ERP ERP Security, Access Control & Role-Based Permissions 1 — Questions and Answers
Question 1: What is the primary purpose of Role-Based Access Control (RBAC) in an ERP system?
- To track user login times and session durations
- To assign system permissions based on a user's job function (Correct answer)
- To encrypt sensitive financial data stored in the database
- To monitor network traffic between ERP modules
Correct answer: To assign system permissions based on a user's job function
RBAC assigns permissions based on job roles, ensuring users access only the data and functions relevant to their responsibilities.
Question 2: In ERP security, what does 'Segregation of Duties' (SoD) primarily prevent?
- Unauthorized software version updates
- System downtime during peak business usage
- Fraud and errors by ensuring no single user controls an entire critical process (Correct answer)
- Data duplication across integrated ERP modules
Correct answer: Fraud and errors by ensuring no single user controls an entire critical process
SoD ensures that critical transactions require involvement from multiple users, preventing any one person from committing and concealing fraud.
Question 3: What does the 'principle of least privilege' mean in ERP security?
- Users should have the minimum access needed to perform their job duties (Correct answer)
- Administrative accounts should be used as rarely as possible
- Passwords must meet minimum complexity requirements set by policy
- Only senior managers can approve configuration changes
Correct answer: Users should have the minimum access needed to perform their job duties
Least privilege limits user access rights to only what is necessary for their specific job function, reducing the attack surface and risk of misuse.
Question 4: What is a 'super user' in an ERP security context?
- A user with the highest sales performance in the organization
- A read-only account used for system monitoring and reporting
- An account used to train other employees on system functions
- An account with unrestricted access to all system functions and data (Correct answer)
Correct answer: An account with unrestricted access to all system functions and data
Super users have unrestricted system access and are typically reserved for emergency situations or system administrators with special oversight requirements.
Question 5: Which control best prevents a single user from both creating a vendor record and processing payment to that vendor?
- Password complexity requirements and expiration policies
- Segregation of Duties (SoD) controls (Correct answer)
- Data encryption for all payment transactions
- Session timeout policies for inactive users
Correct answer: Segregation of Duties (SoD) controls
SoD controls separate conflicting duties (creating vendors vs. processing payments) to prevent fraud where one person could create fictitious vendors and pay them.
Question 6: In an ERP system, what is an 'authorization object'?
- A physical security device protecting the server room
- A signed document granting system access to new employees
- A data structure defining what actions users can perform on specific data (Correct answer)
- A log entry recording each user access attempt
Correct answer: A data structure defining what actions users can perform on specific data
Authorization objects in ERP systems define combinations of fields and values that control what actions a user can take on specific data objects.
Question 7: Which user account type should be used for day-to-day business operations in an ERP system?
- Super user account with broad administrative privileges
- Service account used for system-to-system integration
- Administrative account reserved for configuration management
- Standard user account with role-appropriate permissions (Correct answer)
Correct answer: Standard user account with role-appropriate permissions
Standard user accounts with limited, role-appropriate permissions should be used for daily operations to minimize security risk and comply with least privilege.
ERP ERP Security, Access Control & Role-Based Permissions 1
What is the primary purpose of Role-Based Access Control (RBAC) in an ERP system?