide whether he or she uses these rules purely declaratively or with programmatic role references:

· Declarative security means that the container forces access control without the developer having to program it.

· Programmatic security means that the developer uses a method to check whether a caller of an EJB or a Web resource has a specific role. The developer can control the display of individual control elements using these “role references”. In this way, for example, users to which the role queried in the reference is assigned can receive a more extensive display on the same Web page than users to which this role is not assigned. There can be a mapping between the role checked in the program (such as “USER”) and the actual security role that can be assigned to users by the administrator (such as “HR_CLERK”), that is, a different role may be assigned to the one that is actually checked in the program. If the developers of the various components of an application have used roles with different names, but with the same semantics, these can therefore be consolidated in this way.

J2EE security roles should be used purely declaratively. UME roles and the corresponding UME APIs should be used for programmatic access control.

Work Flow when Using J2EE Security Role References

The developers can use role references (programmatic security) that correspond to individual authorizations in the program of their applications. In a second step, the developers or development coordinators assign at least one security role to each role reference. These J2EE security roles are delivered. The administrator at the customer site installs the application with the respective security roles. The user administrator then assigns the security roles to users or user groups.

Work Flow with Declarative Use of J2EE Security Roles

The developers program their applications and specify the J2EE security role associated in each case in the XML file. These J2EE security roles are delivered and used as described under J2EE security role references.

Sample Basis Questions

1)The local memory of the work process consist of ( More than one answer can be correct)

1. Roll buffer


2. Roll area


3. Paging buffer


4. Page area

2)System messages can be sent using transaction

1. SM04


2. SM02


3. SM12


4. SM21

3)Which of the following are true about update WP?

1. At least one V2 WP should be configured in a SAP system.


2. If V1 WP are unavailable V2 WP can process V1 requests.


3. If V2 WP are unavailable V1 WP will process the V2 requests.


4. None of the above.

4) In case of a MCOD type of SAP installation which of following are true? (Multiple answers are possible).

1. Two SAP systems are stored in two different databases.


2. The same user id’s are used by all the SAP System to connect to the same database.


3. The multiple SAP systems are differentiated using the SCHEMA ID.


4. None of the above.

5)The transaction to Solution manager landscape is

1. SM01


2. SMSY


3. SM66


4. SM13

6)In the 3 layered client-server technology which are the 3 layers?

1. Database layer


2. Application Layer


3. Operating system layer


4. Presentation layer

7)Which of the following are ABAP/4 dictionary objects?(More than one answer can be correct)

1. Tables


2. Fields


3. Data elements


4. Domain

8)Which of the following are ABAP dictionary changes?( More than one answer can be correct)

1. Activation


2. Version management


3. Profile parameter changes


4. Table entries

9)Which is the central archiving transaction?

1. MARA


2. SARA


3. DB15


4. ARCH

10)What is the transaction for defining logical file path is

1. SALE


2. FILE


3. DB15


4. DB16

Sample Basis Questions

1)Which SAP system parameter points to the path of the transport directory?

1. DIR_HOME
2. DIR_DBMS
3. DIR TRANS
4. DIR_EXECUTABLE

2)Transaction for defining logical systems is:

1. BD15
2. BD54
3. BD64
4. BD87

3)Operation modes are created as empty containers in transaction?

1. RZ04
2. SM69
3. SM58
4. SM30

4)In ALE configuration the transaction for maintaining the partner profiles is

1. WE05
2. WE20
3. BD15
4. BD87

5)Which of the following are building blocks of ALE? (More than one answer can be correct)

1. Logical system
2. Message Type
3. Program ID
4. Partner Profile

6)Which of the following are true?

1. Access to http://service.sap.com/ is available only to customers.
2. Access to http://help.sap.com/ is available only to SAP partners.
3. Access to http://service.sap.com/ is available only to SAP customers and partners.
4. All of the above.
5. None of the above.

7)Which of the following is true about developer keys and object keys? (Multiple answers are possible).

1. Object keys in a SAP system are stored in table ADIRACCESS.
2. To create a customer program ZABCD you require an object key.
3. To modify a customer program ZABCD you need an object key.
4. To create a customer program ZABCD you need a developer key.
5. None of the above.

8)Which of the following are client copy profiles? (More than one answer can be correct)

1. SAP_ALL
2. SAP_ABA
3. SAP_NEW
4. SAP_ CUST

9)Client copy/transport log analysis can be done using transaction;

1. SCC1
2. SLOG
3. SCCL
4. SCC3

10)With which user id can one log into a newly created client with password PASS?

1. DDIC
2. BASIS
3. SAP*
4. SYS

Sample Basis Questions

1)What will happen if a background job is running and the Operation Mode Switch is activated in between?

1. The job will be cancelled


2. The job will be put in Suspended state


3. The Job will continue to run and once it finishes then the Operation Mode Switch will occur


4. The Operation Mode will happen the next day

2)The standard System Landscape recommended by SAP is

1. DEV, QAS & PRD systems on one Server


2. DEV & QAS on one server and PRD on another server


3. DEV, QAS & PRD on separate server


4. DEV on one server and QAS & PRD on one server

3)Access Method is

1. Connection between Dialog & Spool Work Process


2. Connection between OS Spool and the Actual Printer


3. Connection between Spool Work Process and OS Spool


4. Connection between Spool Request & Output Request

4)Total number of clients supported per SAP system

1. 1000


2. 999


3. 500


4. 998

5)Which of these is a communication user in client 000?

1. TMSADM


2. SAPDPIC


3. DDIC


4. SYS

6)Which of the following files contain TP configuration?

1. transport.ini


2. DOMAIN_DEV.cfg


3. TP_.PFL


4. tpimport.pfg

7)Which process first connects to the database?

1. Dispatcher


2. Message server


3. Work process


4. SAPGUI

8)Where the SAP Spool system stores data?

1. In the TemSe database


2. at the Operating system


3. in the shared memory of the central instance


4. in the shared memory of the dialog instance

9)Memory allocation sequence for dialog work process is

1. roll first, heap memory until exhausted, remaining of roll area, then Extended memory


2. roll first, Extended memory until quota reached, remaining of Roll area, then Heap memory


3. Extended memory until quota reached, then the whole of Roll area, then heap memory


4. roll first , then heap memory, then extended memory , remaining roll area.

10)For external programs which process is used to trigger an event within an SAP system

1. sapxpg


2. gwrd


3. dpmon


4. sapevt

Derived Roles

As the name indications are derived from already existing roles.
There are two scenarios when we derive roles.

• The role menus are identical but the authorizations for the menu actions are different in the derived role.
• The menu and authorizations of the derived role are identical, but the organizational levels are different in the derived role.

The derived roles inherit the menu structure and functions (including transactions etc...) of the referred role.

The default authorization values of the derived role are that of the inherited role. The organizational values are to be maintained in the derived role.
The organization level data is only copied the first time the authorization data is adjusted for the derived role. If organization level data is maintained in the derived role, it is not overwritten by subsequent adjustments.

Roles derived from another cannot have any additional menu entries. The menu is maintained in the referred role which take effect immediately in all derived roles.


To change the menu of the derived role without changing the menu of referred role you have to break the inheritance relationship. Once the relationship breaks, the derived role is dealt as a normal role and the inheritance relation ship cannot be re established

S_Develop Object

S_DEVELOP This is the general authorization object for ABAP/4 Development Workbench objects. It is used to grant access authorizations for all ABAP/4 Development Workbench components.
These include:

• ABAP/4 development tools


• ABAP/4 Dictionary and Data Modeler


• Screen Painter and Menu Painter


• Function library

Object Browser and Info System This is not given to any user in the production system. If given, one can do development activities in the production system. This is given to ABAP/4 developers only in development systems.

What are the checks Done When a Tcode is Called in SAP

When a transaction is called, a system program makes various checks to
ensure that the user has the appropriate authorization.

1. Is the transaction code valid? (table TSTC check).


2. Is the transaction locked by the system administrator? (table
   TSTC check).


3. Is the user authorized to call the transaction?



4. The authorization object S_TCODE (call transaction) contains the
   field TCD (transaction code).


5. The user must have an authorization with a value for the selected
   transaction code.


6. Does the transaction code have an authorization object? If so, a
   check is made that the user has authorization for this authorization
   object.

Then there are check at ABAP program level and if these checks
are succesful the the authorization checks are successful. If any one
of the checks fail, the user cannot execute the tcode.