SAP P_ADMSEC_731 問題集

質問 1：
Which of the following statements regarding the authority-check are true? Note: There are 2 correct
answers to this question.
A. The authority-check as part of the ABAP source code cannot be deactivated without changing the
program.
B. The authorization object: S_TCODE is checked by the kernel and not by the function module:
authority-check.
C. If you set the profile parameter: auth/object_disabling_active to "Y" you deactivate authorization checks
globally.
D. To find out if authority-checks were deactivated, you can compare table USOBX with the
corresponding customer table.
正解：B,D

質問 2：
Which of the following statements regarding business roles and technical roles in the SAP NetWeaver
Identity Management are true?
Note: There are 2 correct answers to this question.
A. Business roles are known in the identity store as well as in the connected backend systems.
B. Roles can be set up in hierarchies in the identity store.
C. Technical roles are known in the identity store as well as in the connected backend systems.
D. Business roles can represent the business task of an employee.
E. Business roles are system specific and will be uploaded from the backend systems.
正解：C,D

質問 3：
Which of the following is a characteristic of the Segregation of Duties (SOD) principle?
Note: There are 2 correct answers to this question.
A. The SOD principle is a preventive control.
B. Enforcing the SOD principle means that no single individual can carry out a critical task that could
prove to be corruptive to the company.
C. The SOD principle is a detective control.
D. Enforcing the SOD principle means that individuals are capable of performing the tasks for different
roles, rather than depending on just one individual.
正解：A,B

質問 4：
The Central User Administration (CUA) allows you to maintain some of the following centrally, for all
clients connected to the CUA. What can be maintained centrally? Note: There are 2 correct answers to
this question.
A. User logon permissions to clients
B. Lock status of users
C. Initial and changed passwords
D. Replication of authorization profiles
E. Complete definitions of "User Roles"
正解：A,B

質問 5：
Which of the following authentication mechanisms are available for SAP NetWeaver AS Java?
Note: There are 3 correct answers to this question.
A. SAP Logon Tickets for Single Sign-On
B. Web Dynpro for Single Sign-On
C. Security session IDs for Single Sign-On between applications
D. SAML Assertions for Single Sign-On
E. Kerberos Authentication for Single Sign-On
正解：A,C,D

質問 6：
Which of the following interoperability profiles addresses transport security, Simple Object Access
Protocol (SOAP) messaging security, and other security considerations?
A. Message security profile
B. Authentication security profile
C. Authorization security profile
D. Basic security profile
正解：D

質問 7：
When is it acceptable not to take action on an identified risk?
A. Never. Good security has to address and reduce all risks.
B. When political issues prevent this type of risk from being addressed.
C. When the necessary countermeasure is too complex.
D. When the cost of the countermeasure outweighs the value of the asset and the potential loss.
正解：D

質問 8：
Which of the following statements are true for user master records and authorization profiles in clients of
SAP systems? Note: There are 2 correct answers to this question.
A. It is not possible to include an authorization profile into a composite role directly.
B. The name of an authorization profile can be changed using the role maintenance transaction (PFCG).
C. A user master record can be generated from the role maintenance transaction (PFCG).
D. An authorization object can be assigned to a user master record.
正解：A,B