Security And Data Protection practice questions

To specify whether the profile covers HR Cases, HR Tasks, or both

The 'Apply to' field scopes an HR Security Profile to HR Cases, HR Tasks, or both, satisfying the requirement to control which record types the profile's permissions govern. This record-type targeting determines where the profile's access rules take effect, rather than granting permissions across all HR entities indiscriminately.

Before Query Business Rules

Before Query Business Rules execute prior to a query returning records, filtering out rows the user should not see. This satisfies the stem's data protection requirement by restricting visibility at the database query level, complementing ACLs and Query Business Rules.

Access Control Lists (ACLs)

Access Control Lists enforce record and field-level authorisation, evaluating roles, conditions and scripts before granting access. This satisfies the stem's data protection requirement by restricting who can read, write or query HR records, complementing Before Query and Query Business Rules.

Query Business Rules

Query Business Rules add conditions to queries, limiting which records a user retrieves based on their attributes. This satisfies the stem's data protection requirement by enforcing row-level visibility at query time, complementing ACLs and Before Query Business Rules.

The 'HR Criteria' associated with the HR Task type excludes the user's department

HR Criteria filter which HR Tasks a user can see based on conditions such as department. If the criteria exclude the user's department, records are hidden despite the hr_task_reader role, satisfying the stem's requirement for the most likely cause.

Use the 'Field Encryption' module with an encryption context

Field Encryption allows for role-based access to decrypted data.

delegated_developer

The delegated_developer role grants scoped application development rights, letting a user modify HR security configurations within that application's scope. It satisfies the stem's constraint of avoiding full system admin access, since privileges stay confined to the scoped app rather than extending across the entire instance.

Apply an HR Security Profile using the 'Restrict by Assignment Group' setting

An HR Security Profile with 'Restrict by Assignment Group' scopes read access to records matching the user's assignment group, satisfying the requirement that only Payroll members view this HR Case. Unlike ACL-based role restrictions, it filters dynamically by group membership, so access follows the assignment group rather than static role grants.

delegated_developer

The delegated_developer role grants widget creation and modification rights within the Service Portal without conferring ACL administration, satisfying the constraint that the HR team member must not alter HR security ACLs. Its scope is deliberately limited to development artefacts, so security configuration remains protected.

They must be prefixed with 'sn_hr_core'

HR scoped roles are created within the HR application scope, and ServiceNow enforces the sn_hr_core prefix so the role name identifies its owning scope. This naming convention prevents collisions with roles from other scopes and confirms the role belongs to HR Core.

Configure HR Security Profiles to restrict access based on Assignment Group

HR Security Profiles restrict case visibility by Assignment Group, so Payroll staff only see cases assigned to their group and cannot access Employee Relations cases. This is the standard ServiceNow mechanism satisfying the stem's segregation requirement.

sn_hr_core.admin

The scoped admin role is required to manage scoped application security settings.

Manage Application Files

Manage Application Files grants delegated developers the privilege to create and modify application artefacts, including HR Service definitions. It satisfies the stem's requirement by permitting changes to HR Service records without granting broader administrative rights.

HR Administration -> HR Security

This is the correct navigation path.

ACLs with script conditions checking 'gs.getSession().getClientIP()'

ACLs with script conditions checking `gs.getSession().getClientIP()` enforce access at the record level, evaluating the user's source IP on every query. This satisfies the VPN-only constraint directly, since requests originating outside the corporate VPN range fail the condition and are denied. Microsoft Entra ID conditional access cannot inspect ServiceNow session IPs this granularly.

Any user with the 'hr_admin' role

HR Security Profiles are governed by the HR application's own role model, not platform-level administration. The 'hr_admin' role carries the elevated privileges required to create and amend these profiles, satisfying the stem's requirement for who may modify them. Users lacking that role cannot alter profile definitions, regardless of other access.

By checking the 'Assignment Group' field on the case against the user's groups

The HR Security Profile compares the case's Assignment Group field with the user's group memberships, granting visibility only on a match. This satisfies the stem's requirement by restricting case access to members of the assigned group.

User Location

User Location satisfies the HR Criteria location constraint by evaluating the geographic attribute stored against each identity record, allowing access rules to be scoped by where a user is based. Unlike IP-based network restrictions, this attribute derives from HR source data synchronised into Microsoft Entra ID, so it reflects the employee's recorded location rather than their current connection.

By using the 'System Log' and 'ACL' audit logs

System Log and ACL audit logs capture record-level read, write and delete events, including which user accessed which HR case. Enabling ACL auditing on the case table provides the traceable evidence needed for compliance reviews.

hr_admin

The hr_admin role carries the elevated privileges required to delete HR Case records, satisfying the stem's deletion constraint. Standard HR agents and case managers can create and update cases but lack the delete capability, which is restricted to administrators. Assigning hr_admin therefore grants the specific authority needed to remove cases entirely.

Enable 'Attachment Security' for the HR Scoped App

Attachment security ensures scoped policies apply to files.

Name

A Name is a required component of an HR Security Profile, satisfying the stem's demand for three valid components. It identifies the profile so administrators can assign it to HR users and audit its scope. Without a name, profiles cannot be distinguished or referenced during role configuration in Microsoft Entra ID.

HR Services

Profiles often target specific HR services.

Assignment Groups

Profiles are often applied to groups.