What must you do before you can use transaction PFCG? Note: There are 2 correct answers to this question. What must you do before you can use transaction PFCG? Note: There are 2 correct answers to…

Question

Options

• AFill tables USOBT and USOBX with the SAP-delivered authorization default values.
• BFill tables USOBT_C and USOBX_C with the SAP-delivered authorization default values.
• CSet the system profile parameter auth/no_check_in_some_cases to Y.
• DSet the system profile parameter auth/no_check_in_some_cases to N.

• A
  75% (40)
• B
  15% (8)
• D
  9% (5)

Explanation

Before PFCG (the Profile Generator) can function correctly, two prerequisites must be in place. First, tables USOBT and USOBX (A) must be loaded with SAP's delivered authorization defaults - these are the source SAP standard tables that define which authorization objects belong to which transactions, and PFCG's proposal mechanism depends on this data being present. Second, the profile parameter auth/no_check_in_some_cases = Y (C) must be set, which tells the system to honor the "Do Not Check" indicators stored in the authorization default tables; without this, PFCG cannot accurately generate minimal, proposal-based role authorizations.

Why B is wrong: USOBT_C and USOBX_C are the customer-modifiable copies of those tables - they are populated from the SAP standard tables (USOBT/USOBX) via transaction SU25, not filled directly with SAP defaults. Confusing the _C (customer) suffix with the base SAP tables is a classic exam trap.

Why D is wrong: Setting auth/no_check_in_some_cases = N forces all authorization objects to be checked unconditionally, bypassing the check-indicator logic that PFCG relies on - the exact opposite of what's needed.

Memory tip: Think "SAP Standard first, then Customer copy" - USOBT/USOBX (no suffix = SAP standard) must exist before the _C customer tables can be derived. And remember Y = "Yes, trust the check indicators", which is what PFCG needs.

No community discussion yet for this question.