A user in the HR department reports they cannot see records in the 'HR Tasks' list, despite having the 'hr_task_reader' role. What is the most likely cause?
An HR Administrator needs to configure data masking for the 'SSN' field in the HR Profile (sn_hr_core_profile) table. Which feature should be used to ensure the data is masked for all users except those with the 'hr_admin' role?
You need to restrict access to a specific HR Case so that only members of the 'Payroll' assignment group can view it. Which security mechanism should you configure?
You are configuring Delegated Development for an HR team member. You want to grant them permissions to create and modify HR Service Portal widgets, but you must prevent them from modifying the underlying HR security ACLs. Which scope role should be assigned to the developer?
You need to allow HR managers to view sensitive employee information only while they are on the corporate VPN. What security tool is best suited for this?
An HR administrator is configuring HR Criteria to restrict access to a specific Knowledge Base article. When applying this criteria, the system checks the HR Profile of the logged-in user. Which security component is responsible for enforcing this record-level visibility in the HR Service Delivery module?
You need to grant a partner HR team the ability to modify HR Case records, but you must prevent them from seeing the 'Salary' field on the HR Profile. How should you implement this requirement using the principle of least privilege?
When utilizing the 'HR Service Delivery' module, you notice that sensitive employee data is being logged in the application logs. Which ServiceNow feature should be used to mask this data automatically without modifying the business logic?
A customer is using 'Scoped HR' and needs to allow an HR Admin to modify scripts while ensuring they cannot access other system tables. Which role should be assigned to the HR Admin to permit these actions within the HR scope?
An HR administrator needs to prevent users with the 'sn_hr_core.basic' role from viewing the 'Salary' field on the HR Profile form, while still allowing them to view all other fields on that form. The HR Profile table is scoped and already has an ACL that grants read access to the 'sn_hr_core.basic' role for the entire record. What is the most precise way to restrict access to only the 'Salary' field?
An HR implementation specialist is configuring data security for HR cases. The organization requires that HR agents can only see HR cases that are assigned to their own department, but HR managers can see all cases regardless of department. The HR case table has a 'Department' field. Which combination of ACL and role configuration will achieve this requirement with the least administrative overhead?
A global HR team at a multinational company needs an HR agent in the EMEA region to see only employee cases from EMEA, while an HR agent in the APAC region should see only APAC cases. They all have the same HR role, sn_hr_core.basic. Which configuration should you use to enforce this row-level visibility?
A multinational company uses ServiceNow HR Service Delivery. They need to ensure that HR agents in the European Union can only view HR cases for employees located in the EU, while HR agents in the United States can only view cases for US employees. The HR case table has a field 'employee_location' that stores the country. What is the most efficient way to enforce this data segregation?
An HR administrator needs to give a new HR agent access to view and update HR cases, but only for cases assigned to their assignment group. The agent should not be able to see any other HR cases. The HR case table already has ACLs that grant read and write to the sn_hr_core.case_writer role for all cases. What is the most appropriate way to restrict this agent's access without affecting other agents?
An HR administrator needs to ensure that HR case data is protected from unauthorized access by users with the 'itil' role, who should not see any HR cases. The administrator notices that the 'itil' role currently has read access to the HR Case table due to an inherited ACL from a parent table. What is the most effective way to restrict access for the 'itil' role without affecting other roles?
A company wants to implement data encryption for HR cases at rest. They are using ServiceNow HR Service Delivery. Which platform feature should they enable to meet this requirement?
An HR security administrator is reviewing access controls for the HR Service Delivery application. They need to ensure that only authorized HR agents can access sensitive HR case data. Which TWO of the following are valid methods to restrict access to HR cases? (Choose two.)
An HR implementation specialist at a global enterprise needs to ensure that HR agents in the EMEA region cannot view HR cases belonging to employees in the APAC region, even if they have the hr_agent role. The company uses HR Security Profiles and HR Criteria. What should the specialist configure to enforce this regional restriction?
An HR implementation specialist is configuring HR Service Delivery for a multinational company. The company wants to ensure that HR agents in the European Union can only access HR cases for employees located in the EU, while HR agents in the United States can only access cases for US employees. Which approach should be used to enforce this data segregation?
An HR implementation specialist is setting up HR Security Profiles for a new HR Service Delivery implementation. The organization wants to ensure that HR agents can only see HR cases that are assigned to their own assignment group, and they should not be able to see cases assigned to other groups. Which configuration should the specialist implement?
A new HR implementation specialist is asked to grant a member of the HR benefits team the ability to approve HR cases assigned to the benefits team, but not to administer HR security settings or manage other HR teams' work. Which role assignment best matches this least-privilege requirement?
An HR implementation specialist needs to ensure that HR cases containing sensitive employee relations information are only visible to the HR Employee Relations team. The team has a specific assignment group called 'HR Employee Relations'. Which ServiceNow feature should the specialist use to restrict access to these cases?
An HR administrator needs to restrict access to sensitive employee medical records so that only the HR Benefits team can view them, even though other HR staff have the 'sn_hr_core.case_reader' role. Which security mechanism should be implemented?
An HR department requires that only users with the 'sn_hr_core.admin' role can modify HR Services. Which security mechanism must be configured to ensure this role restriction is enforced during the service definition process?
A user needs access to HR case data, but only for cases belonging to their specific department. Which security model should be used to restrict this data access dynamically?
You are auditing your instance and find that unauthorized users are able to read HR Profile records. After verifying that no ACLs are broken, what is the next most likely source of this data exposure?
An HR administrator needs to ensure that only members of the HR department can view HR case records in the HR Service Portal. The HR cases are stored in the HR Case [sn_hr_core_case] table, which is not scoped. The administrator has created a new group called 'HR Case Viewers' and assigned it the 'sn_hr_core.case_reader' role. What is the most appropriate way to restrict access so that only this group can read HR case records?
An HR implementation specialist is configuring data protection for HR cases. The organization requires that certain HR case fields containing sensitive employee information, such as Social Security Number and Medical History, be encrypted at rest. The specialist plans to use the platform's encryption capabilities. Which TWO of the following statements are true regarding field-level encryption in ServiceNow? (Choose two.)
An HR implementation team wants to ensure that only users with the HR case manager role can view the 'confidential notes' field on HR cases, while all other HR agents can see the case but not that field. The field is on the HR case table. What is the most appropriate configuration to meet this requirement?
An HR administrator is configuring HR criteria to determine which HR services and cases a user can access. The administrator wants to create a criterion that includes all employees in the 'HR' department and also all users with the 'hr_admin' role. What is the correct way to combine these conditions?
An HR implementation specialist is configuring the HR Service Portal to ensure that HR cases are only accessible to the assigned HR agent and the case's opener, unless the user has the 'sn_hr_core.admin' role. The specialist needs to enforce this at the record level. Which platform feature should be used to meet this requirement?
An HR administrator needs to grant a new HR agent access to view HR cases, but the agent should not be able to see the 'employee_salary' field on those cases. The HR case table already has a read ACL that grants access to the 'hr_agent' role. What is the minimum additional configuration required to hide the 'employee_salary' field from this agent?
An HR implementation specialist is configuring the HR Service Portal and wants to ensure that employees can only view their own HR cases and not those of other employees. Which platform feature should be used to enforce this?
An HR implementation specialist is configuring security for HR Service Delivery. They need to ensure that HR cases containing sensitive employee information are protected. Which TWO of the following are valid methods to restrict access to HR case records based on user roles? (Choose two.)
An HR implementation specialist needs to ensure that HR case attachments containing sensitive employee information are protected from unauthorized access. The company requires that only the HR agent assigned to the case and the employee who opened the case can download the attachment. Which configuration should be implemented?
An HR implementation specialist is configuring the HR Service Delivery application. The organization wants to ensure that HR agents can only see HR cases that are assigned to their own assignment group, and that they cannot see cases assigned to other HR groups. Which feature should be used to enforce this?
An HR implementation specialist needs to ensure that only users with the HR administrator role can delete HR cases. Which security mechanism should be configured to enforce this?
An HR implementation specialist is configuring an HR Service Delivery (HR SD) instance where employees must be able to open their own HR cases but must never see cases opened by other employees. The solution should use a single, reusable configuration mechanism rather than writing bespoke business rules per case type. Which configuration should the specialist use to enforce this requirement?
An HR implementation specialist must ensure that employees can view their own HR profile, including job title and department, but cannot see compensation fields such as salary or bonus. Employees currently have the sn_hr_core.employee role. Which configuration most directly achieves field-level protection of compensation data while preserving access to non-sensitive HR profile fields?
An HR implementation specialist is configuring field-level encryption for sensitive employee data in HR cases. The organization requires that certain fields, such as national ID and salary, be encrypted at rest and that only users with a specific role can decrypt them. Which ServiceNow feature should the specialist use to meet this requirement?
An HR implementation specialist is reviewing how HR Service Delivery protects sensitive employee data across the platform. The organization wants to confirm that both row-level and field-level protections are in place, and that data in transit and at rest is safeguarded. Which TWO of the following mechanisms are native to ServiceNow and directly support HR data protection? (Choose two.)
An HR implementation specialist is reviewing the security configuration for HR Service Delivery. The organization wants to ensure that HR agents cannot view the 'Notes' field on HR cases if the case is marked as 'Confidential'. Which configuration should be implemented?