CIS-HR Security And Data Protection Practice Test 3 — 15 Questions

Question 1

A customer is using 'Scoped HR' and needs to allow an HR Admin to modify scripts while ensuring they cannot access other system tables. Which role should be assigned to the HR Admin to permit these actions within the HR scope?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

sn_hr_core.delegated_developer. The role 'sn_hr_core.delegated_developer' is designed for HR Admins who need to modify scripts within the HR scope while restricting access to other system tables. This role grants the necessary permissions to edit scripts in HR applications but does not provide broad administrative access, thus adhering to the principle of least privilege.

Answer

security_admin

Answer

sn_hr_core.admin

Answer

admin

Question 2

Which TWO statements are true regarding the use of the 'sn_hr_core.delegated_developer' role?

Accepted Answer

It allows the user to publish HR applications to the ServiceNow Store.. Option C is correct because the sn_hr_core.delegated_developer role is designed to let a delegated developer work on and publish HR scoped applications to the ServiceNow Store, enabling distribution of HR app customizations. Option D is correct because modifying scripts inside the HR scoped application requires the delegated developer role, since scoped application script changes are restricted to users with the appropriate delegated development privileges rather than ordinary HR roles. Option A is not correct because HR Criteria are configuration records used for HR case assignment and are unrelated to delegated development permissions. Option B is not correct because the role does not grant full access to all global system tables; it is scoped to the HR application. Option E is not correct because the role does not automatically assign the admin role, which would be a serious privilege escalation.

Answer

It removes the need for HR Criteria.

Answer

It grants full access to all global system tables.

Answer

It automatically assigns the 'admin' role to the user.

Question 3

An HR administrator needs to prevent users with the 'sn_hr_core.basic' role from viewing the 'Salary' field on the HR Profile form, while still allowing them to view all other fields on that form. The HR Profile table is scoped and already has an ACL that grants read access to the 'sn_hr_core.basic' role for the entire record. What is the most precise way to restrict access to only the 'Salary' field?

Accepted Answer

Create a field-level ACL on the 'Salary' field with type 'field' and operation 'read' that denies access to the 'sn_hr_core.basic' role.. Field-level ACLs are the correct mechanism to control access to individual fields when a table-level ACL already grants broader access. They are evaluated after table ACLs and can deny access to specific roles for specific fields. UI policies and read-only ACLs do not enforce the required security restriction.

Answer

Add a read-only ACL on the 'Salary' field for the 'sn_hr_core.basic' role.

Answer

Create a UI policy that hides the 'Salary' field when the user has the 'sn_hr_core.basic' role.

Answer

Modify the existing table-level ACL to add a condition that excludes the 'Salary' field from read access.

Question 4

An HR implementation specialist is configuring data security for HR cases. The organization requires that HR agents can only see HR cases that are assigned to their own department, but HR managers can see all cases regardless of department. The HR case table has a 'Department' field. Which combination of ACL and role configuration will achieve this requirement with the least administrative overhead?

Accepted Answer

Create two read ACLs on the HR case table: one for the 'sn_hr_core.manager' role with no condition, and one for the 'sn_hr_core.agent' role with a condition that the 'Department' field matches the agent's department.. Using separate read ACLs for managers and agents allows role-based access control without per-user customization. The manager ACL grants unrestricted access, while the agent ACL dynamically filters cases by department. This is efficient and maintains clear separation of duties, unlike business rules or role stacking.

Answer

Create a read ACL for the 'sn_hr_core.agent' role with a condition that the 'Department' field matches the agent's department, and assign the 'sn_hr_core.manager' role to agents who need broader access.

Answer

Use a before query business rule on the HR case table to add a filter for agents based on their department, and rely on ACLs to grant full access to managers.

Answer

Create a single read ACL for both roles with a condition that checks if the user has the manager role; if not, filter by department.

Question 5

A global HR team at a multinational company needs an HR agent in the EMEA region to see only employee cases from EMEA, while an HR agent in the APAC region should see only APAC cases. They all have the same HR role, sn_hr_core.basic. Which configuration should you use to enforce this row-level visibility?

Accepted Answer

Use Domain Separation with domains for EMEA and APAC, place users and cases in the appropriate domain, and configure domain visibility.. Domain Separation is the correct mechanism for isolating HR case data by region. It creates logical partitions so that users in the EMEA domain cannot see APAC records and vice versa, without requiring custom business rules. This declarative approach is scalable and aligns with how ServiceNow HR Service Delivery supports global, multi-region deployments with strict data visibility requirements.

Answer

Create a before query business rule on the HR case table that filters records based on the user's region.

Answer

Configure HR Criteria records that match on the agent's region and apply them to the HR case assignment group.

Answer

Create a UI policy on the HR case table that hides records based on the user's region.

Question 6

A multinational company uses ServiceNow HR Service Delivery. They need to ensure that HR agents in the European Union can only view HR cases for employees located in the EU, while HR agents in the United States can only view cases for US employees. The HR case table has a field 'employee_location' that stores the country. What is the most efficient way to enforce this data segregation?

Accepted Answer

Create a before query business rule on the HR case table that adds a filter to the query based on the current user's region and the employee_location field.. A before query business rule is the most efficient way to enforce row-level security because it modifies the query before it is executed, ensuring users only retrieve records they are allowed to see. It works across all access methods and leverages the existing employee_location field. This approach is scalable and maintains a single HR case table.

Answer

Create a read ACL on the HR case table with a script that checks the user's region and the employee_location field, and returns true only if they match.

Answer

Create separate HR case tables for each region and assign agents to the appropriate table.

Answer

Create a UI policy that hides the HR case records from users in other regions based on the employee_location field.

Question 7

An HR administrator needs to give a new HR agent access to view and update HR cases, but only for cases assigned to their assignment group. The agent should not be able to see any other HR cases. The HR case table already has ACLs that grant read and write to the sn_hr_core.case_writer role for all cases. What is the most appropriate way to restrict this agent's access without affecting other agents?

Accepted Answer

Create a new ACL on the HR case table that grants read and write access only when the case's assignment group matches the user's assignment group, and assign this ACL to the new agent's role.. The correct approach is to create a new ACL that grants access only when the case's assignment group matches the user's assignment group, and assign that ACL to a role held by the new agent. ACLs are the platform's declarative security model and allow row-level conditions. Because ACLs are additive, other agents with broader roles remain unaffected. This solution is maintainable and leverages standard functionality without custom scripting.

Answer

Set the new agent's user record to have a 'limited' access flag and configure the HR case table to respect that flag.

Answer

Create a new role that inherits sn_hr_core.case_writer and add a condition to the existing ACLs to check the assignment group.

Answer

Use a before query business rule on the HR case table that filters records based on the user's assignment group membership.

Question 8

An HR administrator needs to ensure that HR case data is protected from unauthorized access by users with the 'itil' role, who should not see any HR cases. The administrator notices that the 'itil' role currently has read access to the HR Case table due to an inherited ACL from a parent table. What is the most effective way to restrict access for the 'itil' role without affecting other roles?

Accepted Answer

Create a new ACL on the HR Case table that denies read access to the 'itil' role.. To restrict access for the 'itil' role without affecting others, create a deny ACL on the HR Case table for that role. Deny ACLs take precedence over inherited allow ACLs, ensuring that users with the 'itil' role cannot read HR cases. Other methods like removing roles, modifying parent ACLs, or using business rules are either too broad or do not provide record-level security.

Answer

Modify the parent table's ACL to exclude the 'itil' role, which will cascade to the HR Case table.

Answer

Add a before query business rule on the HR Case table that filters out records for users with the 'itil' role.

Answer

Remove the 'itil' role from all users who should not see HR cases.

Question 9

A company wants to implement data encryption for HR cases at rest. They are using ServiceNow HR Service Delivery. Which platform feature should they enable to meet this requirement?

Accepted Answer

Field Encryption for the HR case table fields that contain sensitive data.. Field Encryption is the ServiceNow feature that encrypts specific fields at rest in the database. By enabling Field Encryption on the sensitive fields of the HR case table, the data is stored encrypted, meeting the requirement. This is a built-in feature that can be configured by an administrator without third-party tools.

Answer

Role-based access controls (RBAC) on the HR case table to restrict access to sensitive data.

Answer

Transport Layer Security (TLS) for all HR Service Portal communications.

Answer

Database encryption using the ServiceNow Encryption Key Management (EKM) with a third-party key management system.

Question 10

An HR security administrator is reviewing access controls for the HR Service Delivery application. They need to ensure that only authorized HR agents can access sensitive HR case data. Which TWO of the following are valid methods to restrict access to HR cases? (Choose two.)

Accepted Answer

Using Domain Separation to segregate HR case data by department or region.. The two valid methods are creating ACLs that evaluate role and assignment group, and using Domain Separation to segregate data. ACLs are the standard declarative security model for record-level access, while Domain Separation provides logical partitioning for multi-tenant or multi-region scenarios. Both are supported and recommended for securing HR case data. The other options either do not control record access or are not secure mechanisms.

Answer

Setting up UI Policies to hide the HR case table from the navigation menu.

Answer

Configuring HR Criteria to limit which HR services a user can request.

Answer

Using before query business rules to filter HR case queries based on user attributes.

Question 11

An HR implementation specialist at a global enterprise needs to ensure that HR agents in the EMEA region cannot view HR cases belonging to employees in the APAC region, even if they have the hr_agent role. The company uses HR Security Profiles and HR Criteria. What should the specialist configure to enforce this regional restriction?

Accepted Answer

Create an HR Criteria record on the HR Profile table that filters users by region and assign it to an HR Security Profile that grants read access only to matching cases.. HR Criteria combined with HR Security Profiles provide a declarative, maintainable way to restrict HR case visibility by user attributes such as region. This approach aligns with the HR Service Delivery security model and avoids custom code that can break on upgrades or introduce performance overhead.

Answer

Add a before query business rule on the HR Case table that checks the agent's region and aborts the query if it includes APAC cases.

Answer

Configure a domain separation domain for each region and assign EMEA agents to the EMEA domain, relying on domain visibility to hide APAC cases.

Answer

Create a new role that inherits from hr_agent and assign it only to EMEA agents, then remove the hr_agent role from APAC cases.

Question 12

An HR implementation specialist is configuring HR Service Delivery for a multinational company. The company wants to ensure that HR agents in the European Union can only access HR cases for employees located in the EU, while HR agents in the United States can only access cases for US employees. Which approach should be used to enforce this data segregation?

Accepted Answer

Create ACLs on the HR case table with conditions based on the employee's location and the agent's location.. ACLs are the appropriate mechanism to enforce record-level access based on dynamic conditions such as employee location. By creating a read ACL on the HR case table that compares the employee's location to the agent's location or region, you ensure that agents only see cases relevant to their region. This approach is flexible and directly addresses the requirement for data segregation.

Answer

Configure domain separation for the HR application.

Answer

Use HR criteria to limit which HR services are available to EU and US employees.

Answer

Create separate HR security profiles for EU and US agents and assign them accordingly.

Question 13

An HR implementation specialist is setting up HR Security Profiles for a new HR Service Delivery implementation. The organization wants to ensure that HR agents can only see HR cases that are assigned to their own assignment group, and they should not be able to see cases assigned to other groups. Which configuration should the specialist implement?

Accepted Answer

Create an HR Security Profile with a case criteria that filters cases by assignment group equal to the agent's assignment group, and assign the profile to the HR agents.. HR Security Profiles with case criteria based on the agent's assignment group provide a declarative, maintainable way to restrict case visibility. This approach aligns with the HR Service Delivery security model and avoids custom code, ensuring that agents only see cases assigned to their group.

Answer

Assign the hr_agent role to all agents and configure an ACL on the HR Case table that requires the agent's assignment group to match the case's assignment group.

Answer

Create a before query business rule on the HR Case table that checks if the current user's assignment group matches the case's assignment group and aborts the query if not.

Answer

Use domain separation to create a domain for each assignment group and assign agents to their respective domains.

Question 14

A new HR implementation specialist is asked to grant a member of the HR benefits team the ability to approve HR cases assigned to the benefits team, but not to administer HR security settings or manage other HR teams' work. Which role assignment best matches this least-privilege requirement?

Accepted Answer

Assign the sn_hr_core.manager role to allow approval of HR cases within the team. The sn_hr_core.manager role is scoped for HR team leads who need to manage and approve HR cases within their team, without the broad administrative privileges of sn_hr_core.admin. It aligns with least privilege by granting only the approval authority required for the benefits team member's job function.

Answer

Assign the sn_hr_core.employee role so the user can access the HR Service Portal

Answer

Assign the sn_hr_core.admin role so the user can fully manage HR cases

Answer

Assign the sn_hr_core.case_writer role so the user can create and update HR cases

Question 15

An HR implementation specialist needs to ensure that HR cases containing sensitive employee relations information are only visible to the HR Employee Relations team. The team has a specific assignment group called 'HR Employee Relations'. Which ServiceNow feature should the specialist use to restrict access to these cases?

Accepted Answer

HR Security Profiles with case criteria that filters cases by assignment group 'HR Employee Relations' and user criteria that includes only members of that group.. HR Security Profiles with combined case and user criteria provide a robust, declarative way to restrict HR case access to a specific team. This approach ensures that only members of the HR Employee Relations team can view cases assigned to their group, meeting the security requirement without custom code.

Answer

A UI policy that hides the HR Case records from users not in the 'HR Employee Relations' group.

Answer

A client script that checks the user's assignment group and redirects them if they are not authorized.

Answer

A read ACL on the HR Case table that checks if the current user is a member of the 'HR Employee Relations' assignment group.