CIS-HR Hard Questions — 25 Difficult Questions

Question 1

What is the purpose of the 'sn_hr_core_topic_category' table?

Accepted Answer

Organize HR Services. This table is used to organize HR Services into logical groupings, which are then used for reporting and portal navigation.

Answer

Define HR roles

Answer

Store HR cases

Answer

Manage HR templates

Question 2

Which component is responsible for orchestrating multiple HR activities, such as sending emails, creating tasks, and setting due dates, in a sequence?

Accepted Answer

Lifecycle Event. Lifecycle Events are designed to manage complex, multi-step processes involving cross-departmental tasks.

Answer

Assignment Rule

Answer

HR Service

Answer

Catalog Item

Question 3

If an HR Service requires a specific document, how should this be linked?

Accepted Answer

Using an HR Task of type 'e-Signature'. Document Templates are linked to HR Services via the HR Service configuration.

Answer

Using an Assignment Rule

Answer

Through a catalog variable

Answer

Via the HR Case Template

Question 4

An organization requires that HR case data be encrypted at rest. What platform feature must be enabled?

Accepted Answer

Column Level Encryption (CLE). Column Level Encryption (CLE) is the platform feature that encrypts specific columns in a table, ensuring data at rest is encrypted. For HR case data, enabling CLE on the relevant fields (e.g., case description) satisfies the encryption at rest requirement. CLE uses the platform's encryption capabilities to protect sensitive data.

Answer

Contextual Security

Answer

Access Control Lists

Answer

HR Criteria

Question 5

Which THREE steps are necessary to ensure that HR criteria correctly restrict access to an Employee Center topic?

Accepted Answer

Apply the HR Criteria to the Topic record within the Employee Center configuration. Option B is correct because the HR Criteria must be attached directly to the Topic record in the Employee Center configuration so the topic is scoped to the intended audience. Option D is correct because the 'Available for' field on the Topic record must be populated; without it, the topic is not exposed to any audience and the HR Criteria cannot restrict access as intended. Option E is correct because a custom HR Criteria record defining the target audience must exist before it can be applied to the topic. Option A is not required because global ACLs on the topic table govern table-level access, not Employee Center topic audience restriction. Option C is not required because HR Criteria evaluation runs automatically and does not need to be manually triggered to enforce topic access.

Answer

Update the global ACLs for the topic table

Answer

Run the HR Criteria evaluation job manually

Question 6

An HR Administrator needs to configure data masking for the 'SSN' field in the HR Profile (sn_hr_core_profile) table. Which feature should be used to ensure the data is masked for all users except those with the 'hr_admin' role?

Accepted Answer

Use the 'Field Encryption' module with an encryption context. Field Encryption with an encryption context is the correct feature to mask data for specific roles. It allows administrators to encrypt sensitive fields and control decryption based on roles, ensuring that only users with the 'hr_admin' role can view the unmasked data. This provides a robust security mechanism for PII like SSN.

Answer

Set a Business Rule on the sys_dictionary table

Answer

Apply a UI Policy to make the field read-only

Answer

Configure an HR Criteria record

Question 7

When configuring the Employee Center, which feature allows you to group related catalog items and knowledge articles for a better user experience?

Accepted Answer

Taxonomy. Taxonomy in ServiceNow Employee Center provides a hierarchical structure to organize catalog items, knowledge articles, and other content into categories and subcategories, improving navigation and user experience. It allows administrators to group related items logically, making it easier for employees to find what they need.

Answer

Portal Menu

Answer

Catalog Category

Answer

Service Portfolios

Question 8

In a multi-scoped environment, how do you allow an HR role to access a global 'cmdb_ci' table?

Accepted Answer

By creating a Restricted Caller Access (RCA) record. In a multi-scoped environment, a Restricted Caller Access (RCA) record is the correct way to allow a scoped application (like HR) to access a table in another scope (like the global cmdb_ci table). RCA records explicitly grant cross-scope access to specific tables or scripts, bypassing the default scope isolation. This is the standard mechanism for controlled cross-scope access.

Answer

By changing the scope of the cmdb_ci table

Answer

By adding the 'hr_admin' role to the table

Answer

By using an HR Criteria

Question 9

If you need to display a custom banner on the Employee Center only for employees in the 'London' office, which configuration should you use?

Accepted Answer

Content Publishing. Content Automation or Content Publishing allows targeting specific audiences based on conditions like location.

Answer

Service Catalog criteria

Answer

System property

Answer

Portal Menu

Question 10

Which THREE of the following are valid ways to prevent data leakage in HR?

Accepted Answer

Data encryption. Data encryption (B) is correct because encrypting sensitive HR fields at rest (e.g., via Edge Encryption or platform encryption) renders leaked data unreadable without the keys, directly preventing exposure of PII. Auditing/logging (D) is correct because enabling audit records on HR tables (sys_audit) creates a tamper-evident trail of who read or changed sensitive records, which deters leakage and supports detection and forensic investigation. Access restrictions via ACLs (E) is correct because table/field-level ACLs enforce role- and condition-based read/write rules (e.g., restricting salary fields to HR admins), which is the primary control limiting who can view HR data. UI Policy disabling (A) is not a valid control because UI Policies only affect client-side form behavior and do not stop API, import, or direct table access, so data can still leak. Global table renaming (C) is not a valid control because renaming a table is cosmetic and provides no security boundary against unauthorized reads.

Answer

UI Policy disabling

Answer

Global table renaming

Question 11

If a user is promoted, and a Lifecycle Event is triggered, how do you handle the change in 'Department' on the user record?

Accepted Answer

Use HR Service field mapping. HR Service field mapping defines how Lifecycle Event activities write data back to the user (sys_user) record. When a promotion triggers a Lifecycle Event, the HR Service's field mappings specify that the new Department value from the case should update the user's Department field. This is the declarative, supported way to handle record changes.

Answer

Manually edit the profile

Answer

Use Trigger condition

Answer

Update the activity set

Question 12

You need to grant a partner HR team the ability to modify HR Case records, but you must prevent them from seeing the 'Salary' field on the HR Profile. How should you implement this requirement using the principle of least privilege?

Accepted Answer

Use Column-level ACLs on the sn_hr_core_profile table.. Column-level ACLs on the sn_hr_core_profile table provide the most granular access control by restricting read access to the Salary field for specific roles or users. This aligns with the principle of least privilege because it grants the partner HR team the ability to modify HR Case records while explicitly denying visibility to the sensitive Salary field at the field level. ACLs are evaluated on every record access, ensuring consistent enforcement across all interfaces.

Answer

Apply a Business Rule to hide the field.

Answer

Implement a Data Policy to make the field read-only.

Answer

Create an HR Criteria record for the Salary field.

Question 13

You need to add a custom field to the HR Profile that syncs with an external payroll system. Which table should be extended or modified?

Accepted Answer

sn_hr_core_profile. The HR Profile table (sn_hr_core_profile) is the central location for user-specific HR data.

Answer

sys_user

Answer

sn_hr_core_config

Answer

sn_hr_core_case

Question 14

You are troubleshooting an issue where a user cannot see an HR catalog item on the Employee Center. Which component is the most likely cause?

Accepted Answer

HR Criteria. HR Criteria are conditions evaluated against the user's HR Profile (and related attributes) that determine whether a given HR service or catalog item is visible or requestable. If a user cannot see an HR catalog item on the Employee Center, the most likely cause is that the HR Criteria attached to the service or catalog item are not satisfied by that user's profile.

Answer

Assignment Rule

Answer

Business Rule

Answer

User Role

Question 15

Which THREE components are required to successfully configure an HR Record Producer?

Accepted Answer

HR Service definition. In ServiceNow HR Service Delivery, a Record Producer must be tied to an HR Service definition (A), because the HR Service determines the catalog item's fulfillment process, HR criteria, and associated case type that the producer will create. Variable mapping (C) is required so the values captured from the producer's variables are written into the correct fields on the target HR case record when the producer is submitted. Target table selection (D) is also required because the Record Producer must specify which table (typically an HR case table such as sn_hr_core_case or a case type extension) the new record will be inserted into. The other options are not mandatory: a Client Script (B) is optional for adding dynamic UI behavior, and an Approval workflow (E) is not a required component of a Record Producer configuration since approvals are handled through the associated HR Service or workflow, not the producer itself.

Answer

Client Script

Answer

Approval workflow

Question 16

Which TWO roles are commonly required for an HR Agent to function fully in the HR Workspace?

Accepted Answer

sn_hr_core.admin. Option A, sn_hr_core.admin, is correct because the HR Agent needs the HR-specific administrative role that grants the elevated permissions required to configure and operate HR Workspace features such as HR cases, tasks, and related HR records. Option E, sn_hr_core.case_writer, is correct because it is the HR role that allows the agent to create, edit, and work on HR cases in the HR Workspace, which is the core function of an HR Agent. Option B, admin, is not correct because the full system administrator role is broader than needed and is not the HR-specific role intended for HR Agents. Option C, itil, is not correct because it is an ITSM role for IT service management, not an HR role. Option D, sn_hr_core.basic, is not correct because it provides only baseline read/limited access and does not grant the case-writing capability required for full HR Agent functionality.

Answer

admin

Answer

itil

Answer

sn_hr_core.basic

Question 17

An HR implementation specialist is configuring the HR Service Portal to ensure that HR cases are only accessible to the assigned HR agent and the case's opener, unless the user has the 'sn_hr_core.admin' role. The specialist needs to enforce this at the record level. Which platform feature should be used to meet this requirement?

Accepted Answer

Access Control List (ACL) with a script that checks if the user is the opener or assigned to, or has the admin role.. To enforce record-level access where only the opener, assigned agent, or admin can view an HR case, an ACL with a script condition is required. ACLs are evaluated when a user attempts to read a record, and the script can check the user's relationship to the case. Business rules, UI policies, and data policies do not provide the necessary record-level security.

Answer

Data policy that enforces read access based on user's relationship to the case.

Answer

UI policy that makes the HR Case form read-only for users who are not the opener or assigned agent.

Answer

Before query business rule that filters the HR Case table based on user's relationship to the case.

Question 18

An HR agent reports that an activity within an activity set is not triggering despite the trigger condition being met. What is the most likely cause?

Accepted Answer

The activity type is not defined. In ServiceNow HR Lifecycle Events, an activity within an activity set will not fire if the activity type itself is not defined/configured in the system. The activity type defines the executable behavior (e.g., a task, notification, or script), so without it the activity has no action to trigger even when the trigger condition evaluates true.

Answer

The activity set is set to 'Active'

Answer

The parent Lifecycle Event case is in 'Draft' status

Answer

The trigger condition is too complex

Question 19

When configuring an HR Service, you want to trigger a specific subflow upon creation. Where is this configured?

Accepted Answer

HR Service configuration. The HR Service configuration record includes a 'Subflow' field where you specify the subflow to trigger upon HR case creation. This is the standard, declarative way to associate a subflow with an HR service without scripting. When an HR case is created from that service, the platform automatically launches the designated subflow.

Answer

Catalog Item Script

Answer

Assignment Rule

Answer

HR Case Template

Question 20

Which THREE factors influence HR Case assignment logic?

Accepted Answer

Conditions. In ServiceNow HR Case assignment, the assignment logic is driven by three key factors: Conditions (A), which define the criteria that must be met for a rule to fire (such as case type, department, or other field values); Assignment Group (C), which specifies the group to which the case is routed when the conditions are satisfied; and Skills (D), which can be used to further refine assignment to a specific agent within the group based on required competencies. Portal selection (B) affects the user interface and submission channel but does not influence how the case is assigned. User locale (E) may affect language or localization but is not a factor in the core assignment logic.

Answer

Portal selection

Answer

User locale