CIS-HR Security And Data Protection — Timed 10 Questions

Question 1

When configuring 'HR Security Profiles', what is the purpose of the 'Apply to' field?

Accepted Answer

To specify whether the profile covers HR Cases, HR Tasks, or both. The 'Apply to' field on HR Security Profiles determines the record scope the profile governs — specifically whether it applies to HR Cases, HR Tasks, or both. This lets administrators create granular access rules that differ between case-level and task-level records, since HR agents often need different visibility on tasks versus their parent cases.

Answer

To define which HR Service the profile controls

Answer

To assign the profile to a specific user group

Answer

To restrict the profile to specific geographic locations

Question 2

Which THREE of the following are primary methods for enforcing data protection within the HR Service Delivery application?

Accepted Answer

Before Query Business Rules. In HR Service Delivery, data protection is enforced primarily through the platform's access control and query-restriction mechanisms. Access Control Lists (ACLs) (B) are the core authorization layer that grants or denies read/write/create/delete access to tables and fields based on roles, conditions, and scripts, making them a primary enforcement method. Before Query Business Rules (A) run before a database query executes and can inject or modify query conditions to restrict which records a user can retrieve, providing row-level data protection. Query Business Rules (D) similarly run on query operations to add filters or conditions that limit the result set returned to the user, protecting sensitive HR records. Service Portal Theme settings (C) only control the look-and-feel and branding of the portal and have no bearing on data access. HR Criteria (E) are used to segment HR profiles/cases for routing and assignment logic, not to enforce record-level data protection.

Answer

Service Portal Theme settings

Answer

HR Criteria

Question 3

A user in the HR department reports they cannot see records in the 'HR Tasks' list, despite having the 'hr_task_reader' role. What is the most likely cause?

Accepted Answer

The 'HR Criteria' associated with the HR Task type excludes the user's department. The most likely cause is that the HR Criteria associated with the HR Task type excludes the user's department. HR Criteria are used to determine which HR tasks are visible to which users based on attributes like department, location, or role. Even if the user has the hr_task_reader role, if the HR Criteria for that task type does not include their department, they will not see the records.

Answer

The user is not in the 'hr_admin' group

Answer

The user needs the 'sn_hr_core.admin' role

Answer

The HR Case is in a 'Closed' state

Question 4

An HR Administrator needs to configure data masking for the 'SSN' field in the HR Profile (sn_hr_core_profile) table. Which feature should be used to ensure the data is masked for all users except those with the 'hr_admin' role?

Accepted Answer

Use the 'Field Encryption' module with an encryption context. Field Encryption with an encryption context is the correct feature to mask data for specific roles. It allows administrators to encrypt sensitive fields and control decryption based on roles, ensuring that only users with the 'hr_admin' role can view the unmasked data. This provides a robust security mechanism for PII like SSN.

Answer

Set a Business Rule on the sys_dictionary table

Answer

Apply a UI Policy to make the field read-only

Answer

Configure an HR Criteria record

Question 5

Which role is required to modify HR security configurations in a scoped application without having full system admin access?

Accepted Answer

delegated_developer. The delegated_developer role is designed specifically to allow developers to modify security configurations (such as ACLs, cross-scope privileges, and scoped application security) within their assigned scopes without granting them the full security_admin role. In ServiceNow scoped applications, delegated development lets an admin delegate security_admin-like privileges to a developer for a specific scope, enabling them to elevate and modify security artifacts. This satisfies the requirement of modifying HR security configurations without full system admin access.

Answer

security_admin

Answer

sn_hr_core.admin

Answer

hr_manager

Question 6

You need to restrict access to a specific HR Case so that only members of the 'Payroll' assignment group can view it. Which security mechanism should you configure?

Accepted Answer

Apply an HR Security Profile using the 'Restrict by Assignment Group' setting. Applying an HR Security Profile with the 'Restrict by Assignment Group' setting is the correct mechanism to restrict access to a specific HR Case so that only members of the 'Payroll' assignment group can view it. This profile enforces record-level access based on the assignment group, ensuring that only authorized users can see the case.

Answer

Set the 'Read' ACL on the sn_hr_core_case table to 'Public'

Answer

Modify the 'HR Service' definition to include a client script

Answer

Configure a Business Rule to modify the sys_id visibility

Question 7

You are configuring Delegated Development for an HR team member. You want to grant them permissions to create and modify HR Service Portal widgets, but you must prevent them from modifying the underlying HR security ACLs. Which scope role should be assigned to the developer?

Accepted Answer

delegated_developer. The 'delegated_developer' role combined with scoped application permissions allows specific development tasks without full admin rights.

Answer

sn_hr_core.manager

Answer

sn_hr_core.admin

Answer

security_admin

Question 8

Which of the following is true regarding 'HR Scoped Roles'?

Accepted Answer

They must be prefixed with 'sn_hr_core'. HR Scoped Roles must be prefixed with 'sn_hr_core' to indicate that they are scoped to the HR application. This naming convention is enforced by ServiceNow to ensure that roles are properly scoped and do not conflict with global roles. Therefore, the statement that they must be prefixed with 'sn_hr_core' is true.

Answer

They automatically grant access to global tables

Answer

They are automatically assigned to all users

Answer

They can only be created by the system administrator

Question 9

You need to ensure that 'Payroll' employees cannot see 'Employee Relations' cases. What is the standard ServiceNow best practice for this?

Accepted Answer

Configure HR Security Profiles to restrict access based on Assignment Group. The standard ServiceNow best practice is to configure HR Security Profiles to restrict access based on Assignment Group. HR Security Profiles allow granular control over which HR cases and tasks users can view, based on criteria such as assignment group, department, or location. This ensures that Payroll employees cannot see Employee Relations cases without custom scripting.

Answer

Use Query Business Rules to append 'sys_class_name' filters

Answer

Create a separate HR table for each department

Answer

Disable the 'Read' ACL for Payroll users

Question 10

If a user has both the 'hr_admin' and 'sn_hr_core.admin' roles, which role takes precedence for HR data security?

Accepted Answer

sn_hr_core.admin. ServiceNow security evaluation generally grants access if any role is present, but scoped admin roles are required for specific HR application configuration.

Answer

They are evaluated together

Answer

hr_admin

Answer

The system admin role