CIS-HR Security And Data Protection Practice Test 4 — 15 Questions

Question 1

An HR administrator needs to restrict access to sensitive employee medical records so that only the HR Benefits team can view them, even though other HR staff have the 'sn_hr_core.case_reader' role. Which security mechanism should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure ACLs on the specific table/field with role requirements. Access Control Lists (ACLs) are the correct mechanism to restrict access to specific tables or fields based on roles. By configuring ACLs on the medical records table or sensitive fields, the administrator can ensure only the HR Benefits team role can read them, even if other HR staff have the case_reader role. ACLs provide granular, role-based security at the record and field level.

Answer

Create a new HR Criteria record

Answer

Use Data Policies to read-only the records

Answer

Modify the HR Service Portal widget security settings

Question 2

Where do you go to view the HR Security Profiles assigned to a specific user?

Accepted Answer

HR Profile -> [User Name] -> Security Profiles. HR Security Profiles assigned to a specific user are viewed by opening the HR Profile record for that user and navigating to the Security Profiles related list. This shows exactly which HR security profiles are attached to that individual, which is the authoritative per-user view. The HR Profile is the central record linking a user to their HR-specific security configuration.

Answer

ACLs list

Answer

HR Administration -> HR Security -> HR Security Profiles

Answer

System Security -> Users

Question 3

What role is required for a user to manage 'HR Criteria' records?

Accepted Answer

hr_admin. The hr_admin role in ServiceNow HRSD is required to manage HR Criteria records, as it grants administrative access to HR configuration tables including HR Criteria, HR Profiles, and HR services. This role is designed for HR administrators who configure and maintain the HRSD application. Other roles listed are either read-only or unrelated to HR administration.

Answer

sn_hr_core.reader

Answer

itil

Answer

user_admin

Question 4

An organization requires that HR case data be encrypted at rest. What platform feature must be enabled?

Accepted Answer

Column Level Encryption (CLE). Column Level Encryption (CLE) is the platform feature that encrypts specific columns in a table, ensuring data at rest is encrypted. For HR case data, enabling CLE on the relevant fields (e.g., case description) satisfies the encryption at rest requirement. CLE uses the platform's encryption capabilities to protect sensitive data.

Answer

Contextual Security

Answer

Access Control Lists

Answer

HR Criteria

Question 5

To ensure that HR case 'Work Notes' are hidden from the employee portal, what should you configure?

Accepted Answer

ACLs on the sn_hr_core_case table for the work_notes field. Work notes on HR cases are hidden from the employee portal by configuring Access Control Lists (ACLs) on the sn_hr_core_case table specifically for the work_notes field, restricting read access to internal HR roles. ACLs are the correct mechanism because they enforce field-level security at the database and UI level, ensuring portal users cannot view or query work notes. Other options do not provide field-level read restriction on work notes.

Answer

HR Criteria

Answer

Catalog Item restriction

Answer

Business Rule on the task table

Question 6

If an HR table has a 'Read' ACL for the 'hr_admin' role, and you want to grant a new group 'HR_Auditors' access, what should you do?

Accepted Answer

Add 'HR_Auditors' to the existing ACL roles list. To grant a new group 'HR_Auditors' access when an HR table already has a 'Read' ACL for the 'hr_admin' role, you should add 'HR_Auditors' to the existing ACL's roles list. This extends the ACL to include the new group, allowing its members to read the records. This is the correct approach because ACLs can have multiple roles or groups associated with them.

Answer

Remove the 'hr_admin' role from the ACL

Answer

Change the ACL to 'Public'

Answer

Create a business rule for the auditors

Question 7

What is the purpose of the 'HR Criteria' 'Display' field?

Accepted Answer

It defines the label of the criteria record. The 'Display' field on an HR Criteria record defines the label that appears for that criteria record in the UI. It is a human-readable name used to identify the criteria, not a control for filtering, visibility to end users, or ACL behavior. Administrators set it so the criteria is recognizable when referenced in HR Security Profiles or related configurations.

Answer

To filter records on the portal

Answer

To show the criteria to end users

Answer

It controls the 'Read' ACL status

Question 8

Which feature enables the 'HR Scoped App' to hide its tables from non-HR users?

Accepted Answer

Scoped Application ACLs. Scoped Application ACLs are the correct mechanism because the HR Scoped App is a scoped application in ServiceNow, and scoped applications use their own ACLs to control access to their tables. By default, scoped app tables are not accessible to users outside the application scope unless explicitly granted. HR administrators configure ACLs within the HR scope to restrict table access to HR roles, effectively hiding HR tables from non-HR users.

Answer

HR Criteria

Answer

Business Rules

Answer

User Criteria

Question 9

What is the impact of checking 'Enforce HR Security' on a table in the 'HR Scoped App'?

Accepted Answer

It enables HR Security Profile evaluation for the table. Checking 'Enforce HR Security' on a table in the HR Scoped App activates HR Security Profile evaluation for that table. This means access is governed by HR security profiles (such as HR case assignment groups or HR criteria) rather than standard ACLs alone, ensuring sensitive HR data is only visible to authorized users. It does not encrypt data or require a specific role; it simply enables the HR security model for that table.

Answer

It automatically encrypts the data

Answer

It requires all users to have the 'hr_admin' role

Answer

It makes the table public

Question 10

Which ServiceNow feature identifies sensitive HR data fields for protection?

Accepted Answer

Data Classification. Data Classification is a ServiceNow feature that allows administrators to define classification levels (e.g., Public, Internal, Confidential, Restricted) and apply them to fields. It identifies sensitive HR data fields by tagging them with a classification, which can then be used to enforce security policies such as encryption or access controls. This directly addresses the need to identify sensitive data for protection.

Answer

HR Security Profiles

Answer

Delegated Developer

Answer

HR Criteria

Question 11

If a user has the 'sn_hr_core.case_writer' role, what can they do?

Accepted Answer

Create and update HR cases. The 'sn_hr_core.case_writer' role in ServiceNow HR Service Delivery is designed to grant users the ability to create and update HR cases. This role is typically assigned to HR agents or case managers who need to handle employee inquiries and process HR requests. It does not include permissions to modify system security settings, delete cases, or configure workflows, which are reserved for higher-level roles like admin or HR admin.

Answer

Modify system security settings

Answer

Delete HR cases

Answer

Configure HR Service workflows

Question 12

In a multi-scoped environment, how do you allow an HR role to access a global 'cmdb_ci' table?

Accepted Answer

By creating a Restricted Caller Access (RCA) record. In a multi-scoped environment, a Restricted Caller Access (RCA) record is the correct way to allow a scoped application (like HR) to access a table in another scope (like the global cmdb_ci table). RCA records explicitly grant cross-scope access to specific tables or scripts, bypassing the default scope isolation. This is the standard mechanism for controlled cross-scope access.

Answer

By changing the scope of the cmdb_ci table

Answer

By adding the 'hr_admin' role to the table

Answer

By using an HR Criteria

Question 13

What is the purpose of the 'Delegated Developer' role?

Accepted Answer

To allow developers to manage scoped applications without global admin. The Delegated Developer role allows a user to create and manage scoped applications within their assigned scope without requiring the global admin role. It grants development capabilities limited to the delegated scope, preserving least privilege while enabling application development. This is the standard way to let developers work in ServiceNow without full platform administrative rights.

Answer

To create new users

Answer

To allow users to modify all system settings

Answer

To allow end users to view HR cases

Question 14

When setting up 'HR Criteria', can you use both roles and conditions?

Accepted Answer

Yes, they are evaluated using an 'AND' logic. HR Criteria in ServiceNow HR Service Delivery can combine roles and conditions, and they are evaluated using AND logic — both the role requirement and the condition must be true for the criteria to match. This allows precise targeting of HR catalog items, cases, or knowledge articles to specific populations.

Answer

No, only user conditions are supported

Answer

Yes, but only for Admin roles

Answer

No, you must choose one or the other

Question 15

What is the benefit of using 'HR Criteria' instead of hard-coded ACL scripts?

Accepted Answer

It allows non-developers to manage complex security rules. The benefit of using 'HR Criteria' instead of hard-coded ACL scripts is that it allows non-developers to manage complex security rules through a user-friendly interface. HR Criteria provide a declarative way to define conditions for access, which can be maintained by HR administrators without writing code. This reduces dependency on developers and speeds up changes.

Answer

It is faster to execute

Answer

It replaces the need for roles

Answer

It forces the system to use encryption