ERP Security 4 — Questions and Answers
Question 1: Which ERP security control helps detect when a privileged user exports an unusually large volume of records outside normal business patterns?
- Multi-factor authentication
- User and entity behavior analytics (UEBA) (Correct answer)
- Data masking
- Transport layer security
Correct answer: User and entity behavior analytics (UEBA)
UEBA establishes behavioral baselines and alerts when anomalous data access or export patterns are detected.
Question 2: When migrating an ERP system to a cloud provider, who is responsible for configuring ERP application-level user access controls?
- The cloud provider under the shared responsibility model
- The organization, as the ERP application owner (Correct answer)
- The hardware vendor
- Internet service provider
Correct answer: The organization, as the ERP application owner
Under the cloud shared responsibility model, the customer always owns security configuration within the applications they deploy.
Question 3: A company wants to allow auditors read-only access to financial reports in the ERP without exposing transaction entry screens. Which approach is most appropriate?
- Create a shared admin account for auditors
- Assign a dedicated read-only auditor role with no posting privileges (Correct answer)
- Give auditors a temporary full-access account
- Allow auditors to access the database directly
Correct answer: Assign a dedicated read-only auditor role with no posting privileges
A purpose-built read-only role enforces least privilege, giving auditors exactly the access they need—nothing more.
Question 4: SAP's Security Audit Log (SM20) is used primarily for which purpose?
- Scheduling batch jobs
- Recording and reviewing security-relevant ERP events for forensic analysis (Correct answer)
- Configuring printer outputs
- Managing transport requests
Correct answer: Recording and reviewing security-relevant ERP events for forensic analysis
SM20 captures login attempts, authorization failures, and sensitive transaction usage, enabling security incident investigation.
Question 5: Which type of ERP security test simulates a real-world attacker attempting to exploit vulnerabilities without prior knowledge of the system?
- White-box testing
- Black-box penetration testing (Correct answer)
- Unit testing
- Regression testing
Correct answer: Black-box penetration testing
Black-box penetration testing mimics an external attacker with no insider knowledge, revealing externally exploitable weaknesses.
Question 6: An ERP administrator notices several failed login attempts from an unfamiliar IP address followed by a successful login. What should happen next?
- Ignore it if no data was changed
- Immediately investigate for credential stuffing or brute force compromise (Correct answer)
- Increase the session timeout
- Disable the user's MFA
Correct answer: Immediately investigate for credential stuffing or brute force compromise
A pattern of failures followed by success suggests credential stuffing or brute force, requiring urgent incident response.
Question 7: In ERP security, what does 'transport security' refer to in an SAP landscape?
- Encrypting data in the database
- Controlling which code changes move from development to QA to production (Correct answer)
- Securing the physical server room
- Encrypting email notifications
Correct answer: Controlling which code changes move from development to QA to production
Transport security in SAP governs authorization to release, import, and approve change requests across system tiers.
ERP Security 4
Which ERP security control helps detect when a privileged user exports an unusually large volume of records outside normal business patterns?