WORKDAY-PRO-HCM-CORE practice question 6 of 15

You created a Role-Based (Unconstrained) security group and a User-Based security group. Both security groups have access to the domain that secures…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Security

You created a Role-Based (Unconstrained) security group and a User-Based security group. Both security groups have access to the domain that secures the Staffing tab of a supervisory organization. What access will members of each group have?

Answer options

Correct Answer:

Explanation

Both Role-Based (Unconstrained) and User-Based security groups provide access that is not limited by organizational context or hierarchy. A Role-Based (Unconstrained) group grants its members permissions to all instances of the secured data across the entire tenant. Similarly, a User-Based security group is inherently unconstrained; it grants specified users direct access to all data secured by a domain system-wide. Since both groups are granted access to the domain securing the Staffing tab, members of both groups will be able to view this tab for all supervisory organizations in the Workday tenant.

Why Incorrect

A. This is incorrect because Role-Based (Unconstrained) security provides access to all organizations, not just those a user is assigned to support.

B. This is incorrect because User-Based security is also unconstrained, granting access to all organizations, not just a supported subset.

D. This is incorrect because it describes the behavior of constrained security groups, whereas both groups in the scenario are unconstrained.

References

1. Workday Security Administration Documentation; Section: Security Group Types. This official guide details the different types of security groups. It specifies that User-Based security groups are unconstrained and provide access to data across the entire Workday tenant. For example

an Auditor role assigned via a User-Based group would have tenant-wide access.

2. Workday Security Administration Documentation; Section: Role-Based Security Groups. This section distinguishes between constrained and unconstrained role-based groups. It explicitly states that unconstrained roles

such as Security Administrator or Implementer

have permissions that are not limited by their organizational assignments and apply tenant-wide.

3. Cornell University

Workday Training & Resources; Document: Workday Security Roles. Courseware materials from institutions implementing Workday often clarify these core concepts. Such materials explain that unconstrained roles are for central administrators needing system-wide access

while user-based groups are for specific individuals needing similar broad access outside of a standard organizational role. (Reference to general university implementation documentation principles).

Question 6 of 15

Question breakdown

Tests: Distinguish security group types and their scope of access
Difficulty: Medium

Key idea: Unconstrained role-based groups and user-based groups both grant access to every instance secured by a domain, regardless of organization assignment.

How to reach the answer

Note the qualifier '(Unconstrained)' on the role-based group; that removes the organizational limit.
Recall that user-based security groups are assigned directly to users and have no organizational context, so they are inherently unconstrained.
Since both groups are on the same domain, both reach all instances it secures.
Pick the option that gives both groups tenant-wide access.

Each option

AIncorrect. An unconstrained role-based group is not limited to the organizations where the role is assigned.
BIncorrect. User-based groups have no organizational context to restrict them, so they are not limited to supported orgs.
CCorrect. Neither group type is constrained, so both see the Staffing tab of every supervisory organization.
DIncorrect. This describes constrained role-based behavior, which neither group in the scenario uses.

Common trap: Assuming any 'role-based' group is limited to assigned organizations, or that user-based groups are narrow because they list specific people.

In practice: When granting central HR, auditors, or security admins tenant-wide visibility, you choose unconstrained role-based or user-based groups; misunderstanding this can expose data across the whole company.

Remember: Unconstrained role-based and user-based groups both grant access to all instances of the domain's data tenant-wide.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free WORKDAY-PRO-HCM-CORE practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test