ERP ERP Security, Access Control & Role-Based Permissions 2 — Questions and Answers
Question 1: What is the recommended approach when designing roles in an ERP RBAC system?
- Create one unique role per individual user for maximum specificity
- Create roles based on job functions shared by multiple users (Correct answer)
- Grant all users the same base role and add individual exceptions
- Use department names as role names regardless of actual duties performed
Correct answer: Create roles based on job functions shared by multiple users
Roles should be designed around job functions, allowing multiple users with the same responsibilities to share a common, maintainable role.
Question 2: During ERP implementation, what is a 'role matrix'?
- A visual diagram showing how ERP modules integrate technically
- A technical schema for the authorization configuration database
- A report showing user login frequency categorized by assigned role
- A document mapping job positions to the system roles and permissions required (Correct answer)
Correct answer: A document mapping job positions to the system roles and permissions required
A role matrix maps each organizational job position to its corresponding system roles and specific permissions, serving as the governance foundation for access control design.
Question 3: What is the biggest security risk associated with 'role bloat' in ERP systems?
- The system runs slower due to excessive role definition records
- New employees cannot be assigned appropriate roles quickly enough
- Users accumulate excessive permissions over time, violating least privilege (Correct answer)
- Role names become too long for the system database to store efficiently
Correct answer: Users accumulate excessive permissions over time, violating least privilege
Role bloat occurs when users accumulate roles and permissions beyond what they need, creating security violations and SoD conflicts that increase fraud risk.
Question 4: What is 'role inheritance' in ERP access control design?
- When a new employee receives access rights from the previous person in that position
- When roles are automatically assigned based on the organizational chart hierarchy
- A hierarchical structure where child roles inherit permissions from parent roles (Correct answer)
- The transfer of access rights from terminated employees to their replacements
Correct answer: A hierarchical structure where child roles inherit permissions from parent roles
Role inheritance allows child roles to automatically inherit permissions from parent roles, enabling efficient management of layered permission hierarchies.
Question 5: What is a 'composite role' in SAP ERP security terminology?
- A role that spans and applies across multiple company codes simultaneously
- A container that groups multiple single roles together for easier user assignment (Correct answer)
- A role granting simultaneous access to both financial and HR data
- An automatically generated role based on analysis of historical user behavior
Correct answer: A container that groups multiple single roles together for easier user assignment
A composite role in SAP groups multiple single roles into one container, allowing efficient assignment of a complete set of permissions needed for a job function.
Question 6: What is 'provisioning' in the context of ERP user account management?
- Setting up physical hardware infrastructure required for the ERP deployment
- Training new users on how to effectively use their assigned system functions
- Creating scheduled backup copies of all user account data and preferences
- The process of granting, modifying, or revoking user access rights (Correct answer)
Correct answer: The process of granting, modifying, or revoking user access rights
Provisioning refers to the lifecycle management of user access rights—granting access when hired, modifying upon role changes, and revoking upon termination.
Question 7: When should user access rights be formally reviewed in an ERP environment?
- Only when an employee is terminated or voluntarily leaves the organization
- Annually and whenever an employee changes job roles or responsibilities (Correct answer)
- Every five years as part of the system upgrade and major refresh cycle
- Only when a security breach or unauthorized access incident has been detected
Correct answer: Annually and whenever an employee changes job roles or responsibilities
Access rights should be reviewed at least annually and immediately upon any role change to ensure permissions remain appropriate, current, and compliant.
ERP ERP Security, Access Control & Role-Based Permissions 2
What is the recommended approach when designing roles in an ERP RBAC system?