WORKDAY-PRO-HCM-CORE practice question 6 of 15

You created a Role-Based (Unconstrained) security group and a User-Based security group. Both security groups have access to the domain that secures the Staffing tab of a supervisory organization. What access will members of each group have?

Full set: 192 questions

Domain Security

Answer options
A: Role-Based (Unconstrained) can view the Staffing tab of supervisory organizations they are assigned to support. User-Based can view the Staffing tab of all supervisory organizations.
B: Role-Based (Unconstrained) can view the Staffing tab of all supervisory organizations. User-Based can view the Staffing tab of supervisory organizations they are assigned to support.
C: Both security groups can view the Staffing tab of all supervisory organizations. Correct answer
D: Both security groups can view the Staffing tab of supervisory organizations they are assigned to support.
Correct Answer:
C. Both security groups can view the Staffing tab of all supervisory organizations.
Explanation

Both Role-Based (Unconstrained) and User-Based security groups provide access that is not limited by organizational context or hierarchy. A Role-Based (Unconstrained) group grants its members permissions to all instances of the secured data across the entire tenant. Similarly, a User-Based security group is inherently unconstrained; it grants specified users direct access to all data secured by a domain system-wide. Since both groups are granted access to the domain securing the Staffing tab, members of both groups will be able to view this tab for all supervisory organizations in the Workday tenant.

Why Incorrect

A. This is incorrect because Role-Based (Unconstrained) security provides access to all organizations, not just those a user is assigned to support.
B. This is incorrect because User-Based security is also unconstrained, granting access to all organizations, not just a supported subset.
D. This is incorrect because it describes the behavior of constrained security groups, whereas both groups in the scenario are unconstrained.

References

1. Workday Security Administration Documentation; Section: Security Group Types. This official guide details the different types of security groups. It specifies that User-Based security groups are unconstrained and provide access to data across the entire Workday tenant. For example, an Auditor role assigned via a User-Based group would have tenant-wide access.

2. Workday Security Administration Documentation; Section: Role-Based Security Groups. This section distinguishes between constrained and unconstrained role-based groups. It explicitly states that unconstrained roles, such as Security Administrator or Implementer, have permissions that are not limited by their organizational assignments and apply tenant-wide.

3. Cornell University, Workday Training & Resources; Document: Workday Security Roles. Courseware materials from institutions implementing Workday often clarify these core concepts. Such materials explain that unconstrained roles are for central administrators needing system-wide access, while user-based groups are for specific individuals needing similar broad access outside of a standard organizational role. (Reference to general university implementation documentation principles).

Question breakdown

Tests
Distinguish security group types and their scope of access
Difficulty
Medium

Key idea: Unconstrained role-based groups and user-based groups both grant access to every instance secured by a domain, regardless of organization assignment.

How to reach the answer

  1. Note the qualifier '(Unconstrained)' on the role-based group; that removes the organizational limit.
  2. Recall that user-based security groups are assigned directly to users and have no organizational context, so they are inherently unconstrained.
  3. Since both groups are on the same domain, both reach all instances it secures.
  4. Pick the option that gives both groups tenant-wide access.

Each option

  • AIncorrect. An unconstrained role-based group is not limited to the organizations where the role is assigned.
  • BIncorrect. User-based groups have no organizational context to restrict them, so they are not limited to supported orgs.
  • CCorrect. Neither group type is constrained, so both see the Staffing tab of every supervisory organization.
  • DIncorrect. This describes constrained role-based behavior, which neither group in the scenario uses.

Common trap: Assuming any 'role-based' group is limited to assigned organizations, or that user-based groups are narrow because they list specific people.

In practice: When granting central HR, auditors, or security admins tenant-wide visibility, you choose unconstrained role-based or user-based groups; misunderstanding this can expose data across the whole company.

Remember: Unconstrained role-based and user-based groups both grant access to all instances of the domain's data tenant-wide.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free WORKDAY-PRO-HCM-CORE practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other WORKDAY-PRO-HCM-CORE practice questions

Scroll to Top