CSA Users, Groups, and Roles 3 — Questions and Answers
Question 1: Which role allows a user to manage other users' records without full admin access?
- user_admin (Correct answer)
- admin
- security_admin
- itil_admin
Correct answer: user_admin
The user_admin role grants the ability to create, edit, and manage user records without requiring full admin access.
Question 2: How can an administrator prevent a specific role from being elevated via 'sudo' in High Security mode?
- Set 'Grantable' to false on the role (Correct answer)
- Remove the role from all elevation groups
- Mark the role as non-elevatable in the Role record
- Roles cannot be restricted from sudo elevation
Correct answer: Set 'Grantable' to false on the role
Setting the 'Grantable' field to false on a role prevents it from being granted through elevation or sudo.
Question 3: What is the purpose of the 'sys_user_has_role' table?
- It logs all role changes for audit purposes
- It stores the many-to-many relationship between users and roles (Correct answer)
- It defines the permissions associated with each role
- It tracks group membership changes
Correct answer: It stores the many-to-many relationship between users and roles
The sys_user_has_role table is a junction table that records which roles are directly assigned to which users.
Question 4: A group in ServiceNow can have which of the following types of membership?
- Only direct user assignments
- Direct users and nested groups (Correct answer)
- Only LDAP-synchronized members
- Members pulled exclusively from roles
Correct answer: Direct users and nested groups
ServiceNow groups support both direct user assignments and nested groups as members.
Question 5: Which system property controls the maximum number of roles a single user can hold?
- glide.user.max_roles
- glide.security.role_limit
- There is no such system property (Correct answer)
- com.glide.user.role_cap
Correct answer: There is no such system property
ServiceNow does not have a built-in system property that limits the number of roles a single user can hold.
Question 6: What is the effect of checking 'Web service access only' on a user record?
- The user can only access ServiceNow via mobile
- The user cannot log into the UI but can authenticate for integrations (Correct answer)
- The user's access is restricted to the Service Portal
- The user can only perform read operations
Correct answer: The user cannot log into the UI but can authenticate for integrations
A 'Web service access only' user cannot log in through the browser UI but can still authenticate for REST/SOAP integrations.
Question 7: When using role-based access control, which of the following grants the MOST permissive access in ServiceNow?
- itil
- admin (Correct answer)
- security_admin
- user_admin
Correct answer: admin
The admin role is the most permissive standard role, granting access to virtually all platform features and data.
CSA Users, Groups, and Roles 3
Which role allows a user to manage other users' records without full admin access?