Webclass 97: Which SOX ITGC controls can we automate?

Q1. What different types of data do we need to consider for SAP?

Configuration data, master data, transactional data

Correct Incorrect Correct answer

Customer and vendor master data and journal entries

Correct Incorrect Correct answer

Q2. Do we need to consider all of COBiT when designing a controls matrix for SOX ITGC?

No, we only need to consider those systems that are supporting material business processes

Correct Incorrect Correct answer

Yes, if we choose to base our approach on COBiT then we have to show that we follow it completely

Correct Incorrect Correct answer

Q3. Does SAP guarantee unalterability of data?

Not necessarily, because data can be updated through SE16N developper access or through malicious ABAP code

Correct Incorrect Correct answer

Yes, SAP prevents alterability, because you cannot change data, as you can in SAP

Correct Incorrect Correct answer

Q4. If we see GAPS in the numbering of journal entry documents in SAP, is that an indication that someone has updated the data through a data fix?

Not necessarily because in SAP, parked documents also get an internal incremental number and these parked documents may be later deleted

Correct Incorrect Correct answer

Yes, because SAP always automatically assigns an incremental system number to ensure that there are no gaps

Correct Incorrect Correct answer

Q5. How can you find out which tables are used in SAP configuration?

/SPRO-> Click on customization area-> click on change log-> click on logging display status

Correct Incorrect Correct answer

/SE84-> Enter key word

Correct Incorrect Correct answer

Q6. How can you see the relationship between tables in SAP?

/SLDB->enter table name-> select database->select structure->select display

Correct Incorrect Correct answer

/SE84-> select transactions and enter key words

Correct Incorrect Correct answer

Q7. How can you find out which tables are used by a program?

/SE38-> Enter program name-> select source code-> look at table list at the top and also mentioned in SUBMIT, CALL FUNCTION or CALL TRANSACTION, etc.

Correct Incorrect Correct answer

/SE11-> Enter table -> Click on where used button-> select programs

Correct Incorrect Correct answer

Q8. Why might you check the status of ALE documents?

To ensure the good monitoring of interfaces between modules/ systems

Correct Incorrect Correct answer

To check if there are unauthorized batches

Correct Incorrect Correct answer

Q9. Which table is useful for seeing information about batches?

BDCLM

Correct Incorrect Correct answer

S_BDC_MONI

Correct Incorrect Correct answer

Q10. Do all SAP systems log changes?

No, it depends if logging is turned on SCC4

Correct Incorrect Correct answer

Yes, logging is inherent to the SAP system

Correct Incorrect Correct answer

Q11. Which table determines if changes to a configuration table will be logged?

DD09L

Correct Incorrect Correct answer

DBTABLOG

Correct Incorrect Correct answer

Q12. Is it possible to delete Change Documents for business transactions?

Yes, they can be deleted using programs RSCDOK91, RSCDOK95 and RSCDOK99

Correct Incorrect Correct answer

No, change document logs are protected in the SAP system

Correct Incorrect Correct answer

Q13. What is the main risk relating to change management?

Upload of malicious code into the SAP system that may be used for unauthorized business logic, modification of business and configuration data, denial of service, identity theft, etc.

Correct Incorrect Correct answer

Changes that are not delivered on time

Correct Incorrect Correct answer

Q14. Are all changes to the system logged?

No, it depends if logging is turned on in SCC4

Correct Incorrect Correct answer

Yes all changes are logged and the logs are protected in SAP

Correct Incorrect Correct answer

Q15. Where can we find information about transport requests?

In tables E070, E071K and in the transport_directory

Correct Incorrect Correct answer

In the SQL database

Correct Incorrect Correct answer

Q16. What are standard users?

The default users that are used for implementation of the system, such as SAP*

Correct Incorrect Correct answer

Dialog users, type A

Correct Incorrect Correct answer

Q17. Where can we see the list of emergency users?

RSUSR100

Correct Incorrect Correct answer

USOBX_C

Correct Incorrect Correct answer

Q18. Where can authorization checks be truned off?

At the system level, at the authorization object level and for specifically listed transaction codes

Correct Incorrect Correct answer

At the system level only

Correct Incorrect Correct answer

Q19. Why should we check the presence of RFCs

Because an RFC is a back-door into the SAP system: it is used for ALE, BAPI and Transports

Correct Incorrect Correct answer

Because RFC can cause users to have separation of duties conflicts for certain transaction codes

Correct Incorrect Correct answer

Q20. Do we have to do SOX ITGC audit if a business process is supported by an information system that is managed by an outsourced service provider?

No we would rather obtain a SAS70

Correct Incorrect Correct answer

Yes, we still need to do SOX ITGC

Correct Incorrect Correct answer

Webclass 97: Which SOX ITGC controls can we automate?

Webclass 97: Which SOX ITGC controls can we automate?

admin June 9, 2026

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question

19. Question

20. Question