CIS-HR practice question 4 of 10

After the HR Admin [sn_hr_core.admin] role has been removed from the Admin role, how may a user with only the Admin role add members to HR groups?

Full set: 136 questions

Answer options

A: The Admin must elevate their role to security_admin to add members to HR groups.

B: The Admin follows the same process as with any group membership change.

C: The Admin can no longer add members to HR groups. Correct answer

D: The Admin must impersonate an HR Admin to add members to HR groups.

Correct Answer:

C. The Admin can no longer add members to HR groups.

Explanation

In ServiceNow HR Service Delivery, HR groups are protected by Access Control Lists (ACLs) that specifically require the snhrcore.admin role. When this role is removed from the Admin role, users with only the Admin role lose the ability to modify HR group memberships. The Admin role alone does not override HR-specific ACLs, which are designed to maintain separation of duties and protect sensitive HR data. This security model ensures that HR administration remains under the control of designated HR personnel.

Why Incorrect

A. Securityadmin role does not grant HR-specific permissions; it manages platform security settings.
B. HR groups have specialized ACLs that prevent standard group membership processes without HR roles.
D. Impersonation requires the impersonated user's roles; Admin cannot impersonate roles they don't possess.

References

1. ServiceNow HR Service Delivery Administration Guide

"HR Security Model and Roles" section

pages 45-47

2. ServiceNow Access Control Lists Documentation

"Role-Based Access Control for HR Applications"

Doc ID: KB0745123

3. ServiceNow Platform Security Architecture

"Application-Specific Role Requirements"

Version 2023.2

pages 112-115

Keep practicing

Take the free CIS-HR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test