What must you do if you want to enforce an additional authorization check when a user starts an SAP transaction?

Question

Options

• AAssign authorization object S_START to the chosen transaction code with transaction SU24 and
• BAssign the authorization object to be checked to the chosen transaction code in the SAP Default
• CAssign the authorization object and permissions to the chosen transaction code using transaction
• DAssign the authorization object to be checked to the chosen transaction code with transaction

• A
  5% (1)
• B
  5% (1)
• C
  82% (18)
• D
  9% (2)

Explanation

Option C is correct because enforcing an additional authorization check at transaction startup requires two steps done together: assigning the authorization object and configuring its field values/check indicator to the transaction code - which transaction SU24 facilitates by linking objects with their proposed permission values and marking them as "Check" (enforced).

Why the distractors fail:

• A is wrong because S_START is not a valid SAP authorization object for this purpose - the standard transaction-access object is S_TCODE, and simply assigning a fictitious object name accomplishes nothing.
• B is wrong because the "SAP Default Authorization" (profile/proposal values) only provides suggestions that role builders may accept or ignore - it does not enforce a check at startup.
• D is wrong because it only assigns the authorization object to the transaction but omits configuring the field values/permissions alongside it, leaving the check incomplete or ineffective.

Memory tip: Think of SU24 as the "gatekeeper configurator" - it doesn't just name what to check (object), it also defines what values are allowed (permissions) and whether the check is enforced (check indicator set to "Check"). All three elements together = enforcement. If any piece is missing, the gate doesn't lock.

No community discussion yet for this question.