SAP Certified Associate C_SEC_2405 Book

A decentralized treble control strategy for user and role maintenance in a production system involves distributing responsibilities to ensure segregation of duties. One user administrator per production system is recommended to manage user master records, ensuring centralized control over user creation and assignment within each system. One authorization data administrator is responsible for maintaining authorization objects and values within roles, ensuring that permissions are correctly defined. One decentralized role administrator handles role creation and assignment, allowing flexibility across different business units or applications while maintaining oversight. Having one user administrator per application area (option A) is too granular and risks inconsistency in a production system. A single authorization profile administrator (option C) is not ideal, as profile generation is typically automated within PFCG, and the role is less distinct in a decentralized strategy. This treble control approach enhances security by preventing any single individual from controlling all aspects of access, aligning with SAP’s best practices for governance and compliance.

In SAP systems, table authorization groups are controlled using views V_DDAT_54 and V_BRG_54. V_DDAT_54 is a maintenance view that allows administrators to assign tables to authorization groups, defining which groups protect specific tables and ensuring that access is restricted to authorized users. V_BRG_54 is another view used to manage table authorization groups, particularly for assigning and maintaining group definitions that link to authorization objects like S_TABU_DIS. These views enable granular control over table access, supporting data security and compliance. PRGN_CUST is a customizing table for role and authorization settings, not specifically for table authorization groups, and SSM_CUST is related to system settings, not table access control. By using V_DDAT_54 and V_BRG_54, SAP provides a structured approach to managing table authorizations, ensuring that sensitive data in tables is protected against unauthorized access while allowing efficient administration of access controls.

In SAP Access Control, User Access Review and Role Reaffirm are functions used to approve or reject a user’s continued access to specific security roles. User Access Review allows managers or administrators to periodically review and certify user role assignments, ensuring that access remains appropriate for current job functions. This process involves approving or rejecting access based on business needs, supporting compliance with security policies. Role Reaffirm, similarly, requires periodic certification of role assignments, enabling administrators to confirm or revoke user access to specific roles to prevent unauthorized permissions. SOD (Segregation of Duties) Review focuses on identifying conflicts in role assignments, not approving user access, and Role Certification is not a standard term in SAP Access Control, though it may be confused with Role Reaffirm. These functions ensure ongoing governance of access rights, reducing risks and maintaining compliance in SAP systems by ensuring only authorized users retain access to critical roles.