CIS-HR Practice Test 24 — 15 Questions

Question 1

Which role is necessary to perform 'HR Case' deletions?

Accepted Answer

hr_admin. Deletion is a high-risk operation, typically reserved for the 'hr_admin' or 'admin' role.

Answer

hr_task_writer

Answer

sn_hr_core.reader

Answer

itil

Question 2

Which TWO of the following are examples of 'HR Scoped Roles'?

Accepted Answer

sn_hr_core.case_writer. These roles are prefixed with 'sn_hr_core' (or similar scope identifier).

Answer

itil

Answer

security_admin

Answer

user_admin

Question 3

Which of the following is true regarding 'HR Scoped Roles'?

Accepted Answer

They must be prefixed with 'sn_hr_core'. Scoped roles are contained within the application scope, preventing global role collision.

Answer

They automatically grant access to global tables

Answer

They are automatically assigned to all users

Answer

They can only be created by the system administrator

Question 4

What is the benefit of using 'HR Criteria' instead of hard-coded ACL scripts?

Accepted Answer

It allows non-developers to manage complex security rules. HR Criteria is maintainable, reusable, and configurable by HR Admins without requiring deep scripting knowledge.

Answer

It is faster to execute

Answer

It replaces the need for roles

Answer

It forces the system to use encryption

Question 5

If a user is assigned to multiple 'HR Security Profiles', how does the system determine the final access level?

Accepted Answer

The system evaluates all assigned profiles (additive). ServiceNow security profiles are typically evaluated using an 'OR' logic for access (if any profile grants access, it is granted) or additive restrictions.

Answer

It errors out until only one is left

Answer

It uses the most restrictive profile

Answer

It uses the first one created

Question 6

Which THREE of the following are types of HR Criteria?

Accepted Answer

Department Criteria. HR Criteria can be based on users, locations, or departments.

Answer

Group Criteria

Answer

Role Criteria

Question 7

Which 'HR Security Profile' setting defines whether the profile is active?

Accepted Answer

The 'Active' boolean field. The 'Active' checkbox on the profile record controls its participation in security evaluations.

Answer

The 'Access' checkmark

Answer

The 'Profile Status' field

Answer

The 'Enable' button in the related link

Question 8

Which TWO of the following are valid ways to secure sensitive HR data on the platform?

Accepted Answer

Access Control Lists (ACLs). ACLs and Field Level Encryption (or Scoped Data Protection) are the primary security tools for HR data.

Answer

HR Criteria

Answer

Business Rules

Answer

User Criteria

Question 9

What is the impact of checking 'Enforce HR Security' on a table in the 'HR Scoped App'?

Accepted Answer

It enables HR Security Profile evaluation for the table. Enabling this flag forces the system to evaluate HR Security Profiles for every read operation on that table.

Answer

It automatically encrypts the data

Answer

It requires all users to have the 'hr_admin' role

Answer

It makes the table public

Question 10

If a user has the 'sn_hr_core.case_writer' role, what can they do?

Accepted Answer

Create and update HR cases. This role allows for the creation and editing of HR cases, but not necessarily configuration.

Answer

Modify system security settings

Answer

Delete HR cases

Answer

Configure HR Service workflows

Question 11

Which THREE of the following are benefits of using 'Scoped Applications' for HR?

Accepted Answer

Easier updates. Isolation, security, and maintainability are the primary benefits of scoped HR applications.

Answer

Unlimited storage

Answer

Automatic role assignment

Question 12

Which THREE of the following are required to successfully implement 'Field Level Encryption'?

Accepted Answer

Field identification. You need the encryption module, the key, and the field definition.

Answer

HR Service definition

Answer

User Criteria

Question 13

What is the function of the 'Restricted Caller Access' (RCA) records?

Accepted Answer

To manage cross-scope access between applications. RCA records manage cross-scope access, ensuring that applications only communicate with authorized tables/fields.

Answer

To restrict admin users

Answer

To limit user access to apps

Answer

To define portal layout

Question 14

Which TWO of the following are true about 'HR Scoped Roles'?

Accepted Answer

They can be assigned to anyone. Scoped roles are confined to the application and follow specific naming conventions.

Answer

They override system admin roles

Answer

They are available globally

Answer

They are automatically updated by ServiceNow

Question 15

You are auditing your instance and find that unauthorized users are able to read HR Profile records. After verifying that no ACLs are broken, what is the next most likely source of this data exposure?

Accepted Answer

Before Query Business Rules. Business Rules with 'query' operations (Before Query Business Rules) act as a filter at the database level and can accidentally expose data if not properly scoped.

Answer

UI Actions

Answer

Workflow Properties

Answer

Client Scripts