CSA - ServiceNow System Administrator Users, Groups, and Roles Questions and Answers 1 — Questions and Answers
Question 1: A user belongs to two groups: 'Service Desk' and 'Change Approvers'. The 'Service Desk' group has the 'itil' role. The 'Change Approvers' group has the 'approver_user' role. Which of the following statements is true regarding the user's permissions?
- The user can perform actions permitted by both the 'itil' and 'approver_user' roles. (Correct answer)
- The user's permissions are determined only by their primary group.
- The user must choose a role to impersonate upon logging in.
- The user will only have the permissions of the 'itil' role because it is a more permissive role.
Correct answer: The user can perform actions permitted by both the 'itil' and 'approver_user' roles.
In ServiceNow, when a user is a member of multiple groups, they inherit the roles from all of those groups. The permissions are cumulative. Therefore, the user will have the capabilities of both the 'itil' role (from the Service Desk group) and the 'approver_user' role (from the Change Approvers group).
Question 2: A ServiceNow administrator needs to grant access to a new custom application. According to ServiceNow best practices, what is the recommended method for assigning roles to a large number of users?
- Assign the application role directly to each individual user record.
- Create a new group, assign the application role to the group, and then add users to the group. (Correct answer)
- Create a business rule that automatically adds the role to users based on their department.
- Temporarily elevate the privileges of each user to 'admin' to grant the role, then revert the privileges.
Correct answer: Create a new group, assign the application role to the group, and then add users to the group.
ServiceNow best practice is to assign roles to groups rather than to individual users. This simplifies administration, as you only need to manage group memberships rather than individual role assignments. When a user is added to a group, they automatically inherit all the roles assigned to that group.
Question 3: Which of the following is a key characteristic of a Role in ServiceNow?
- It is a collection of users with a common purpose.
- It is a record in the sys_user table.
- It controls access to features and capabilities. (Correct answer)
- It is primarily used for assigning tasks and approvals.
Correct answer: It controls access to features and capabilities.
A role in ServiceNow is a record in the `sys_user_role` table that controls access to applications, modules, and other features. Groups are collections of users, and user records are stored in the `sys_user` table. While roles indirectly affect task assignment by granting access, their primary function is access control.
Question 4: An IT manager wants to ensure that only members of the 'Network' group can be assigned network-related incidents. When an incident is categorized as 'Network', the 'Assignment group' field is correctly populated with the 'Network' group. However, the 'Assigned to' field still allows lookup of any ITIL user. What feature ensures the 'Assigned to' field is dependent on the 'Assignment group'?
- A Client Script
- An Assignment Rule
- A Reference Qualifier (Correct answer)
- A UI Policy
Correct answer: A Reference Qualifier
A Reference Qualifier is used to filter the records that are returned for a reference field. In this scenario, a dynamic reference qualifier can be configured on the 'Assigned to' field to restrict the selectable users to only those who are members of the group specified in the 'Assignment group' field. This is out-of-the-box functionality for task tables.
Question 5: Where in the ServiceNow platform would a system administrator navigate to create and manage user groups?
- System Properties > Groups
- System Definition > Groups
- User Administration > Groups (Correct answer)
- Self-Service > My Groups
Correct answer: User Administration > Groups
User groups are managed within the User Administration application. The specific module is 'Groups', which can be found by navigating to User Administration > Groups in the Application Navigator.
Question 6: A user record in ServiceNow contains various details about an individual. Which of the following pieces of information is NOT typically stored directly on the user [sys_user] record by default?
- Email address
- Manager
- Inherited roles (Correct answer)
- Department
Correct answer: Inherited roles
While a user's roles are associated with their user record, the list of *inherited* roles is not a direct field on the sys_user table. Inherited roles are dynamically calculated based on the user's group memberships and the roles assigned to those groups. The user's email, manager, and department are standard fields on the user record.
CSA - ServiceNow System Administrator Users, Groups, and Roles Questions and Answers 1
A user belongs to two groups: 'Service Desk' and 'Change Approvers'.
The 'Service Desk' group has the 'itil' role.
The 'Change Approvers' group has the 'approver_user' role.
Which of the following statements is true regarding the user's permissions?