Webclass 36: SAP SOD - Who has access to what versus Who did what?

Q1. What are the three methods for reviewing SOD that Claire mentions?

Who has which access?

Correct Incorrect Correct answer

Who used which access?

Correct Incorrect Correct answer

Who used which access in the same document flow?

Correct Incorrect Correct answer

SAP GRC

Correct Incorrect Correct answer

Q2. What does SAP check when you try to use a transaction code?

Whether or not you have the role or profile that mentions the transaction code

Correct Incorrect Correct answer

Whether or not you have the objects that are necessary for the transaction code

Correct Incorrect Correct answer

Whether or not each of those objects has all the necessary authorization fields and values that are required for that transaction code and that are specified for the Authorization

Correct Incorrect Correct answer

Whether or not your access is found in the separation of duties matrix

Correct Incorrect Correct answer

Q3. Why is it not enough to audit the roles that the user has access to in SAP?

Because users can also be assigned access directly by profiles

Correct Incorrect Correct answer

Because users can also be assigned access directly to a transaction code, without going through a role or a profile

Correct Incorrect Correct answer

Actually, it is enough to only review roles because the role is what determines which transaction codes the user has access to

Correct Incorrect Correct answer

Q4. Which SAP table tells you if the user is active or inactive?

USR02

Correct Incorrect Correct answer

UST04

Correct Incorrect Correct answer

Q5. Why is it not enough to only consider the profiles that are mentioned per user in UST04?

Because one profile can be a parent of another profile, that can be a parent of other profiles, etc. So to get all profiles, we need to use UST10C to unravel the hierarchical table structure

Correct Incorrect Correct answer

Actually, it is enough to only use UST04, because UST04 lists all users and their profiles

Correct Incorrect Correct answer

Q6. Why is it not enough to only consider the roles that are mentioned per user in AGR_USERS?

Because one role can be a parent of another role, that can be a parent of other roles, etc. So to get all the roles that a user has access to, we also need to user AGR_AGRS to unravel the hierarchical table structure.

Correct Incorrect Correct answer

Actually, it is enough to only use AGR_USERS, because AGR_USERS lists all the users and their roles

Correct Incorrect Correct answer

Q7. Which two tables help us to see the objects and authorization values that are required for each transaction code?

TSTCA

Correct Incorrect Correct answer

USOBT_C

Correct Incorrect Correct answer

TSTCT

Correct Incorrect Correct answer

Q8. What is the difference between “Authorization”, “Authorization FIELD” and “Authorization VALUE”?

An "Authorization" is coupled with the Authorization object in order to let us know in UST12 table, which transaction codes a user has; An "Authorization FIELD" is the type of value that the authorization value refers to, for example "BUKRS" for company code, "TCD" for transaction code or ACTVT for activity (such as read, write, display); An "Authorization value" is the actual value, for example NG01 for the company Nigeria 01 or VA01 for the transaction code to create sales orders.

Correct Incorrect Correct answer

An "Authorization" is the value, for example company code NG01 or transaction code VA01; An "Authorization FIELD" is the type of authorization and an "Authorization VALUE" tells you if you can read, write or display using the transaction code.

Correct Incorrect Correct answer

Q9. How could you use the BKPF general ledger table to do a 10 minute quick SOD test?

1/ Make a summary from BKPF of fields USER and TCODE; 2/ Make a copy of the result of 1; 3/ Join MANY (ACL) or INNER JOIN (SQL) between the result of 1 and 2 based on USER; 4/ Compare the fields TCODE and TCODE2 from the result of 3 to the SOD matrix to see if there are any users that have used a pair of transaction codes that are in conflict.

Correct Incorrect Correct answer

Join the BKPF table to the SOD matrix, based on TCODE

Correct Incorrect Correct answer

Q10. Why is it not enough to only use the BKPF table to compare to the SOD matrix?

Because the BKPF table is only the general ledger transactions, so any transactions that do not result in the creation of a journal entry, such as the creation of sales orders, purchase orders, suppliers, customers, articles, etc. will not be found in the BKPF table.

Correct Incorrect Correct answer

Because the BKPF table is only the general ledger transactions and only transactions relating to the direct entry of journal entries will be contained in the BKPF table

Correct Incorrect Correct answer

Webclass 36: SAP SOD – Who has access to what versus Who did what?

Webclass 36: SAP SOD – Who has access to what versus Who did what?

admin June 9, 2026

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question