ERP Security 5 — Questions and Answers
Question 1: Which ERP security framework component maps business risks to specific system control points and monitors them continuously?
- GRC (Governance, Risk, and Compliance) continuous controls monitoring (Correct answer)
- Change data capture
- ETL pipeline
- Business intelligence dashboards
Correct answer: GRC (Governance, Risk, and Compliance) continuous controls monitoring
GRC continuous controls monitoring automates the detection of policy violations and SoD conflicts in real time.
Question 2: A company's ERP vendor releases a critical security patch. The security team wants to test it before applying to production. What is the correct sequence?
- Apply directly to production, then test
- Apply to sandbox/QA first, validate, then promote to production (Correct answer)
- Skip the patch if the system is stable
- Apply only to the database server
Correct answer: Apply to sandbox/QA first, validate, then promote to production
Patching in a lower environment first allows validation that the patch does not break business processes before production deployment.
Question 3: What is 'privilege creep' in an ERP environment?
- An increase in system licensing fees
- The gradual accumulation of unnecessary access rights as a user changes roles over time (Correct answer)
- Escalating hardware resource usage
- Unauthorized admin logins
Correct answer: The gradual accumulation of unnecessary access rights as a user changes roles over time
Privilege creep occurs when users retain old role permissions after moving to new positions, violating least privilege.
Question 4: Which ERP security control prevents a payroll administrator from changing their own salary record in the HR module?
- Data encryption
- Self-service restriction through role design (Correct answer)
- Network segmentation
- Audit trail logging
Correct answer: Self-service restriction through role design
Role design can restrict which employee records a user can modify, preventing self-modification of sensitive personal data.
Question 5: In a multi-tenant cloud ERP environment, which control ensures one customer's data cannot be accessed by another customer?
- Shared login credentials across tenants
- Logical tenant isolation enforced at the application and database tier (Correct answer)
- Single shared database without row-level security
- Open API access for all tenants
Correct answer: Logical tenant isolation enforced at the application and database tier
Logical isolation uses tenant IDs, scoped API tokens, and separate schemas or databases to enforce strict data boundaries.
Question 6: An internal audit finds that 47 ERP user accounts belong to employees who left the company over a year ago. Which process failed?
- Password complexity enforcement
- User access recertification and offboarding process (Correct answer)
- Firewall rule review
- Software vulnerability scanning
Correct answer: User access recertification and offboarding process
Periodic access recertification reviews and automated HR-to-ERP offboarding workflows should catch and disable departed users' accounts.
Question 7: Which ERP security approach limits the potential damage of a compromised service account by granting it only the database tables it needs to read or write?
- Defense in depth
- Principle of least privilege applied to service accounts (Correct answer)
- Security information and event management (SIEM)
- Network intrusion detection
Correct answer: Principle of least privilege applied to service accounts
Restricting service accounts to exactly the tables and actions they require limits blast radius if the account credentials are stolen.
ERP Security 5
Which ERP security framework component maps business risks to specific system control points and monitors them continuously?