ERP Security 3 — Questions and Answers
Question 1: Which attack vector specifically targets ERP systems by exploiting trust relationships between connected third-party integrations?
- Phishing
- Supply chain / API integration attacks (Correct answer)
- Brute force login
- Cross-site scripting
Correct answer: Supply chain / API integration attacks
ERP systems connected to third-party APIs can be compromised through insecure integration points, making API security critical.
Question 2: What is the primary purpose of an ERP security baseline configuration?
- To maximize system performance
- To define the minimum secure settings required before go-live (Correct answer)
- To automate user provisioning
- To enable remote desktop access
Correct answer: To define the minimum secure settings required before go-live
A security baseline establishes the hardened default configuration that every ERP instance must meet before deployment.
Question 3: A user in the procurement module can create purchase orders and also approve them. This violates which principle?
- Principle of least privilege
- Segregation of duties (Correct answer)
- Defense in depth
- Need-to-know
Correct answer: Segregation of duties
SoD requires that creating and approving the same transaction be handled by different users to prevent unauthorized purchasing.
Question 4: Which ERP security log event should trigger an immediate security alert?
- User logged in during business hours
- Successful password change
- Access to SAP basis transaction SE16 by a non-basis user (Correct answer)
- Monthly report generation
Correct answer: Access to SAP basis transaction SE16 by a non-basis user
SE16 (table browser) allows direct database table access and should never be used by non-basis users in production.
Question 5: In Microsoft Dynamics 365, what mechanism controls which entities and fields a user security role can read, write, or delete?
- Workflow approvals
- Privileges and access levels on security roles (Correct answer)
- SharePoint permissions
- Azure AD groups only
Correct answer: Privileges and access levels on security roles
Dynamics 365 security roles combine entity-level privileges with access level scopes (user, business unit, organization) to govern data access.
Question 6: An ERP penetration test reveals that the default SAP system administrator password 'Appl1ance' was never changed. This is an example of which vulnerability?
- Missing patch
- Default credential exposure (Correct answer)
- Privilege escalation
- Session hijacking
Correct answer: Default credential exposure
Unchanged vendor default credentials are a critical vulnerability because they are publicly known and easily exploited.
Question 7: Which concept describes restricting ERP users to access only the data records belonging to their business unit or geography?
- Vertical access control
- Data-level security / organizational restriction (Correct answer)
- Firewall segmentation
- Token-based authentication
Correct answer: Data-level security / organizational restriction
Data-level (or organizational) security restricts row-level record access so users see only their own entity's data.
ERP Security 3
Which attack vector specifically targets ERP systems by exploiting trust relationships between connected third-party integrations?