ERP Security 5

Question 1

Which ERP security framework component maps business risks to specific system control points and monitors them continuously?

Accepted Answer

GRC (Governance, Risk, and Compliance) continuous controls monitoring

Answer

GRC continuous controls monitoring automates the detection of policy violations and SoD conflicts in real time.

Question 2

A company's ERP vendor releases a critical security patch. The security team wants to test it before applying to production. What is the correct sequence?

Accepted Answer

Apply to sandbox/QA first, validate, then promote to production

Answer

Patching in a lower environment first allows validation that the patch does not break business processes before production deployment.

Question 3

What is 'privilege creep' in an ERP environment?

Accepted Answer

The gradual accumulation of unnecessary access rights as a user changes roles over time

Answer

Privilege creep occurs when users retain old role permissions after moving to new positions, violating least privilege.

Question 4

Which ERP security control prevents a payroll administrator from changing their own salary record in the HR module?

Accepted Answer

Self-service restriction through role design

Answer

Role design can restrict which employee records a user can modify, preventing self-modification of sensitive personal data.

Question 5

In a multi-tenant cloud ERP environment, which control ensures one customer's data cannot be accessed by another customer?

Accepted Answer

Logical tenant isolation enforced at the application and database tier

Answer

Logical isolation uses tenant IDs, scoped API tokens, and separate schemas or databases to enforce strict data boundaries.

ERP - Management Practice Test

ERP - Management Practice Test

ERP Security 5