Advanced Configurable Security Flashcards
When creating an intersection security group, which field would you configure to hide instances that members would have otherwise seen?
Link to see screenshot: See Chapter 1, Quest 1
a. Security Groups to Include b. Security Groups to Exclude c. Exclude Target Position in Organization d. Applies to Current Organization Only
Chapter 1
Security Groups to Exclude
True or False?
This intersection security group configuration would limit self-service to contingent workers and employees in all locations other than Sweden.
Link to see screenshot: See Chapter 1, Quest 2
Chapter 1
True
Security Groups to Include
How would you ensure that when a user runs the Trial Balance report, they only see certain Ledger Account values?
a. Use a role-based constrained security group to constrain them to assigned ledger accounts b. Set up ledger account security segments and grant segment- based security groups permission to the Access Ledger Account (Segmented) domain. c. The trial Balance report an only be accessed via user-based unconstrained security groups d. You cannot secure access to Ledger Account values.
Chapter 2
Set up ledger account security segments and grant segment-based security groups permission to the Access Ledger Account (Segmented) domain
Which domain security policy would give users in a segment-based security group access to allowed spend category values?
a. Procurement Segmented Setup b. Access Requisition Spend Category (Segmented) c. Access Procurement Items (Segmented)
Chapter 2
Access Requisition Spend Category (Segmented)
How would you ensure that a given user only accesses integration events for certain integrations systems?
a. Use a constrained integration system security group. b. Set up integration system security segments and grant segment-based security groups permission to the Integration Events domain. c. A given user can only see their own integration events when running the integration events report. d. You cannot configure access to certain integration events.
Chapter 2
Set up integration system security segments and grant segment-based security groups permission to the Integration Events domain.
Ture or False?
After adding a security group to an aggregation security group that is already in use, you do not have to activate pending security policy changes.
Chapter 3
True.
A benefit of using aggregation security group is that you can add security groups to an existing aggregation without needing to modify the security policies.
An aggregation security group contains constrained service center security groups for different regions. If an approval step is routed to the aggregation group, who receives the action step?
a. All members of the aggregation security group. b. Members in the intersection of included security groups. c. Members with target access based on the context of the event. d. No one-service center representatives cannot take actions in business processes.
Chapter 3
Members with target access based on the context of the event.
Scenario: Self-service expenses is to be expanded to Canadian employees.
Review the existing security design. How would you change the design to support the expansion to Canadian employees?
Go to chapter to study for Chapter 4 & 5
Chapter 1 Considerations
Best Practices p.67
Follow these best practices when using intersection security:
1. If intersecting role-based constrained security groups, remember to:
a. Maintain the additional role assignments.
b. Assign the same worker/position to both roles being intersected.
c. Create a custom report to audit aps in role assignments
2. When changing business process security policies to remove security groups and replace with the intersection security group, you can impact existing business process definitions that may still be routing a step to the removed security group. Run the Business Process Exception Audit report to identify errors and resolve them.
3. Wen changing access to worklets (e.g., self-service worklets), be sure to run Security Exception Audit to resolve any permissions issues with landing page worklet configurations.
4. Verify all needed removals and replacements with the intersection security group by running the following reports:
a. Action Summary for Security Group
b. Domain Security Policies for Functional Area
c. Business Process Security Policies for Functional Area
5. Test, Test, Test
Tip: use the Maintain Permissions for Security Group task to ease removals and replacements in domain security policies.
Chapter 2 Considerations
Use Case: Document Categories
Segmented security is commonly used with document categories because access to worker documents is secured to a single domain. Without segmentation, security groups with permission to the Worker Data: Add Worker Documents and Worker Data: Edit and Delete Worker Documents domains would have access to view all documents for a given worker. By using document category values to identify the type of document and then using segment-based security, you can configure access to certain document category values.
Example: Benefits partners and administrators may have access to view and modify worker documents in Benefits document category via the Benefits categories segment-based security group
Use the Create Document Category Security Segment and Edit Document Category Security Segment tasks to define segments of values. These tasks are secured to the Document Categories Segmented Setup domain. Document categories must already be defined using the Maintain Document Categories task. A given document category security segment can contain one more document category values and a segment based security group can give members access to one or more security segments.
»»»See text book for screenshot
The following example gives the recruiter-related security groups access to view worker contract-related documents, such as offer letters and employment contracts.
»»»See text book for screenshot
In addition to domain access for worker documents, it is important to review business process security policy configurations for access to worker documents that are attached as part of a business process event. Security groups with View All access to the business process will have access to documents associated with the event. You can also configure access to attachments separately.
Chapter 3 Considerations
Decide early how much aggregation to use.
• Security policies and business process definitions are built differently based on whether aggregation is used or not
• If you decide later that additional aggregation needed, this will cause significant rework
• Start small with the lowest common denominator of access for the aggregation
What if I find out later I need my subordinate groups to have different permissions?
• There is a risk of this happening, so be clear on requirements up front.
• Security groups access can be “topped off”. Place extra permissions on subordinate groups, not on the aggregation.
• The opposite is not possible. Any permission (as opposed to span of control) placed higher in the chain inherits down.
Which security groups types include other security groups to determine membership?
(Select three correct answers)
a. Role-based security groups
b. Aggregation security groups
c. Segment-based security groups
d. Service center security groups
e. Intersection security groups
Question from pro practice test
Segment-based security groups
Intersection security groups
Aggregation security groups
Intersection security groups:
Grant access based on user membership in all included security groups.
Include only users who meet all of the specifications
Intersect the constraints of the security groups within.
Cannot include other intersection security groups in the intersection
Can include aggregation security groups in the intersection.
True
How do you configure an intersection security group?
Intersection security groups have two main areas for configuration:
- In the Intersection Criteria section, specify the security group(s) to include (and intersect) as members
- In the Exclusion criteria section, you can specify exceptions to target access. This configuration hides targets that members would have otherwise seen. Exclusions are identified by organization. Positions in the organizations listed are not visible to members of the intersection security group.
Reminder : A security group will only impact access in the tenant when
added to a domain or business process security policy. For example, if we
added our HR-Partner-Intersection group to, the Exit interview domain
security policy, User B will be able to run the Exit interview report secured
to this domain and will only see data for workers who are in the IT
supervisory organization who are also in the USA location hierarchy. He
will only have this intersected target access constraint in security policies
where the intersection security group is used.
True
