CIS-HR Security And Data Protection Practice Test 2 — 15 Questions

Question 1

When using 'HR Criteria', which attribute can be used to restrict access based on the user's location?

Accepted Answer

User Location. HR Criteria in ServiceNow HRSD support a 'User Location' attribute that allows administrators to restrict access to HR services, cases, or content based on the user's location as defined in their HR profile. This is the correct attribute for location-based segmentation. Other attributes like role, IP address, or browser type are not HR Criteria attributes for location restriction.

Answer

User Role

Answer

IP Address

Answer

Browser Type

Question 2

How can you audit access to HR cases?

Accepted Answer

By using the 'System Log' and 'ACL' audit logs. Auditing access to HR cases requires visibility into both authentication/transaction activity and the ACL enforcement decisions that govern who can read or write HR case records. ServiceNow captures this through the System Log (syslog) for transaction-level events and the ACL audit logs (enabled via the 'Enable ACL failure logging' or 'Enable ACL debugging' system properties) which record which ACL rules allowed or denied access. Together these provide a defensible audit trail showing who accessed HR cases and whether the access was permitted.

Answer

By running a report on the 'sys_log' table

Answer

By looking at the 'HR Case' table history

Answer

By asking the users

Question 3

Which role is necessary to perform 'HR Case' deletions?

Accepted Answer

hr_admin. The hr_admin role is necessary to perform HR Case deletions because delete operations on HR case records require elevated administrative privileges. Standard HR case roles like hr_task_writer and sn_hr_core.reader do not include delete rights on HR cases. This ensures that sensitive HR case data is not accidentally or maliciously removed by non-administrative users.

Answer

hr_task_writer

Answer

sn_hr_core.reader

Answer

itil

Question 4

You need to ensure that HR case attachments are encrypted. What is the correct approach?

Accepted Answer

Enable 'Attachment Security' for the HR Scoped App. Attachments in ServiceNow inherit the security of the parent record, or you can use Attachment Encryption modules.

Answer

Rename the attachments

Answer

Encrypt the storage drive

Answer

Move files to a secure server

Question 5

Which THREE of the following are components of an HR Security Profile?

Accepted Answer

Name. In ServiceNow HR Service Delivery, an HR Security Profile is defined by three key components: Name (B), which provides the unique identifier/label for the profile so it can be referenced and applied to HR criteria and records; HR Services (C), which specify the set of HR services (catalog items/cases) that the profile grants access to; and Assignment Groups (E), which determine which HR assignment groups' members are granted access to the associated HR services and cases. These three together define who (via assignment groups) can access which HR services, under a named profile. Workflow (A) is a process automation construct used for approvals/tasks, not a component of an HR Security Profile, and UI Policy (D) is a form-behavior control (making fields mandatory/read-only/visible) unrelated to HR Security Profile composition.

Answer

Workflow

Answer

UI Policy

Question 6

Which THREE of the following are types of HR Criteria?

Accepted Answer

Department Criteria. In HR-driven identity governance (for example, Oracle Identity Manager or similar provisioning systems), HR criteria define how worker records are matched to identity attributes, and the three valid types here are Department Criteria (A), Location Criteria (D), and User Criteria (E). Department Criteria (A) is correct because it correlates an HR feed's department or organization field to the corresponding department attribute used for provisioning and role assignment. Location Criteria (D) is correct because it matches the HR record's location, site, or country field to the identity's location attribute to drive access based on physical or legal jurisdiction. User Criteria (E) is correct because it matches individual user-level HR attributes (such as employee type, worker category, or user ID) directly to the person's identity record. Group Criteria (B) is not a defined HR criteria type, since groups are typically targets of rule-based membership rather than an HR matching dimension, and Role Criteria (C) is not an HR criteria type either, because roles are the outcome of criteria evaluation rather than a criterion category itself.

Answer

Group Criteria

Answer

Role Criteria

Question 7

Which TWO of the following are true about 'HR Scoped Roles'?

Accepted Answer

They can be assigned to anyone. Option C is correct because HR scoped roles, like other scoped application roles, can be granted to any user record in the instance—there is no restriction limiting them to HR employees or specific user types. Option E is correct because roles created within the HR Service Delivery scoped application must follow the scoped naming convention and begin with the 'sn_hr_core' prefix (e.g., sn_hr_core.admin, sn_hr_core.case_writer). Option A is incorrect because scoped roles do not override system admin roles; the admin role remains the highest privilege and scoped roles simply add granular permissions within their application scope. Option B is incorrect because HR scoped roles are confined to the HR application scope rather than being globally available across all applications. Option D is incorrect because ServiceNow does not automatically update customer-created or customized scoped roles; role maintenance is an administrative responsibility.

Answer

They override system admin roles

Answer

They are available globally

Answer

They are automatically updated by ServiceNow

Question 8

Which THREE of the following are necessary to test if your HR security configuration is working correctly?

Accepted Answer

Impersonate a user who should not have access. To validate an HR security configuration, you must confirm both that unauthorized users are blocked and that authorized users retain proper access. Option B is correct because impersonating a user who should not have access directly tests whether HR records, cases, or modules are properly restricted for that persona. Option D is correct because the System Security logs (e.g., sys_security_acl and related audit records) capture ACL denials and access attempts, providing evidence that the security rules actually fired. Option E is correct because verifying the user has the correct role confirms the role assignments and inherited roles that the HR ACLs and role-based access depend on, ensuring the test is meaningful. Option A is not needed since restarting the ServiceNow instance does not test security behavior and is not part of validating HR access controls. Option C is not appropriate because creating an HR case as an admin only shows admin capability and does not verify that restricted users are properly denied.

Answer

Restart the ServiceNow instance

Answer

Create a new HR case as an admin

Question 9

Which TWO of the following tools allow you to perform a security audit on HR records?

Accepted Answer

System Logs. System Logs (A) are correct because they capture a chronological record of system-level events and transactions, including access to and changes made on HR records, which is essential for a security audit trail. Audit History (D) is also correct because it specifically tracks field-level changes to records, showing who changed what value and when, which directly supports auditing HR data modifications. Form Layout (B) only controls how fields are arranged on a form and has no auditing or logging capability. UI Policy logs (C) merely record client-side UI policy execution behavior, not security-relevant record changes. Dictionary Editor (E) is used to modify table/field schema definitions and does not provide any audit trail of record activity.

Answer

Form Layout

Answer

UI Policy logs

Answer

Dictionary Editor

Question 10

Which THREE of the following are required to successfully implement 'Field Level Encryption'?

Accepted Answer

Field identification. Field Level Encryption (FLE) in ServiceNow requires you to first identify which fields will be encrypted, so option B (Field identification) is correct because the specific fields must be selected and configured for encryption. Option D (Role assignment for decryption) is correct because users need the appropriate roles (such as the encryption role or specific decryption roles) to view decrypted values; without role assignment, encrypted data remains masked. Option E (Encryption Context) is correct because FLE uses an encryption context to define the scope and key used for encrypting and decrypting field values, and it must be configured for the encryption to work. Option A (HR Service definition) is not required for FLE; HR service definitions are used in HR Service Delivery case management, not field-level encryption. Option C (User Criteria) is not required for FLE; user criteria are used for access control in portals and knowledge, not for the core encryption/decryption mechanism.

Answer

HR Service definition

Answer

User Criteria

Question 11

Which THREE of the following are security controls that can be applied to HR attachments?

Accepted Answer

Encryption at rest. Encryption at rest (A) is correct because it protects HR attachment files stored on the platform by rendering their contents unreadable if the underlying storage is accessed without authorization. ACLs (B) are correct because access control lists define which users or roles can read, write, or delete specific attachment records, enforcing record-level authorization. Scoped Application policy (D) is correct because application-scope policies restrict which scoped applications and cross-scope callers can access HR attachment data, containing exposure across the platform. Role assignment only (C) is not a complete control because roles alone grant broad access without record- or field-level enforcement. Catalog Item restriction (E) does not apply, since catalog items govern service catalog ordering, not HR attachment security.

Answer

Role assignment only

Answer

Catalog Item restriction

Question 12

Which TWO of the following are true regarding 'HR Security Profiles' and 'Assignment Groups'?

Accepted Answer

Profiles are assigned to groups. Option C is correct because HR Security Profiles are attached to Assignment Groups, meaning the profile's row-level and field-level permissions are applied through the group rather than being assigned directly to individual users. Option E is correct because a profile can be scoped or restricted to specific Assignment Groups, so only members of those groups receive the profile's access. Options A, B, and D are incorrect: profiles do not override group membership, groups are not mandatory for profiles (profiles can exist independently and be assigned later), and groups do not automatically become profiles—these are distinct configuration objects.

Answer

Profiles override group membership

Answer

Groups are mandatory for profiles

Answer

Groups automatically become profiles

Question 13

An HR administrator is configuring HR Criteria to restrict access to a specific Knowledge Base article. When applying this criteria, the system checks the HR Profile of the logged-in user. Which security component is responsible for enforcing this record-level visibility in the HR Service Delivery module?

Accepted Answer

Contextual Security. HR Criteria leverages the sn_hr_core_criteria table to evaluate conditions against the HR Profile (sn_hr_core_profile) and enforce ACLs or visibility settings.

Answer

Platform ACLs

Answer

Data Policies

Answer

Business Rules

Question 14

You need to grant a partner HR team the ability to modify HR Case records, but you must prevent them from seeing the 'Salary' field on the HR Profile. How should you implement this requirement using the principle of least privilege?

Accepted Answer

Use Column-level ACLs on the sn_hr_core_profile table.. Column-level ACLs on the sn_hr_core_profile table provide the most granular access control by restricting read access to the Salary field for specific roles or users. This aligns with the principle of least privilege because it grants the partner HR team the ability to modify HR Case records while explicitly denying visibility to the sensitive Salary field at the field level. ACLs are evaluated on every record access, ensuring consistent enforcement across all interfaces.

Answer

Apply a Business Rule to hide the field.

Answer

Implement a Data Policy to make the field read-only.

Answer

Create an HR Criteria record for the Salary field.

Question 15

When utilizing the 'HR Service Delivery' module, you notice that sensitive employee data is being logged in the application logs. Which ServiceNow feature should be used to mask this data automatically without modifying the business logic?

Accepted Answer

Log Redaction Rules. Log Redaction Rules in ServiceNow allow administrators to define patterns (e.g., regex for SSNs, credit card numbers) that are automatically masked in log output without changing business logic or the underlying data. This is the purpose-built feature for preventing sensitive data from appearing in application logs while preserving the original values in the database.

Answer

Field Encryption

Answer

ACLs

Answer

Data Privacy Policies