CIS-HR Security And Data Protection Practice Test 5 — 15 Questions

Question 1

What is the role of the 'HR Service' definition in data security?

Accepted Answer

It links to 'HR Criteria' for visibility control. The HR Service definition links to HR Criteria, which determine which employees can see and request the service. This linkage controls visibility and access to HR services based on user attributes. Thus, the HR Service definition plays a role in data security by governing who can view the service and related cases.

Answer

It defines the encryption level

Answer

It manages the user's role assignment

Answer

It contains the ACL scripts for the case

Question 2

When an HR service is restricted by 'HR Criteria', what happens when a user attempts to open a case they don't have access to via the portal?

Accepted Answer

The system returns 'Record not found'. When HR Criteria restricts access to an HR service, the system does not reveal the existence of the restricted case to unauthorized users. Instead, it returns a 'Record not found' message, which prevents information leakage about the existence of cases the user is not entitled to see. This is a deliberate security design choice in ServiceNow HR Service Delivery to protect sensitive employee data.

Answer

The system prompts for admin credentials

Answer

An 'Access Denied' error message is displayed

Answer

The system redirects them to the login page

Question 3

Which 'HR Security Profile' setting defines whether the profile is active?

Accepted Answer

The 'Active' boolean field. The 'Active' boolean field on the HR Security Profile record defines whether the profile is active. When this field is checked (true), the profile is active and its criteria are evaluated for access. When unchecked, the profile is inactive and ignored.

Answer

The 'Access' checkmark

Answer

The 'Profile Status' field

Answer

The 'Enable' button in the related link

Question 4

Which table holds the 'HR Profile' data?

Accepted Answer

sn_hr_core_profile. The sn_hr_core_profile table is the central storage for employee HR data.

Answer

sn_hr_core_case

Answer

cmn_location

Answer

sys_user

Question 5

If a user is assigned to multiple 'HR Security Profiles', how does the system determine the final access level?

Accepted Answer

The system evaluates all assigned profiles (additive). When a user is assigned to multiple HR Security Profiles, the system evaluates all assigned profiles and combines their permissions additively. This means the user receives the union of access rights granted by each profile. There is no restriction to the most restrictive or first created; access is cumulative.

Answer

It errors out until only one is left

Answer

It uses the most restrictive profile

Answer

It uses the first one created

Question 6

What is the function of the 'Restricted Caller Access' (RCA) records?

Accepted Answer

To manage cross-scope access between applications. Restricted Caller Access (RCA) records in ServiceNow HR control cross-scope access between applications. They define which scopes are allowed to call into or access resources from another scope, enforcing scope isolation and preventing unauthorized cross-application data access. This is a security mechanism for managing inter-scope permissions.

Answer

To restrict admin users

Answer

To limit user access to apps

Answer

To define portal layout

Question 7

What is the primary way to define which HR users can access the 'HR Service Portal'?

Accepted Answer

User Criteria. User Criteria is the primary way to define which HR users can access the HR Service Portal. User Criteria allows administrators to specify conditions based on user attributes (e.g., role, department, location) to determine who can access portal content, including pages, widgets, and knowledge articles. This is the standard mechanism for controlling portal access in ServiceNow.

Answer

Role-based redirect

Answer

ACLs

Answer

HR Criteria

Question 8

If a field has 'Encryption' applied, how does the system handle searching for that data?

Accepted Answer

Searching is not supported for encrypted fields. When a field is encrypted in ServiceNow, the system stores the data in encrypted form and does not support searching on that field because the search would require decrypting all values, which is not feasible. Therefore, searching is not supported for encrypted fields. This is a deliberate limitation to maintain security.

Answer

It searches the cleartext automatically

Answer

It creates an index for the encrypted field

Answer

It asks the user to decrypt the data first

Question 9

Which TWO factors must be configured when setting up a new 'Delegated Developer' for HR?

Accepted Answer

The user account. When creating a Delegated Developer in ServiceNow, the two required factors are the user account (Option A) and the application scope (Option C). Option A is correct because a Delegated Developer must be tied to a specific user account so the system knows who is being granted the delegated development privileges. Option C is correct because delegated development is always scoped to a particular application scope, which defines exactly which application's artifacts the developer can modify. The user's location (Option B), assigned group (Option D), and HR role (Option E) are not required configuration factors for delegated development; while groups may be used for other access controls, they are not part of the delegated developer setup itself.

Answer

The user's location

Answer

The user's assigned group

Answer

The user's HR role

Question 10

Which TWO of the following are valid ways to secure sensitive HR data on the platform?

Accepted Answer

Access Control Lists (ACLs). Access Control Lists (ACLs) are a valid way to secure sensitive HR data because they enforce record-level and field-level authorization on the platform, restricting which users or roles can read, write, or delete specific records and fields. Column Level Encryption (CLE) is also valid because it encrypts individual field values at rest using a cryptographic module and key, so even users with database or table access cannot read the plaintext HR data without the appropriate encryption key and role. HR Criteria and User Criteria are not security mechanisms; they are conditions used to target or filter records (for example, in HR or user administration activities) and do not themselves restrict access. Business Rules are not a security control either; they automate logic, validation, or workflow behavior and do not provide the access enforcement or encryption needed to protect sensitive HR data.

Answer

HR Criteria

Answer

Business Rules

Answer

User Criteria

Question 11

Which TWO of the following can be used to restrict access to an HR Case?

Accepted Answer

HR Security Profiles. HR Security Profiles (B) are the ServiceNow HR-specific mechanism for restricting access to HR cases, as they define which HR case fields and records a user can view or modify based on their role and HR profile configuration. ACLs (D) are the platform's fundamental access control mechanism and can be applied to HR case tables and fields to enforce record-level and field-level read/write/create/delete restrictions. UI Policies (A) only control the visibility, mandatory, and read-only state of fields on a form and do not enforce security or restrict record access. User Preferences (C) are personal display settings and have no bearing on access control. Business Rules (E) execute server-side logic on database operations but are not an access-restriction mechanism; they cannot replace ACLs or HR Security Profiles for controlling who can access an HR case.

Answer

UI Policy

Answer

User Preferences

Answer

Business Rules

Question 12

Which THREE of the following are considered 'Sensitive HR Data' categories?

Accepted Answer

Social Security Number (SSN). Option A (Social Security Number) is correct because a government-issued national identifier is a classic sensitive HR data element whose exposure enables identity theft and is protected under privacy regulations. Option B (Salary Details) is correct because compensation data is confidential personal financial information whose unauthorized disclosure can cause workplace and legal harm. Option D (Medical Information) is correct because health and medical records are highly sensitive personal data, often classified as a special category under privacy laws such as GDPR and HIPAA. Option C (Employee Name) is not correct because a name alone is generally directory-level identifying information rather than sensitive HR data. Option E (Case Description) is not correct because a generic case description is not inherently a sensitive HR data category unless it contains specific protected elements.

Answer

Employee Name

Answer

Case Description

Question 13

Which TWO of the following are true about 'HR Criteria'?

Accepted Answer

It is reusable across HR services. Option C is correct because HR Criteria are defined once and can be reused across multiple HR services, allowing consistent eligibility logic to be applied wherever needed rather than redefining it per service. Option D is correct because HR Criteria support dynamic user attributes, meaning the criteria can evaluate values that change based on the user context at runtime rather than relying on static values. Options A, B, and E are not correct: HR Criteria do not replace roles entirely, they are not hard-coded (they are configurable and dynamic), and they are not limited to the portal but can be used across HR service contexts.

Answer

It replaces roles entirely

Answer

It is hard-coded

Answer

It only works for the portal

Question 14

Which THREE of the following are benefits of using 'Scoped Applications' for HR?

Accepted Answer

Easier updates. Scoped applications in ServiceNow provide easier updates (B) because each scope is versioned and can be published, installed, and upgraded independently, so HR app changes don't force updates to other customizations. Improved security (C) is a benefit because scoped apps enforce scope-level access controls, private script includes, and restricted cross-scope access, reducing the risk of unintended privilege escalation. Data isolation (D) is also correct because scoped apps keep their tables, business rules, and scripts within the application scope, preventing other applications from directly accessing or modifying HR data unless explicitly allowed. Unlimited storage (A) is not a feature of scoped applications, and automatic role assignment (E) is not provided by scoping; roles must still be assigned through ACLs, groups, or user administration.

Answer

Unlimited storage

Answer

Automatic role assignment

Question 15

Which TWO of the following are examples of 'HR Scoped Roles'?

Accepted Answer

sn_hr_core.case_writer. In ServiceNow HR Service Delivery, HR scoped roles are prefixed with the sn_hr_core scope and are contained within the HR application scope, so sn_hr_core.case_writer (B) is correct because it grants write access to HR cases within that scoped application, and sn_hr_core.admin (E) is correct because it is the administrative role for the HR Core scoped application. These roles are delivered as part of the HR Service Delivery plugin and are only assignable within the HR scope, which is exactly what defines an 'HR Scoped Role.' The other options are not HR scoped roles: itil (A) is a global, platform-level role granting ITIL process access, security_admin (C) is a global elevated role for security configuration, and user_admin (D) is a global role for user administration, none of which belong to the sn_hr_core scope.

Answer

itil

Answer

security_admin

Answer

user_admin