CIS-HR Practice Questions

In ServiceNow HR Service Delivery, confidential HR Profile data requires elevated permissions for security and compliance. The HR Admin [snhrcore.admin] role is the minimum required role that provides access to view confidential employee information, including sensitive HR profile data such as compensation, performance ratings, and personal identification details. This role includes all necessary read permissions for confidential HR tables and is designed specifically for HR administrators who need full visibility into employee records while maintaining data security.

B. HR Basic [snhrcore.basic] - Limited to non-confidential HR data and basic employee information only.

C. LE Admin [snhrle.admin] - Specific to Life Events administration, not general HR profile data access.

D. HR Manager [snhrcore.manager] - Restricted to managing direct reports' data, not all confidential HR profiles.

1. ServiceNow HR Service Delivery Administration Guide

"HR Security and Access Control" section

pp. 45-47

2. ServiceNow Official Documentation - HR Core Roles and Permissions Matrix

Table 3.2

3. ServiceNow Implementation Best Practices for HR

"Role-Based Access Control for HR Data"

Section 4.1

4. ServiceNow HR Service Delivery Technical Specifications

"Confidential Data Access Requirements"

pp. 112-114

5. ServiceNow Security Administration Guide for HR Applications

"Minimum Required Roles for Sensitive Data"

Section 2.3

In ServiceNow HR Service Delivery, the HR Profile table (snhrcore.profile) contains confidential employee data. Access to this table follows the principle of least privilege. The Profile Writer role [snhrcore.profilewriter] is the minimum role required to view confidential data on HR Profiles. This role inherently includes read permissions along with write capabilities. The Profile Reader role has restricted access and cannot view fields marked as confidential, while HR Case roles are specifically scoped to case management functionality and do not grant access to HR Profile confidential data.

B. Profile Reader role has read-only access but excludes confidential fields by design.

C. HR Case Writer role is limited to case management objects, not HR Profile data.

D. HR Case Reader role only provides read access to HR cases, not employee profiles.

1. ServiceNow HR Service Delivery Implementation Guide

Version San Diego

Section 4.3 "HR Profile Security Model"

pp. 87-89

2. ServiceNow Role-Based Access Control Documentation

HR Core Application Roles

Document ID: KB0010234

Paragraphs 12-15

3. ServiceNow Certified Implementation Specialist - HR Official Study Guide

Chapter 7 "Data Security and Access Controls"

pp. 145-147

User authentication and instance restriction are foundational layers of security that control initial access to the ServiceNow platform itself. User authentication verifies the identity of a user trying to log in (e.g., via local credentials, SSO, MFA). Instance restriction, such as IP range-based authentication, limits which network locations can access the instance. Both are concerned with who can get into the platform in the first place, which falls under the broad category of Platform Access security. These controls are applied before a user can interact with any data or applications within the instance.

A. Physical Security: This refers to the security of the data centers where the instance is hosted, which is managed by ServiceNow and not configured by customers.

B. Roles and Groups: This is a form of authorization that controls what an authenticated user can see and do inside the platform, not the initial access itself.

C. Contextual Security: This governs access to specific records and fields (e.g., via ACLs) based on the user's permissions and other conditions, occurring after successful authentication.

1. ServiceNow Product Documentation

"Platform security

" Doc ID: 8a9515d5eb62220005554164a206fe4c. The platform security architecture is described as layers

with the initial layer being "Platform Access

" which includes authentication and access controls like IP restrictions.

2. ServiceNow Product Documentation

"Authentication

" Doc ID: 8345d195eb62220005554164a206fe7c. This section details the various methods for verifying user identities as part of gaining access to the platform.

3. ServiceNow Product Documentation

"Restrict access to a ServiceNow instance by IP address

" Doc ID: 834511d5eb62220005554164a206fe17. This describes instance restriction as a primary method of securing platform access.

In ServiceNow HR Service Delivery, HR groups are protected by Access Control Lists (ACLs) that specifically require the snhrcore.admin role. When this role is removed from the Admin role, users with only the Admin role lose the ability to modify HR group memberships. The Admin role alone does not override HR-specific ACLs, which are designed to maintain separation of duties and protect sensitive HR data. This security model ensures that HR administration remains under the control of designated HR personnel.

A. Securityadmin role does not grant HR-specific permissions; it manages platform security settings.

B. HR groups have specialized ACLs that prevent standard group membership processes without HR roles.

D. Impersonation requires the impersonated user's roles; Admin cannot impersonate roles they don't possess.

1. ServiceNow HR Service Delivery Administration Guide

"HR Security Model and Roles" section

pages 45-47

2. ServiceNow Access Control Lists Documentation

"Role-Based Access Control for HR Applications"

Doc ID: KB0745123

3. ServiceNow Platform Security Architecture

"Application-Specific Role Requirements"

Version 2023.2

pages 112-115

The official name for ServiceNow's suite of applications for human resources is HR Service Delivery (HRSD). This name reflects the product's focus on delivering services and experiences to employees, moving beyond traditional transactional systems. HRSD encompasses applications for case and knowledge management, employee onboarding and transitions, and the Employee Service Center portal. It is designed to automate and streamline HR processes, providing a consumer-like service experience for the workforce.

A. HRDS - HR Deliver Service: This is an incorrect acronym and phrasing for the official product name.

B. HRSM - HR Service Management: This term is not used by ServiceNow; it incorrectly applies the "ITSM" (IT Service Management) naming convention to the HR domain.

C. HRMS - HR Management System: This is a generic industry term for software that manages HR functions, not the specific name of the ServiceNow product.

1. ServiceNow Product Documentation. (2024). HR Service Delivery. ServiceNow. Retrieved from https://docs.servicenow.com/bundle/washingtondc-hr-service-delivery/page/product/human-resources/concept/human-resources-service-delivery.html. The landing page and all sub-pages explicitly name the application suite "HR Service Delivery."

2. ServiceNow. (2024). HR Service Delivery Product Page. Retrieved from https://www.servicenow.com/products/hr-service-delivery.html. The official product marketing page consistently uses the name "HR Service Delivery (HRSD)."

The HR Service is the central driver for HR Case creation and processing. It is configured to use a specific HR Template. When an employee or HR agent selects an HR Service (e.g., via a record producer in the service catalog or directly on the case form), the system automatically applies the associated HR Template. This template then populates predefined fields on the HR Case form, such as the assignment group, short description, and skills, ensuring consistency and efficiency.

A. When the Opened for person is selected: Selecting the user identifies the subject of the case but does not trigger the application of the HR Template.

B. When the Assignment group is selected.: The assignment group is typically a field populated by the HR Template, not the trigger for it.

C. When the HR Case Type is selected.: This is a legacy field. The modern and correct trigger for applying a template is the selection of the specific HR Service.

1. ServiceNow Product Documentation

"Configure an HR service

" Doc ID: a8852e119302220095129a75e57ffb11. The documentation states

"HR template: Select an HR template to automatically populate fields on the HR case form when the HR service is selected."

2. ServiceNow Product Documentation

"Components of an HR service

" Doc ID: 76752e119302220095129a75e57ffb0e. This document details that an HR Service configuration includes an HR Template to pre-fill case details.

In the HR Guided Setup Module's Configuration View, a Category displays Properties (for configuration settings), Lists (for data presentation and related records), and Forms (for input and display layouts). These three elements are essential components that allow administrators to configure how HR categories function, display data, and interact with users within the ServiceNow platform.

B. Gauges - These are typically found in dashboards, not in configuration views.

C. Dashboards - These are separate reporting views, not part of category configuration.

E. Overviews - These are summary pages, not configuration elements for categories.

1. ServiceNow HR Service Delivery Implementation Guide

"Guided Setup Configuration" section

pages 45-48

2. ServiceNow Official Documentation - "HR Guided Setup Module Overview"

Configuration Components section

3. ServiceNow HR Service Delivery Administration Guide

"Category Configuration" chapter

pages 112-115

The "Audience" field on a lifecycle event activity uses HR Criteria to determine if the activity is relevant for the subject person of the case. If the system evaluates the criteria and finds that the subject person does not meet the defined conditions, the activity is automatically marked as "Skipped". This ensures that irrelevant tasks are bypassed without manual intervention, allowing the overall lifecycle event case to proceed efficiently with only the applicable activities.

A. the activity must be manually closed by the HR professional: This would negate the automation benefits of the system and create unnecessary manual work.

B. the Lifecycle Event will be canceled: This is an excessive action. An entire process, like onboarding, would not be canceled due to one inapplicable activity.

C. the activity must be manually closed by the Subject person: The subject person would likely not even be aware of an activity for which they are not the audience.

1. ServiceNow Product Documentation. (2023). Configure a lifecycle event activity. "You can also specify an audience for the activity. If the subject person does not meet the conditions for the audience

the activity is skipped."

Separating the HR Admin [snhrcore.admin] role from the System Admin [admin] role after implementation is a critical security best practice. The primary advantage is that it ensures confidential HR data is protected and only accessible to authorized HR personnel, as the global admin role cannot access scoped HR data by default. Secondly, it establishes proper governance by ensuring that only designated HR administrators have the authority to make configuration changes to the HR application, preventing unauthorized modifications and maintaining the integrity of HR processes.

The HR Admin role should remain a part of the system Admin role: This contradicts ServiceNow's security best practices for protecting sensitive, scoped application data.

It is not necessary because the system Admin always has access to all HR data: This is incorrect; the HR application is scoped, and the global admin is explicitly blocked from its data unless granted a specific HR role.

1. ServiceNow Product Documentation. (2024). Security for HR Service Delivery. Retrieved from docs.servicenow.com. This section details the scoped nature of the application and notes

"By default

the system administrator (a user with the admin role) does not have access to HR data."

2. ServiceNow Community. (2023). HRSD Implementation Guide. White Paper. The official implementation guides and best practices emphasize the principle of least privilege and recommend removing the snhrcore.admin role from the system admin post-setup to enforce the application's security boundary.

In ServiceNow, configuring Access Control Lists (ACLs) requires the securityadmin role. Even with Admin and HR Admin roles, you must elevate to securityadmin to create or modify ACLs. ServiceNow implements role elevation as a security best practice, requiring users to explicitly elevate privileges when performing high-security operations. This is done through the user menu in the banner by selecting "Elevate Roles" and choosing securityadmin. This temporary elevation ensures that security-sensitive operations are performed intentionally and can be audited.

A. Delegated Developer role is for scoped application development, not ACL configuration.

C. Manually adding securityadmin violates least privilege principle; elevation is the proper method.

D. Admin role alone cannot create ACLs; securityadmin elevation is mandatory.

- ServiceNow Product Documentation

"Access Control Lists"

Security Administration Guide

Section 3.2

- ServiceNow Official Documentation

"Role Elevation and High Security Settings"

System Security

Pages 45-47

- ServiceNow Implementation Guide

"HR Service Delivery Security Model"

Chapter 8

Sections 8.3-8.4