CIS-HR Security And Data Protection — 15 Questions

Question 1

When configuring 'HR Security Profiles', what is the purpose of the 'Apply to' field?

Accepted Answer

To specify whether the profile covers HR Cases, HR Tasks, or both. The 'Apply to' field determines if the security profile applies to Cases, Tasks, or both.

Answer

To define which HR Service the profile controls

Answer

To assign the profile to a specific user group

Answer

To restrict the profile to specific geographic locations

Question 2

Which THREE of the following are primary methods for enforcing data protection within the HR Service Delivery application?

Accepted Answer

Before Query Business Rules. Security in HRSD relies on a combination of ACLs, Query Business Rules, and role-based access to ensure sensitive data is not exposed.

Answer

Service Portal Theme settings

Answer

HR Criteria

Question 3

A user in the HR department reports they cannot see records in the 'HR Tasks' list, despite having the 'hr_task_reader' role. What is the most likely cause?

Accepted Answer

The 'HR Criteria' associated with the HR Task type excludes the user's department. HR Criteria or Contextual Security roles are often layered; check if they meet the specific criteria defined for the task type.

Answer

The user is not in the 'hr_admin' group

Answer

The user needs the 'sn_hr_core.admin' role

Answer

The HR Case is in a 'Closed' state

Question 4

An HR Administrator needs to configure data masking for the 'SSN' field in the HR Profile (sn_hr_core_profile) table. Which feature should be used to ensure the data is masked for all users except those with the 'hr_admin' role?

Accepted Answer

Use the 'Field Encryption' module with an encryption context. Field-level encryption or Data Masking is used to protect sensitive data fields based on user roles.

Answer

Set a Business Rule on the sys_dictionary table

Answer

Apply a UI Policy to make the field read-only

Answer

Configure an HR Criteria record

Question 5

Which role is required to modify HR security configurations in a scoped application without having full system admin access?

Accepted Answer

delegated_developer. The delegated developer role allows developers to manage specific applications without global admin privileges.

Answer

security_admin

Answer

sn_hr_core.admin

Answer

hr_manager

Question 6

You need to restrict access to a specific HR Case so that only members of the 'Payroll' assignment group can view it. Which security mechanism should you configure?

Accepted Answer

Apply an HR Security Profile using the 'Restrict by Assignment Group' setting. HR Case security is primarily managed through HR Criteria and HR Security profiles, but record-level access for specific cases is best controlled using ACLs or HR Scoped Roles.

Answer

Set the 'Read' ACL on the sn_hr_core_case table to 'Public'

Answer

Modify the 'HR Service' definition to include a client script

Answer

Configure a Business Rule to modify the sys_id visibility

Question 7

You are configuring Delegated Development for an HR team member. You want to grant them permissions to create and modify HR Service Portal widgets, but you must prevent them from modifying the underlying HR security ACLs. Which scope role should be assigned to the developer?

Accepted Answer

delegated_developer. The 'delegated_developer' role combined with scoped application permissions allows specific development tasks without full admin rights.

Answer

sn_hr_core.manager

Answer

sn_hr_core.admin

Answer

security_admin

Question 8

An HR administrator needs to restrict access to sensitive employee medical records so that only the HR Benefits team can view them, even though other HR staff have the 'sn_hr_core.case_reader' role. Which security mechanism should be implemented?

Accepted Answer

Configure ACLs on the specific table/field with role requirements. Contextual Security (ACLs) applied to specific HR tables or fields allows for granular control based on roles and conditions beyond the standard HR roles.

Answer

Create a new HR Criteria record

Answer

Use Data Policies to read-only the records

Answer

Modify the HR Service Portal widget security settings

Question 9

Where do you go to view the HR Security Profiles assigned to a specific user?

Accepted Answer

HR Profile -> [User Name] -> Security Profiles. The HR Profile record contains a related list or field displaying assigned security profiles.

Answer

ACLs list

Answer

HR Administration -> HR Security -> HR Security Profiles

Answer

System Security -> Users

Question 10

What role is required for a user to manage 'HR Criteria' records?

Accepted Answer

hr_admin. Management of HR Criteria is restricted to HR Admins or those with specific scoped administrative privileges.

Answer

sn_hr_core.reader

Answer

itil

Answer

user_admin

Question 11

Which of the following is true regarding 'HR Scoped Roles'?

Accepted Answer

They must be prefixed with 'sn_hr_core'. Scoped roles are contained within the application scope, preventing global role collision.

Answer

They automatically grant access to global tables

Answer

They are automatically assigned to all users

Answer

They can only be created by the system administrator

Question 12

You need to ensure that 'Payroll' employees cannot see 'Employee Relations' cases. What is the standard ServiceNow best practice for this?

Accepted Answer

Configure HR Security Profiles to restrict access based on Assignment Group. Using HR Security Profiles mapped to specific HR Service configurations or Assignment Groups is the standard way to enforce separation of duties.

Answer

Use Query Business Rules to append 'sys_class_name' filters

Answer

Create a separate HR table for each department

Answer

Disable the 'Read' ACL for Payroll users

Question 13

If a user has both the 'hr_admin' and 'sn_hr_core.admin' roles, which role takes precedence for HR data security?

Accepted Answer

sn_hr_core.admin. ServiceNow security evaluation generally grants access if any role is present, but scoped admin roles are required for specific HR application configuration.

Answer

They are evaluated together

Answer

hr_admin

Answer

The system admin role

Question 14

An organization requires that HR case data be encrypted at rest. What platform feature must be enabled?

Accepted Answer

Column Level Encryption (CLE). Edge Encryption or Column Level Encryption (CLE) is required for specific data-at-rest requirements in HR.

Answer

Contextual Security

Answer

Access Control Lists

Answer

HR Criteria

Question 15

To ensure that HR case 'Work Notes' are hidden from the employee portal, what should you configure?

Accepted Answer

ACLs on the sn_hr_core_case table for the work_notes field. Visibility of work notes is controlled by the 'Visible to' field on the note or the underlying ACLs on the journal field.

Answer

HR Criteria

Answer

Catalog Item restriction

Answer

Business Rule on the task table