According to the SAP Help Portal1, one of the ways to specify on which system and client the control is executed is to assign a risk definition to the control for the desired system. The risk definition contains the connector information that determines the system and client where the control runs. Therefore, A is the correct answer. B, C, and D are not valid ways to specify the system and client for control execution, as they are related to other aspects of control configuration, such as approval, reporting, and rule set assignment. Reference: 1 https://help.sap.com/doc/e2ccae7ee6354b169cf845cd665e07fe/1.0%202016-07/en-US/frameset.htm?frameset.htm

According to the SAP Training Course GRC3001, some of the settings that can be configured in both the global and system-specific provisioning configurations are: Account Validation Error (A), Send Password , and Deactivate Password (E). These settings control how the user accounts are validated, created, and deactivated during provisioning. Therefore, A, C and E are the correct answers. B and D are not valid settings for both global and system-specific provisioning configurations, as they are related to other aspects of provisioning, such as role delimitation and assignment type. Reference: 1 https://training.sap.com/course/grc300-sap-access-control-implementation-and-configuration-classroom-018-g-en/

According to the SAP Help Portal1, some of the required steps to create a role in SAP Access Control are: Define a Business Process (A), Define a Role Methodology (B), and Define a Naming Convention (E). These steps help to organize and standardize the role design and maintenance process. Therefore, A, B and E are the correct answers. C and D are not required steps for creating a role in SAP Access Control, as they are related to other aspects of role management, such as role owners, approvers, and project release. Reference: 1 https://help.sap.com/doc/e2ccae7ee6354b169cf845cd665e07fe/1.0%202016-07/en-US/frameset.htm?frameset.htm

According to the SAP Blogs1, when using Business Role Management, two of the events that should be mapped to the target development system as default are Role Generation and Authorization Maintenance. These events are related to the creation and modification of roles in the development system. Therefore, A and C are the correct answers. B and D are not valid events for Business Role Management, as they are related to other scenarios, such as Access Risk Analysis and Provisioning. Reference: 1 https://blogs.sap.com/2019/03/14/sap-access-control-12-role-certification/

According to the SAP Press blog2, some of the available alert capabilities that can be configured in SAP Access Control are identifying a user who has executed conflicting functions, identifying a user who has executed a critical action and opening a support desk message, and identifying a user who has executed a critical action and generating an email notification. These alerts help to monitor and manage compliance by notifying the relevant parties about potential access risks or violations.