CCNA Security And Data Protection Questions

Scoped applications encapsulate their artefacts, so changes stay contained rather than touching global tables and scripts. This containment means patches and upgrades can be applied without overwriting customisations, satisfying the stem's benefit of easier updates across the HR application lifecycle.

Read ACLs on the HR case table are a standard way to control which roles can view HR case records. By requiring specific roles, you ensure that only authorized users can read the records. This is a fundamental security measure in ServiceNow and directly meets the requirement to restrict access based on roles.

HR Criteria replaces hard-coded ACL scripts with declarative, condition-based rules that business users configure through the ServiceNow interface. This satisfies the stem's constraint by removing developer dependency, letting HR staff maintain complex security logic themselves without scripting knowledge or code deployment cycles.

Attachments are stored in the sys_attachment table, and access to them is controlled by ACLs on that table. By creating an ACL that evaluates the associated HR case's assigned agent and opened_for fields, you can restrict download access to only those users. This is the correct approach because it directly secures the attachment records and integrates with the platform's security model.

HR Security Profiles are the primary HR-specific restriction mechanism, scoping case visibility by criteria such as department, location or HR service. They satisfy the requirement to limit which HR cases a user can access, alongside ACLs.

Access Control lists (ACLs) are the platform's native mechanism for row-level and field-level authorization. A read ACL on the HR Case table with a condition such as opened_by equals the session user restricts any query to only the records the user owns, applies consistently across list views, reports, portal widgets, and APIs, and is reusable without per-case-type scripting.

Column-level encryption protects sensitive HR fields such as salary or national insurance numbers at rest, so even database-level access reveals only ciphertext. This directly satisfies the stem's requirement to secure HR data within the instance, complementing access controls with cryptographic protection.

Social Security Number is a government-issued identifier that uniquely identifies an individual, so it falls within Sensitive HR Data categories. The stem asks for three such categories, and SSN qualifies because exposure enables identity theft and requires restricted handling.

Field-level ACLs evaluate specifically against the field being read, so a read ACL on the compensation fields that requires a privileged HR role will block employees from seeing salary and bonus while leaving other fields on the same HR Profile record readable. This is the most direct, declarative way to protect individual sensitive fields without hiding the entire record.

The Delegated Developer role grants scoped application development rights without requiring global admin, letting developers build and manage their own scoped apps. It satisfies the stem's requirement by enabling scoped application management without elevated global privileges.

ACLs are the platform's core authorization mechanism and evaluate on the server for every read and write. In HR Service Delivery they can restrict which HR cases, HR profiles, and specific fields a user can access, applying consistently across the UI, portals, and APIs. This makes ACLs a native and direct component of an HR data protection strategy.

sn_hr_core.case_writer is an HR-scoped role granting write access to HR cases, letting HR agents create and update case records. It satisfies the stem's requirement for genuine HR Scoped Roles, as its sn_hr_core prefix confines it to the HR application scope.

HR Security Profiles assigned to a user are viewed through the HR Profile record itself, not the user record. Opening HR Profile → [User Name] → Security Profiles lists every profile granted to that individual, satisfying the stem's requirement to see assignments for a specific user.

Access Control Lists on the sn_hr_core_case table governing the work_notes field restrict read access to internal roles, hiding work notes from the employee portal. This satisfies the stem's requirement by enforcing field-level security on the correct table and field.

This is correct because ACLs are the platform's standard mechanism for controlling record-level access. By creating a read ACL on the HR Case table that requires the 'sn_hr_core.case_reader' role, only users with that role (i.e., members of the HR Case Viewers group) will be able to read HR case records. This directly enforces the requirement without affecting other tables.

ACLs on the medical records table or fields enforce role-based access at the database layer, restricting reads to the HR Benefits role. The broader case_reader role cannot bypass ACL checks, giving precise field-level protection beyond UI policies or views.

Scoped Application ACLs restrict record access at the application boundary, so the HR Scoped App's tables stay invisible to users lacking HR roles. This satisfies the stem's requirement to hide tables from non-HR users, since ACLs evaluate the caller's roles before granting read access to any scoped table.

Platform Encryption allows field-level encryption at rest using keys managed in the Key Management Framework. Access to decrypt is controlled by roles that have permission to use the key. This meets the requirement for encrypted fields and role-based decryption without custom code.

The HR Service definition links to HR Criteria, which determines visibility control by matching user attributes. This linkage enforces data security, ensuring only users meeting the criteria can view records tied to that HR service.

Enabling 'Enforce HR Security' on a table triggers HR Security Profile evaluation, applying profile-based read, write and query rules to that table's records. This satisfies the stem's requirement by activating profile evaluation rather than merely assigning roles.

A delete ACL on the HR case table (sn_hr_core_case) that requires the HR administrator role will restrict delete operations to users with that role. This is the standard way to control record deletion in ServiceNow. By specifying the role in the ACL condition, only HR administrators can delete HR cases, meeting the requirement precisely.

The sn_hr_core.case_writer role grants write access to the HR case table, letting the holder open new cases and modify existing ones. It satisfies the stem's requirement to both create and update, without granting the broader configuration rights reserved for case_admin or HR admin roles.

Contextual security evaluates record attributes against the user's context at query time, so a department filter on HR case records dynamically restricts visibility to only those cases matching the user's own department. This satisfies the stem's requirement for dynamic, attribute-based restriction rather than static role-based access.

Encrypted field values are stored as ciphertext, so the database cannot match plaintext query strings against them. Platform search therefore returns no results for those fields, satisfying the stem's constraint that searching encrypted data is unsupported.

The HR Profile table in HR Service Delivery is sn_hr_core_profile, which stores the core employee HR record linked to a user. It satisfies the stem's requirement by being the dedicated table holding HR Profile data, distinguishing it from case, task, or lifecycle event tables that reference it.

ACLs enforce role-based restrictions at the record and field level, so only holders of sn_hr_core.admin can write to HR Services definitions. This satisfies the stem's requirement that the role restriction be enforced during service definition, which UI policies or business rules alone cannot guarantee.

Data encryption renders HR records unreadable without the correct decryption key, satisfying the requirement to prevent leakage even if files are copied, intercepted or stolen. It protects data at rest and in transit, so exposure of the underlying storage or network does not disclose salaries, health details or personal identifiers.

Before Query Business Rules execute before the query runs and can add or remove encoded query conditions, silently widening result sets beyond ACL restrictions. With ACLs verified intact, such a rule is the likely cause of unauthorised users reading HR Profile records, satisfying the stem's exposure scenario.

ACLs enforce record-level read, write and delete permissions directly on HR tables, so access is restricted to the specific employees, groups or roles named. This satisfies the stem's requirement to secure sensitive HR data at the data layer, independent of any UI or form-level restriction.

Log redaction strips or masks PII fields before records are written or shared, limiting exposure across HR Service Delivery systems. It satisfies the data protection strategy's requirement to minimise sensitive data propagation, complementing access controls and retention policies rather than replacing them.

Restricted Caller Access records govern cross-scope access between applications in ServiceNow, satisfying the stem's requirement to define that function. They explicitly permit or deny one application's scripts from reaching another scope's resources, overriding default cross-scope privilege behaviour. This makes them the mechanism for managing inter-application access boundaries.

Access accumulates across every assigned HR Security Profile, so the union of permissions applies rather than a single winning profile. This satisfies the stem's multiple-assignment constraint: the system evaluates all profiles additively, granting the combined access level. No precedence or override logic reduces the result, so the highest privilege from any profile is included.

HR criteria are defined once and referenced by multiple HR services, so the same rule set governs hiring, promotion and termination without duplication. This reusability across HR services is the defining property, letting administrators maintain consistent logic centrally rather than redefining criteria for each service.

The hr_admin role carries the elevated privileges needed to create, edit and delete HR Criteria records. Standard employee or manager roles lack this administrative scope, so hr_admin is the role that grants the required access.

The user account identifies which person receives the Delegated Developer role, granting them elevated development rights within the HR scope. It is one of the two required factors, paired with the application scope that bounds where those rights apply.

Field-level ACLs control access to a specific field independently of table-level ACLs. By creating a read ACL on the confidential notes field that requires the HR case manager role, only users with that role can read the field. Other HR agents who have table-level read access to HR cases will see the case but the field will be hidden. This is the standard approach for restricting sensitive fields.

Column Level Encryption encrypts designated table columns at rest, so HR case data is unreadable in the database without the encryption key. This platform capability directly satisfies the at-rest encryption requirement, unlike transport-layer or application-level controls.

ACLs are the standard ServiceNow mechanism to restrict record-level access based on conditions such as assignment group. By creating an ACL on the HR case table (sn_hr_core_case) with a condition that the assignment group matches the user's assignment group, you can ensure agents only see cases assigned to their group. This directly enforces the required restriction.

A Restricted Caller Access record grants a scoped application permission to call into a table outside its own scope, such as global cmdb_ci. This satisfies cross-scope access without altering the HR role's scope or granting broad global privileges.

The Display field controls the human-readable label shown for the HR Criteria record in lists and references. It does not affect evaluation logic or the conditions themselves; it simply gives administrators a meaningful name when selecting criteria elsewhere.

This is correct. ACLs are the platform's record-level security mechanism. By creating a read ACL on the HR Case table with a script condition that checks if the current user is the opener, the assigned to, or has the 'sn_hr_core.admin' role, you can enforce the requirement precisely. This ensures that only authorized users can view the case.

Field-level ACLs override table-level ACLs. By creating a read ACL on the employee_salary field that requires a more privileged role, the hr_agent will not have read access to that field even though they have table-level read access. This is the minimum configuration needed to hide the field. No other changes are required.

HR Criteria drives record-level read ACLs, so a case outside the user's criteria is filtered from query results entirely. The portal therefore cannot distinguish 'no access' from 'no such record', returning 'Record not found' rather than an authorisation error.

The 'Active' boolean field directly controls whether an HR Security Profile is enabled or disabled, satisfying the stem's requirement for the setting that defines profile activity status. Toggling this field to true activates the profile; setting it false deactivates it, making it the precise configuration element governing the profile's operational state.

HR Criteria combine roles and conditions with AND logic, so a record qualifies only when the user holds the specified role *and* meets every configured condition. This satisfies the stem's requirement to use both together, narrowing matching precisely rather than broadening it as OR would.

User Criteria define which users or groups match conditions granting access to the HR Service Portal, controlling visibility at the portal level. This satisfies the scenario's requirement for the primary mechanism defining HR user access.

This is true. The encryption context is a configuration that specifies the fields to encrypt and the roles that are allowed to decrypt. It can be scoped to specific fields, allowing granular control over which data is encrypted and who can access it. This is essential for compliance with data protection regulations.

A read ACL on the 'Notes' field can include a condition that checks the case's confidentiality status. If the case is marked 'Confidential', the ACL denies read access to the field for HR agents. This directly prevents agents from viewing the notes in confidential cases while allowing access in non-confidential ones. Field-level ACLs are ideal for this granular control.

Data Classification applies classification tags to fields, letting administrators mark sensitive HR data such as salary or personal details for protection. It satisfies the scenario's requirement for a feature that identifies sensitive HR data fields.

ACLs are the standard ServiceNow mechanism for enforcing record-level security. By creating an ACL on the HR case table that checks if the case's opened_for or employee field matches the logged-in user, you can ensure employees only see their own cases. This is the correct and secure way to enforce this requirement in the HR Service Portal.

Adding HR_Auditors to the existing ACL's roles list grants that group the same Read access without creating a duplicate ACL. This satisfies the access requirement while preserving a single, maintainable rule for the HR table.

This is correct. HR criteria support advanced conditions where you can use OR to combine multiple conditions. By creating a single HR criterion with an advanced condition that checks if the user's department is 'HR' OR if the user has the 'hr_admin' role, you can accurately include all required users. This is the most efficient and maintainable approach.