ERP Security 2 — Questions and Answers
Question 1: Which ERP security concept ensures that no single user can complete a sensitive transaction from start to finish without another user's involvement?
- Least privilege
- Segregation of duties (Correct answer)
- Defense in depth
- Role-based access control
Correct answer: Segregation of duties
Segregation of duties (SoD) divides critical tasks among multiple users to prevent fraud and error.
Question 2: In SAP ERP, which authorization object controls access to specific financial posting transactions?
- S_TCODE
- F_BKPF_BUK (Correct answer)
- P_ORGIN
- S_USER_GRP
Correct answer: F_BKPF_BUK
F_BKPF_BUK governs document posting authorizations by company code in SAP FI.
Question 3: An ERP system stores sensitive HR salary data. Which encryption approach best protects this data at rest?
- SSL/TLS encryption
- AES-256 column-level encryption (Correct answer)
- MD5 hashing
- Base64 encoding
Correct answer: AES-256 column-level encryption
AES-256 column-level encryption protects specific sensitive fields in the database even if the storage media is compromised.
Question 4: A company discovers that an ERP consultant's account was used to export the entire customer list after their contract ended. What control failure does this represent?
- Inadequate patch management
- Failure to revoke access upon offboarding (Correct answer)
- Weak password policy
- Missing audit logs
Correct answer: Failure to revoke access upon offboarding
Timely deprovisioning of user accounts when employment or contracts end is a critical access management control.
Question 5: Which ERP security layer protects against SQL injection attacks targeting the ERP database?
- Strong password hashing
- Parameterized queries and input validation (Correct answer)
- Role-based menus
- Session timeout policies
Correct answer: Parameterized queries and input validation
Parameterized queries prevent malicious SQL code from being injected through user input fields.
Question 6: In Oracle EBS, what is the purpose of function security profiles?
- To encrypt database tablespaces
- To restrict which menus and functions a responsibility can access (Correct answer)
- To manage network firewall rules
- To configure two-factor authentication
Correct answer: To restrict which menus and functions a responsibility can access
Function security in Oracle EBS controls which application functions are available within a given responsibility.
Question 7: A SOX compliance audit requires evidence that ERP financial reports cannot be altered by the users who generate them. Which control satisfies this requirement?
- Multi-factor authentication
- Report output immutability and access logging (Correct answer)
- Strong firewall rules
- Daily data backups
Correct answer: Report output immutability and access logging
Immutable report storage combined with access logging demonstrates that financial outputs have not been tampered with.
ERP Security 2
Which ERP security concept ensures that no single user can complete a sensitive transaction from start to finish without another user's involvement?