Sap Basis

1)How many Single roles can be added in one Composite role ?
- 100
2)What are the limitations of ST01? Explain in detail?
For load balancing server, Switch the application servers via SM51
What is use Of SHDB

SHDB is a batch input transaction recorder. This application is used to record t
ransactions and screens as users enter them. It has a "playback" feature that ex
ecutes the recording in the foreground. It allows test data to be created and up
loaded.
how to add abap role to portal users?

We add through backend system. (Import of backend roles will be done by portals
team and converts into views pages )
In which table you can see authorization group for table and which table to see
authorization group for program?
V_brg_54/v_ddat_54 and for program
What is the correct procedure for Mass Generation of Roles?

You can do it through PFCG mass generation /run the profile pfcg_time_dependency
how to adjust user master records?

Do user comparison
how to create new authorization object?

Su21
which ticketing tool you are using?

USD (uni service centre desk)
I want to see list of roles assigned to 10 different users.how do you do it?

See through table AGR_USERS
in my production system there are some 20 roles created in the production system
itself without following the standard procedure of creating in dev testing it q
as and then moving it to prd.so how do you find out all the roles created in prd
system?
See the Logs in SUIM
What is the table to find out org values?
You will not find org values(Plant, company code, purchasing org,
divison) in one table,you need to retrieve the data from different tables.
What is an Authorization Group

An authorization group contains tables and views
What is difference between R/3 security and HR security?
Explain in detail or its importance?
The difference b/w R/3 n HR security is in R/e we can
restrict authorisation through auth objects and fields and
values. In HR also using objects but restricting through
infotypes and personal area'
In Bi, restrictions apply through info objects.
There are many parameters anda table to manage password
limitations and exceptions.
login/password_expiration_time
login/min_password_lng
login/failed_user_auto_unlock
login/min_password_digits
login/min_password_letters
login/min_password_diff
login/password_max_new_valid
login/password_max_reset_valid
and Table USR40 to insert password exceptions through SM30
How can I restrict a single user without changing their role?
The access of a user in an ABAP system is granted through the roles and associat
ed profiles assigned to them. A role contains a defined set of access which is
the same for any user assigned to that role.
If a user has different access requirements then they need to have a role develo
ped to reflect their needs.
Depending on the specific requirement, it may be preferable to use an alternativ
e control such as the periodic management review of a relevant report.
How do I give end users access to table data in the production system?
A custom transaction should be created which uses SM30 to access specific table
or view. This transaction can be assigned to a role in the same way as any othe
r standard or custom transaction code.
ABAPERS/DEVELOPERS will do this.
Mitigation process:
1. You have a defined rulebook.
2. You have created all risks and rules are generated.
3. You have run risk analysis in your system.
4. You have now list of risks exposure and discuss with business what to be miti
gated and what to be removed from the roles.
5. You have remediated all authorizations which are not neccessary at all.
You can mitigate it at two levels-

First you need to clean all roles. Mitigate them.
Second user level-If user is getting violations via two roles, you need to decid
e whether you want ot keep them or not.
If not, then you will have to remove one/more roles.
If you want to keep, then you have to mitigate them.
Mitigation procedure-
1. Create a naming convention which clearly states mitigation nature-e.g. which
module it belongs to role and risks.
1. Create mitigation control and associate approver, monitor, risks to them,.
2. Mitigate Roles using contorls specifying which risks you want ot omitigate.
same to mitigate users:
To mitigate a user, Create a mitigation control (naming convention should convey
the nature of risk, module of user etc.)
2. Go to RAR-Mitigation-Mitigating controls-Create.
3. Goto RAR-Mitigation-Mitigated users-Search created mit. control-Add-Put Contr
ol ID, search User name by system, Risk ID, Monitor ID and save.
What is SOD:
The primary purpose of SOD is to ensure that a role does not allow a user to per
form a combination of tasks that are considered to be a risk
What is the UME function in GRC?
The UME is the User Management Engine within a Java system. In the same way as i
n any other Java System, the UME controls the user and their authorisations for
the GRC component. You can define the roles and authorised "actions" within this
application and assign these directly to users of the tool.
1) When PFCG proposes 3 activities but you only want 2, how do you fix this?
Ans: Changes in Su24
2) What is the use of transaction PFUD at midnight?
It is used to ensure that valid authorization profiles are contained in user mas
ter record. we need to run PFCG_TIME_DEPENDENCY as a background job periodically
3) Is PFUD needed when saving in SU01 and does the user need to logoff and on ag
ain after changes?
NO, PFUD is not needed. and user doesn t need to login & log off.
4) How are web services represented in authorizations of users who are not logge
d on?
5) How do you force a user to change their password and on which grounds would y
ou do so?
user forced to change their password in every 90 / 60 days. This can be achieved
by setting the profile parameters
6) What is the difference between SU24 and SU22? What is "orginal data" in SU22
context?
SU22 displays and updates the values in tables USOBT and USOBX, while SU24 does
the same in tables USOBT_C and USOBX_C.
The _C stands for Customer
7) When an authorization check on S_BTCH_JOB fails, what happens?
Ans: User will not be able to release or delete other user jobs
8) Can you have more than one set of org-level values in one role?
9) Should RFC users have SAP_NEW and why?
Yes, during implementation & upgrades RFC users needs SAP_NEW.
SAP_NEW is a SAP standard Profile which is usually assigned to system users temp
orarily during an upgrade to ensure that the activities and operations of SAP us
ers is not hindered, during the Upgrade. It contains all the necessary objects a
nd transactions for the users to continue their work during the upgrade. It shou
ld be withdrawn once all upgrade activities is completed, and replaced with the
now modified Roles as it has extensive authorizations than required
10) What is an X-glueb command and where do you use it in SAP security?
11) What is the disadvantage of searching for AUTHORITY-CHECK statements in ABAP
OO coding and how does SU53 deal with this?
12) In which tables can you make customizing settings for the security administr
ation and name one example of such a setting which is usefull but not SAP defaul
t?
ANS: Lock the sys against importing user assignments. SM30->PRGN_CUST->User_rel_
import = No
13) Can you use the information in SM20N to build roles and how?
Ans: When you are able to get usage history of transaction thru SM20N, why not u
se the information for re designing of roles
14) If the system raises a message that authorizations are missing but you have
SAP_ALL, what do you do?
Ans: When you get message auth are missing then add the SAP_NEW profile to the u
ser.
When new objects are added to the pre-upgrade SAP_ALL, it needs to be regenerate
d: the system first deletes the authorizations of SAP_ALL to regenerate it with
all the new ones. However, as RSUSR406 contains authority-checks, you should ens
ure that you have only a PFCG role authorized for profile generation and not onl
y SAP_ALL when doing this, or alternately use report AGR_REGENERATE_SAP_ALL.
- Transport an object to the system. During import, the system will automaticall
y regenerate SAP_ALL, unless SAP note 439753 is applied (Bernhard recently menti
oned that in another thread).
- Implement SAP note 1064621 from a different client.
15) Name any one security related SAP note and explain it's purpose or solution.
16) What are the two primary differences between a SAML token profile and a SAP
logon ticket?
17) Where do you configure the local and global settings of the CUA and what are
the consequences of inconsistent settings?
Ans: In SCUM filed attribute settings.
Eg: In logon data if I have set all the fields to GLOBAL, in the child systems P
assword reset button will be missing
Right settings: set the initial password as everywhere
18) If you have users in different systems with different user ID's for the same
person, what are your options to manage their authorizations centrally?
19) Explain the use of the TMSSUP* RFC destinations and the importance of the do
main controller?
20) Why should you delete SAP_NEW profile and which transaction should you use b
efore doing so?
25) How do you remove a developer's access and developer keys from a system? Wha
t else would you check for?
Ans: Which role grant access to S_TABU_DIS / S_DEVELOP / S_PROGRAM
Which users have access to the roles that include S_TABU_DIS
Do the users also have tcodes that enables direct access Se38,SA38
For users who have S_TABU_DIS in combination with table
access transaction, which table can the user access
Developer key: pull out the report who has access to Production developer key us
ing Devaccess
What else would you check for?
Check whether user is able to open the system with SCC4 & Se06
26) How do you transport user groups from transaction SUGR? Does this impact the
"Groups" tab in SU01 and if so, then what should you check beforehand?
Ans: in my experience user GROUPS cannot be transported. Rather you created them
locally in each client
27) When you record a transport request in PFCG for a role and then change the r
ole before releasing the transport request, does the transport include the chang
es or not? Is the answer documented anywhere in the system?
Ans: As you have not released the role. You can do n-number of changes.
Please note that Creation of transport request is just Adding the transportable,
Where as once the transport is released, the data or roles associated with the t
ransport is being placed(downloaded) in Data and Co-files.So, further if we do c
hanges, that wills be not over-written
28) Describe a scenario under which you would update a SAP table directly, and w
hich precautions you would take?
There are many scenarios where we update SAP tables directly if it is really req
uired to like custom program created to update SAP table which is used for inter
facing or upload and download. The precaution should be taken that there are no
inconsistency in the system or database due to update.
1.What is the difference between System Trace, Developer Trace and System Log?
System Trace:
If you want to record the internal SAP system activities, use the function SAP S
ystem Trace. Recording the processes in your application server enables you to m
onitor the system and facilitates troubleshooting.
Developer Trace:
Developer traces contain technical information for use in the event of problems
with your system. Using the entries in the developer traces requires a sophistic
ated knowledge of the host systems in which your SAP system is running and of th
e SAP system itself.
System Log:
You can use the log to pinpoint and correct errors occurring in your system and
its environment.
To work with system logs, choose Tools ® Administration from the R/3 initial scree
n. When the System Administration initial screen appears, choose Monitoring ® Syst
em log. Alternatively, you can choose Test ® System log from the ABAP/4 Developmen
t Workbench initial screen.
2.Incase, My sap system was down (Users are unable to login to sap system) How t
o analyze this problem?
Check if all the services of SAP, Database, SAPOSCOL are up and running.
check the wp status using dpmon.
Try restarting the workprocess., if that does not work., than try to kill some o
f the jobs. Else., restart the application Server.
3.How to import the transport request at operating system Level? When importing
a transport request, what are the common errors you faced?
tp import client U123689
RC 8 & 12
4.For example, my sap system having patch number was 8.I want to apply patch 9 a
nd 10.Mistakenly I will apply the patch directly 11 without
applying 9 and 10.How sap system will recognize this problem?
Firstly, the dependencies are checked. And without performing a test import no B
ASIS consultant would import a support pack. If you did that., than clear the OC
S queue by running OCS_RESET_QUEUE in SE37 than import SP9 and SP10. If it is JA
VA stack than no need to make changes you can directly apply SP11.
5.One user unable to execute one t-code, that is authorization object is missing
, How to add this authorization object to user?
Take the SU53 screenshot., based on the output results., you can search for auth
orizations that are existing in the system. If the authorization is available an
d you receive an approval from the concerned HOD or the concerned person., than
you can directly attach the authorization. If there is no authorization availabl
e., than the functional lead or the HOD will revert back to you saying that you
need to create the Role or make modifications in an existing role. Than do that
in DEV, transport it to QAS and PRD.
6.for example, consider a client 800.This client having 75 users. But 15 users a
ccount was locked. I want to unlock this 15 users account at
a time. How to do?
Using T-code SU10.
7.what is the use of parameter tab, and personalization tab in user master recor
d? What is the use of account id in logon tab?
8.how to change the number of work process at OS level? How to analyze the statu
s of work process at OS level?
By editing the instance profile at the OS level, you can increase the no. of wor
k processes by adding or modifying the parameter rdisp/wp_no_=
Status of a WP can be checked at the OS level by executing dpmon.
9.For example, my sap system having 4 application sersvers. How many enqueue wor
k process allowed for this sap system?
1 (you can increase them by making modifications in rdisp/wp_no_enq)
10.What is the latest version of sap kernel? Can u give me the list of kernel ve
rsions?
service.sap.com/swdc
710 (Demo version is available)
700
640
620
610 (WEB AS was introduced in this version)
4.6D
4.5
4.0
3.1
3.0
11.what are the prerequisite for before applying support packs? Shall I apply sa
p basis patch to all the system, like BW, ABAP, HR, etc.
Dependency check.... check if the new SP to be installed has any dependent copon
ents in any of the other SP's.
You must implement different SP's for different components in SAP.
12.For example, I want to transfer 50GB of data from DEV to Quality. I am using
client export and import method; can you tell me how many
hours take for client export and import? And also How many hours take for remote
client copy?
Data transfer rate depends on the H/W Configuration and N/w Speed in Remote Clie
nt copy.
13.How to perform a client import and export at OS level?
using r3trans or tp
14.What is the use of reference and service user in sap?
15.For example, I scheduled one ABAP program as a background job, But it was run
ning 10 days and above. How to analyze this problem?
what is the selection criteria?
16.How to take a sap backup using BRTOOLS explain the procedure? When using BRTO
OLS, which backup device, you are used (Drive/tape) ?
refer inist.sap file.
17.When applying a support pack to sap system. Can you tell me what are errors y
ou are faced?
18.In CUA, I am unable to changes from DEV to QAS or PRD.How to troubleshoot thi
s problem?
19.In CUA, What is the use of distribution model, partener profile, BAPI?
20.what is the user group and use in sap?
21.Example you have 6 sap application servers, I want to monitor all the applica
tion servers. How to configure a CCMS?
22.what are the configuration details of ECC6.0?
HDD, RAM, OS, DATABASE.è1.Server Configuration
HDD, RAM, OS, DATABASE.è2. System Configuration
23.What are things we have to monitor in ST02, ST06, ST04, and ST03?
We can monitor many things in the above T-codes. What exact info do u need?
24.what is the name of your output device, device type in printer?
25.Can you tell me the path in service market place for download support packs a
nd kernel?
You can create the Password exeception from the USR40 table if you have the auth
orization of DEBUGGING. Suppose you want to set that any password containing "we
lcome" will be an exception. So you can follow the below steps for creating this
as an exception:-
1. Execute the T-code SE16.
2. Insert USR40 in the Tablename field. Display the existing values over there.
3. Select any of the line item & go to debug mode by /h.
4. Select the field 'code' & change the value from 'SHOW' to 'INSR' & press F8[R
un(to cursor)].
5. Enter "*WELCOME*" in the password field & save.You will get the message as "D
atabase record successfully created".
6. Go back to SE16 & view the USR40 table again. You will find your entry as an
exception in the table.
Please find the below questions.

1.What is Role and Profile , Explain in details about the differences.
2.What are types of Roles and profiles
3.What are Master , Derived and Composite Roles
4.What are the steps to upgarde Security.
5.How do you track Missing authorizations through ST01
6.How do u get Email ids along with Business Area , Employee details
7.Please explain about 10 tables (AGR , USR)
8.How to give display authorization to a Role with PFCG T code
9.What are HR Authorizations
10.What is person , org structure and position in HR
11.What do you mean by Hirerarchy Authorizations
12.What is Infocube, Info object , Info area
13.What are analyis authorizations , Explain in detail
14.What is SRM and how do authorizations vary from MM and SRM modules
15.Explain about T codes for Material mastercreation, Vendor master
maintainance and sales order creation activities.
16.How to restrict Table level authorizations.
17.How to create portal Roles.
18.How do u create a Role and user , explain in detail
Steps For SAP Client Copy / System Refresh

Before doing a client copy, you need to prepare the following :-
1. Find the source client space with the client size custom program which can be
implemented using the rel. note:
Find the space of the client - '0118823'. This will give you the size of the sou
rce client.
2. If your are on Unix OS, adjust all the file systems according to PRD file sys
tem to fit the PRD client in DEV
client based on space requirements also.
3. You can do the client copy by remote or export/import client.
Remote method is not preferred if you are doing a large client copy.
Do a client export/import.
4. To speed up the export/import, use R3trans export/import for the clustered ta
bles.
Please find the rel. notes related to performance improvements for cluster table
s in OSS.
5. Do import and post processing.
Note: Export may take 10 to 20 hr. for 50gb of data
import may take 4 days and post import will take 8 to 15 hr. for 50gb of data. A
nd it all depends on
your system performance.
Please refer OSS rel. notes for the few RZ10 parameters which needs to be set fo
r cluster tables to speed up the process.
Note :-
If it is a fresh installation, do this --
1. SCC4 --> Create client no. and fill other details.
2. Logon to the newly created client with SAP* and PASS as password.
3. SCCL --> choose any profile (preferably SAP_ALL), source client 000 and targe
t client .
4. Preferably do a test run initially to check if it can go well.
5. As a care check space in databases.
What are step and procedure to create a client & to take a client copy from sour
ce to target.
By: Kavitha.G
If you are copying from same system then flow the below steps:
1. Create the client in Tcode scc4.
2. Before that create a logical System in BD54.
3. Login in the newly created client with
user Name : sap* and password : pass
4. Use the Tcode sccl to copy the client.if you are not familiar with the client
copy. Try a test run and then schedule it in background.
5. You can select the needed profile.
6. To view the log files use the tcode scc3.
If you are using different system then create a rfc connection in sm59.test the
connection and then continue from the 1st step
You can also import and export a client. Use scc7 for importing from the client
and scc8 fro exporting from the source client
What is system refresh when and why it is done?
The system refersh is nothing but the deletion of the client and replacing the d
ata from other client. For example : you have clients 100, 200 and 300. Suppose
when you want to refresh the client 100 you remove the client 100 and replace it
with 200 0r 300 as per your reqiurement. Mostly the refresh of clients will be
happen at the time of development stage.
System Refresh is a simplified term to Client Copy. Client Copy means copying th
e production client on to the quality to test the real data. As recommend by SAP
this need to carried out every 3 months.
The process to carry out the same is as follows:
1. Create a client on quality system using txn scc4
2. Create a RFC between Production system and Quality System (need to create on
quality system)
3. Login to the newly created client using sap* and pass as a password
4. Txn sccl to start the client copy. You can test the client copy by selecting
the test run option. (test run will estimate the time taken for the activity).
Interview Q&A
1.what is cua and how to configure it?
2.what is child and parent role?
3.what is role and profile?
4.how many types of users?
5.how to create role?
6.how to custamize the t code?
7.what we do in suim?
8.what is audit log?
9.how to solve the user problmes?
10.how to analyze the t- code and user in the sytem
how is the transaction PFUD?
how is the transaction SUIM?
When we create a request which way it goes?
What's inside an Object?
What is the Virsa?
Why can not we add a transaction that creates conflicts for a particular user?
Transaction in which we add objects within a specific transaction?
What is SOD?
THOMSON REUTERS
Qualifications
Education:
Bachelor's degree in Computer Science or other related field.
4 years of SAP Basis/Netweaver experience which includes
Required Skills:
? 4 years in SAP Implementations and Operational Support
? 4 years experience in SAP ERP Implementation and Support
? 2 years experience in SAP J2EE Administration and Troubleshooting
? 2 years in supporting Oracle or DB2 databases in SAP installations
? 2 years hands-on experience in UNIX/Linux
Some Important Basis Q&A
System Trace:
If you want to record the internal SAP system activities, use the function SAP S
ystem Trace. Recording the processes in your application server enables you to m
onitor the system and facilitates troubleshooting.
Developer Trace:
Developer traces contain technical information for use in the event of problems
with your system. Using the entries in the developer traces requires a sophistic
ated knowledge of the host systems in which your SAP system is running and of th
e SAP system itself.
System Log:
You can use the log to pinpoint and correct errors occurring in your system and
its environment.
To work with system logs, choose Tools ® Administration from the R/3 initial scree
n. When the System Administration initial screen appears, choose Monitoring ® Syst
em log. Alternatively, you can choose Test ® System log from the ABAP/4 Developmen
t Workbench initial screen.
Check if all the services of SAP, Database, SAPOSCOL are up and running.
check the wp status using dpmon.
Try restarting the workprocess., if that does not work., than try to kill some o
f the jobs. Else., restart the application Server.
tp import client U123689
RC 8 & 12
nd 10.Mistakenly I will apply the patch directly 11 without
applying 9 and 10.How sap system will recognize this problem?
Firstly, the dependencies are checked. And without performing a test import no B
ASIS consultant would import a support pack. If you did that., than clear the OC
S queue by running OCS_RESET_QUEUE in SE37 than import SP9 and SP10. If it is JA
VA stack than no need to make changes you can directly apply SP11.
Take the SU53 screenshot., based on the output results., you can search for auth
orizations that are existing in the system. If the authorization is available an
d you receive an approval from the concerned HOD or the concerned person., than
you can directly attach the authorization. If there is no authorization availabl
e., than the functional lead or the HOD will revert back to you saying that you
need to create the Role or make modifications in an existing role. Than do that
in DEV, transport it to QAS and PRD.
ccount was locked. I want to unlock this 15 users account at
a time. How to do?
Using T-code SU10.
By editing the instance profile at the OS level, you can increase the no. of wor
k processes by adding or modifying the parameter rdisp/wp_no_=
Status of a WP can be checked at the OS level by executing dpmon.
1 (you can increase them by making modifications in rdisp/wp_no_enq)
rsions?
710 (Demo version is available)
700
640
620
610 (WEB AS was introduced in this version)
4.6D
4.5
4.0
3.1
3.0
Dependency check.... check if the new SP to be installed has any dependent copon
ents in any of the other SP's.
You must implement different SP's for different components in SAP.
client export and import method; can you tell me how many
hours take for client export and import? And also How many hours take for remote
client copy?
Data transfer rate depends on the H/W Configuration and N/w Speed in Remote Clie
nt copy.
using r3trans or tp
what is the selection criteria?
refer inist.sap file.
ou are faced?
s problem?
1.Server Configuration?HDD, RAM, OS, DATABASE.
2. System Configuration? HDD, RAM, OS, DATABASE.
We can monitor many things in the above T-codes. What exact info do u need?
nd kernel?
a) Check Database status
b) SAP services
c) SAP Management console (Dispatcher, IGS and Message Server)
d) On the basis of point at serial no (c), you need to findout trace root
e) If all are ok, check network connectivity
nd 10.Mistakenly I will apply the patch directly 11 without applying 9 and 10.Ho
w sap system will recognize this problem?
If case there is some dependency, system will prompt an error for pre-requisite
while importing Patch
Use Tcode:PFCG, Click on Authorisation, Change Authorisation Data, Click on sear
ch to check for authorization object, add the value
ccount was locked. I want to unlock this 15 users account at a time. How to do?
Use Tcode: SU10 for mass changes
rsions?
Latest version is 196, You check status of sap version, login SAP GUI, click on
status, click on other Kernel info
You need to check dependency before applying, SPAM should be latest, then SAP Ba
sis, APPL, ABA , after ward another patches
client export and import method; can you tell me how many hours take for client
export and import? And also How many hours take
for remote client copy?

Use Tcode: SCC7, SCC8, you need to copy request file from Dev to Quality.
Use Tcode: SM50
ou are faced?
Q locked, Dependency Patch not implemented
s problem?
HDD, RAM, OS, DATABASE.è1.Server Configuration
HDD, RAM, OS, DATABASE.è2. System Configuration
http://benstudycenter.blogspot.com/2008/02/user-groups.html
nd kernel?
Click on Support Packages and Patches->My Company's Application Components/? SAP
ERP?/ SAP ERP 2004/? Support package stack/ Support package stack à ECCà Next StepàSe
lect SAP KERNEL 6.40 32-BIT for SAP ECC Server (From SP000 to SP101) / MS SQL Ser
ver and Database Independent àNext Step
By: Shailesh Singh | 11 Jul 2010
You can refer http://pragyarawal.blogspot.com/ for more java interview questions
.
By: | 21 Jul 2010
ANSWER for some Unanswered questions
14. a) Reference user is user to to provide the Authorization uo another user
b)Service user no change password .EG . if u created user as dialog .at first lo
gin u have to change the pwd. but in service user no need
15. Due to program Error inform to developer to correct the program
20.User group is user to Group the User.it is crated in T.Code-SUGR
25. service.sap.com/swdc/support package /my company applications
http://www.wikinewforum.com/showthread.php?t=26500

Sap Basis

Încărcat de

Informații document

Descriere originală:

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Sap Basis

Încărcat de

Drepturi de autor:

Formate disponibile

1)How many Single roles can be added in one Composite role ?

What is use Of SHDB

how to add abap role to portal users?

What is the correct procedure for Mass Generation of Roles?

how to adjust user master records?

how to create new authorization object?

which ticketing tool you are using?

I want to see list of roles assigned to 10 different users.how do you do it?

What is an Authorization Group

You can mitigate it at two levels-

Please find the below questions.

Steps For SAP Client Copy / System Refresh

Some Important Basis Q&A

13.How to perform a client import and export at OS level?

S-ar putea să vă placă și