CIS-HR Security And Data Protection — Timed 50 Questions

Question 1

When configuring 'HR Security Profiles', what is the purpose of the 'Apply to' field?

Accepted Answer

To specify whether the profile covers HR Cases, HR Tasks, or both. The 'Apply to' field on HR Security Profiles determines the record scope the profile governs — specifically whether it applies to HR Cases, HR Tasks, or both. This lets administrators create granular access rules that differ between case-level and task-level records, since HR agents often need different visibility on tasks versus their parent cases.

Answer

To define which HR Service the profile controls

Answer

To assign the profile to a specific user group

Answer

To restrict the profile to specific geographic locations

Question 2

Which THREE of the following are primary methods for enforcing data protection within the HR Service Delivery application?

Accepted Answer

Before Query Business Rules. In HR Service Delivery, data protection is enforced primarily through the platform's access control and query-restriction mechanisms. Access Control Lists (ACLs) (B) are the core authorization layer that grants or denies read/write/create/delete access to tables and fields based on roles, conditions, and scripts, making them a primary enforcement method. Before Query Business Rules (A) run before a database query executes and can inject or modify query conditions to restrict which records a user can retrieve, providing row-level data protection. Query Business Rules (D) similarly run on query operations to add filters or conditions that limit the result set returned to the user, protecting sensitive HR records. Service Portal Theme settings (C) only control the look-and-feel and branding of the portal and have no bearing on data access. HR Criteria (E) are used to segment HR profiles/cases for routing and assignment logic, not to enforce record-level data protection.

Answer

Service Portal Theme settings

Answer

HR Criteria

Question 3

A user in the HR department reports they cannot see records in the 'HR Tasks' list, despite having the 'hr_task_reader' role. What is the most likely cause?

Accepted Answer

The 'HR Criteria' associated with the HR Task type excludes the user's department. The most likely cause is that the HR Criteria associated with the HR Task type excludes the user's department. HR Criteria are used to determine which HR tasks are visible to which users based on attributes like department, location, or role. Even if the user has the hr_task_reader role, if the HR Criteria for that task type does not include their department, they will not see the records.

Answer

The user is not in the 'hr_admin' group

Answer

The user needs the 'sn_hr_core.admin' role

Answer

The HR Case is in a 'Closed' state

Question 4

An HR Administrator needs to configure data masking for the 'SSN' field in the HR Profile (sn_hr_core_profile) table. Which feature should be used to ensure the data is masked for all users except those with the 'hr_admin' role?

Accepted Answer

Use the 'Field Encryption' module with an encryption context. Field Encryption with an encryption context is the correct feature to mask data for specific roles. It allows administrators to encrypt sensitive fields and control decryption based on roles, ensuring that only users with the 'hr_admin' role can view the unmasked data. This provides a robust security mechanism for PII like SSN.

Answer

Set a Business Rule on the sys_dictionary table

Answer

Apply a UI Policy to make the field read-only

Answer

Configure an HR Criteria record

Question 5

Which role is required to modify HR security configurations in a scoped application without having full system admin access?

Accepted Answer

delegated_developer. The delegated_developer role is designed specifically to allow developers to modify security configurations (such as ACLs, cross-scope privileges, and scoped application security) within their assigned scopes without granting them the full security_admin role. In ServiceNow scoped applications, delegated development lets an admin delegate security_admin-like privileges to a developer for a specific scope, enabling them to elevate and modify security artifacts. This satisfies the requirement of modifying HR security configurations without full system admin access.

Answer

security_admin

Answer

sn_hr_core.admin

Answer

hr_manager

Question 6

You need to restrict access to a specific HR Case so that only members of the 'Payroll' assignment group can view it. Which security mechanism should you configure?

Accepted Answer

Apply an HR Security Profile using the 'Restrict by Assignment Group' setting. Applying an HR Security Profile with the 'Restrict by Assignment Group' setting is the correct mechanism to restrict access to a specific HR Case so that only members of the 'Payroll' assignment group can view it. This profile enforces record-level access based on the assignment group, ensuring that only authorized users can see the case.

Answer

Set the 'Read' ACL on the sn_hr_core_case table to 'Public'

Answer

Modify the 'HR Service' definition to include a client script

Answer

Configure a Business Rule to modify the sys_id visibility

Question 7

You are configuring Delegated Development for an HR team member. You want to grant them permissions to create and modify HR Service Portal widgets, but you must prevent them from modifying the underlying HR security ACLs. Which scope role should be assigned to the developer?

Accepted Answer

delegated_developer. The 'delegated_developer' role combined with scoped application permissions allows specific development tasks without full admin rights.

Answer

sn_hr_core.manager

Answer

sn_hr_core.admin

Answer

security_admin

Question 8

Which of the following is true regarding 'HR Scoped Roles'?

Accepted Answer

They must be prefixed with 'sn_hr_core'. HR Scoped Roles must be prefixed with 'sn_hr_core' to indicate that they are scoped to the HR application. This naming convention is enforced by ServiceNow to ensure that roles are properly scoped and do not conflict with global roles. Therefore, the statement that they must be prefixed with 'sn_hr_core' is true.

Answer

They automatically grant access to global tables

Answer

They are automatically assigned to all users

Answer

They can only be created by the system administrator

Question 9

You need to ensure that 'Payroll' employees cannot see 'Employee Relations' cases. What is the standard ServiceNow best practice for this?

Accepted Answer

Configure HR Security Profiles to restrict access based on Assignment Group. The standard ServiceNow best practice is to configure HR Security Profiles to restrict access based on Assignment Group. HR Security Profiles allow granular control over which HR cases and tasks users can view, based on criteria such as assignment group, department, or location. This ensures that Payroll employees cannot see Employee Relations cases without custom scripting.

Answer

Use Query Business Rules to append 'sys_class_name' filters

Answer

Create a separate HR table for each department

Answer

Disable the 'Read' ACL for Payroll users

Question 10

If a user has both the 'hr_admin' and 'sn_hr_core.admin' roles, which role takes precedence for HR data security?

Accepted Answer

sn_hr_core.admin. ServiceNow security evaluation generally grants access if any role is present, but scoped admin roles are required for specific HR application configuration.

Answer

They are evaluated together

Answer

hr_admin

Answer

The system admin role

Question 11

When configuring 'Delegated Developer', what privilege allows a user to modify 'HR Service' definitions?

Accepted Answer

Manage Application Files. The 'Manage Application Files' privilege allows a user to modify HR Service definitions because HR Services are stored as application files (records) in the system. This privilege grants the ability to create, update, and delete records within the application scope.

Answer

Manage Notifications

Answer

Manage Security

Answer

Manage Tables

Question 12

Which module contains the 'HR Security' configuration settings?

Accepted Answer

HR Administration -> HR Security. HR Administration is the primary location for HR configuration, including security profiles.

Answer

System Security -> HR

Answer

Self-Service -> HR Security

Answer

System Definition -> HR

Question 13

You need to allow HR managers to view sensitive employee information only while they are on the corporate VPN. What security tool is best suited for this?

Accepted Answer

ACLs with script conditions checking 'gs.getSession().getClientIP()'. ACLs with script conditions checking the client IP via gs.getSession().getClientIP() are the correct tool because they can enforce access based on network context (corporate VPN IP range) at the record level. This allows HR managers to view sensitive data only when their session originates from the VPN. Security profiles, criteria, and UI policies do not natively enforce IP-based access control.

Answer

HR Security Profiles

Answer

HR Criteria

Answer

UI Policy

Question 14

Who can modify HR Security Profiles?

Accepted Answer

Any user with the 'hr_admin' role. HR Security Profiles in ServiceNow can be modified by users with the hr_admin role. This role is specifically designed to administer HR security configurations, including security profiles that define access to HR data. It grants the necessary permissions to create, update, and delete HR security profiles.

Answer

Only the System Administrator

Answer

End users

Answer

Any user with the 'itil' role

Question 15

If an HR Case is assigned to a 'Group', how does the 'HR Security Profile' ensure only the assigned group members can see it?

Accepted Answer

By checking the 'Assignment Group' field on the case against the user's groups. The profile is evaluated against the user's membership and the case's assignment field.

Answer

By using an HR Criteria record for every case

Answer

By enforcing it via an ACL that checks for the 'itil' role

Answer

By hiding the record if it is not 'Assigned to' the user

Question 16

When using 'HR Criteria', which attribute can be used to restrict access based on the user's location?

Accepted Answer

User Location. HR Criteria in ServiceNow HRSD support a 'User Location' attribute that allows administrators to restrict access to HR services, cases, or content based on the user's location as defined in their HR profile. This is the correct attribute for location-based segmentation. Other attributes like role, IP address, or browser type are not HR Criteria attributes for location restriction.

Answer

User Role

Answer

IP Address

Answer

Browser Type

Question 17

How can you audit access to HR cases?

Accepted Answer

By using the 'System Log' and 'ACL' audit logs. Auditing access to HR cases requires visibility into both authentication/transaction activity and the ACL enforcement decisions that govern who can read or write HR case records. ServiceNow captures this through the System Log (syslog) for transaction-level events and the ACL audit logs (enabled via the 'Enable ACL failure logging' or 'Enable ACL debugging' system properties) which record which ACL rules allowed or denied access. Together these provide a defensible audit trail showing who accessed HR cases and whether the access was permitted.

Answer

By running a report on the 'sys_log' table

Answer

By looking at the 'HR Case' table history

Answer

By asking the users

Question 18

Which role is necessary to perform 'HR Case' deletions?

Accepted Answer

hr_admin. The hr_admin role is necessary to perform HR Case deletions because delete operations on HR case records require elevated administrative privileges. Standard HR case roles like hr_task_writer and sn_hr_core.reader do not include delete rights on HR cases. This ensures that sensitive HR case data is not accidentally or maliciously removed by non-administrative users.

Answer

hr_task_writer

Answer

sn_hr_core.reader

Answer

itil

Question 19

You need to ensure that HR case attachments are encrypted. What is the correct approach?

Accepted Answer

Enable 'Attachment Security' for the HR Scoped App. Attachments in ServiceNow inherit the security of the parent record, or you can use Attachment Encryption modules.

Answer

Rename the attachments

Answer

Encrypt the storage drive

Answer

Move files to a secure server

Question 20

Which THREE of the following are components of an HR Security Profile?

Accepted Answer

Name. In ServiceNow HR Service Delivery, an HR Security Profile is defined by three key components: Name (B), which provides the unique identifier/label for the profile so it can be referenced and applied to HR criteria and records; HR Services (C), which specify the set of HR services (catalog items/cases) that the profile grants access to; and Assignment Groups (E), which determine which HR assignment groups' members are granted access to the associated HR services and cases. These three together define who (via assignment groups) can access which HR services, under a named profile. Workflow (A) is a process automation construct used for approvals/tasks, not a component of an HR Security Profile, and UI Policy (D) is a form-behavior control (making fields mandatory/read-only/visible) unrelated to HR Security Profile composition.

Answer

Workflow

Answer

UI Policy