Free c-sec-2405 sample questions

Correct answer: SCUM

Transaction SCUM (Central User Administration - System Landscape) is the primary tool for managing the CUA landscape. Within SCUM, the 'Field distribution' tab allows an administrator to specify for each user master data field whether it should be maintained globally (in the central system only), locally (in child systems), or proposed from the central system. This is crucial for enforcing consistent user data across the landscape.

Correct answers: Generate a Personal Security Environment (PSE) for each system and exchange their public key certificates.; Set the profile parameters for the SNC library path and the distinguished name for each system.

Each system needs its own SNC PSE, which contains its private key and public key certificate. For the systems to trust each other, the public key certificate of each system must be imported into the other system's PSE certificate list.

Profile parameters like `snc/gssapi_lib` (pointing to the cryptographic library) and `snc/identity/as` (defining the system's SNC name) must be set on both systems to enable SNC and identify the systems to each other.

Correct answer: All future changes made to the table via standard maintenance transactions (like SM30) will be recorded.

Activating table logging causes the system to record changes (inserts, updates, deletes) made to the table data. This logging is primarily triggered by standard maintenance transactions. The logs can then be analyzed using transaction SCU3. It does not log read access or changes made via native SQL.

Correct answer: To identify and adjust PFCG roles affected by changes in authorization objects and default values between ECC and S/4HANA.

Transaction SU25 is crucial for post-upgrade authorization adjustments. Steps 2a, 2b, and 2c are used to compare the authorization default values (from SU24) of the old release with the new S/4HANA release. This process helps administrators identify which of their existing PFCG roles contain transactions with changed authorization data, allowing them to manually review and merge the new defaults to ensure the roles function correctly in S/4HANA.

Correct answer: False

False. The recommended best practice in SAP S/4HANA Cloud, Public Edition, is to copy the standard business role templates provided by SAP and then adjust the copy. This approach ensures that the role is based on a tested and supported foundation, simplifies future upgrades, and leverages the pre-configured business catalogs and applications associated with the template.

Correct answer: Activating the relevant SICF services and exchanging metadata between the SAP Gateway (acting as SP) and the corporate IdP.

SAML 2.0 integration relies on a trust relationship established by exchanging metadata. The SAP Gateway system acts as the Service Provider (SP). Its SP metadata must be exported and given to the Identity Provider (IdP). Conversely, the IdP's metadata must be imported into the SAP system (using transaction SAML2). Additionally, the core SICF services for SAML processing (`/sap/public/bc/sec/saml2` and `/sap/bc/webdynpro/sap/saml2`) must be active.

Correct answer: The authorization data for the role has been changed, and the profile needs to be generated.

In transaction PFCG, a yellow status light on the Authorizations tab indicates that the authorization data has been modified (e.g., by adding new transactions or manually changing objects) but the corresponding authorization profile has not yet been generated. The administrator must enter the authorization data in expert mode to maintain the values and then generate the profile, which will turn the light green.

Correct answer: To define which external programs are allowed to register on the Gateway and which hosts can start external programs.

The `reginfo` (registration info) file controls which external RFC server programs are allowed to register themselves with the SAP Gateway using a specific Program ID. The `secinfo` (security info) file defines which clients (based on host and user) are permitted to start external programs via the Gateway. Together, they form a critical access control list (ACL) for protecting the Gateway from unauthorized external program execution and registration.

Correct answer: SUIM

The User Information System (SUIM) is a powerful reporting toolset designed for comprehensive authorization analysis. It allows administrators to run a wide variety of reports, such as finding users by role or profile assignment, finding roles that contain a specific authorization object, or even searching for users who have an authorization object with a particular value. It is the primary tool for this kind of analysis.

Correct answer: IAS acts as an Identity Provider for authentication and SSO, while IPS manages the lifecycle and replication of users and groups to target systems.

This correctly separates the functions. The Identity Authentication service (IAS) is a cloud-based Identity Provider (IdP) that handles user login, SSO, MFA, and trust relationships. The Identity Provisioning service (IPS) is responsible for identity lifecycle management; it reads users and groups from a source system (like a corporate directory) and provisions (creates, updates, deletes) them into various target systems (both cloud and on-premise).