CIS-SP ServiceNOW Certified Implementation Specialist - Service Provide Questions and Answers

A domain audit in ServiceNow is a comprehensive review process that includes various actions and results to ensure the integrity and proper functioning of domain-separated environments1. The detailed results or actions included in a domain audit typically encompass:

• Records or configurations affected ©: The audit identifies which records or configurations have been impacted by any issues. This includes changes to the operating system, applications, or devices, and is crucial for tracking system operations and use2.

• Recommended actions to remedy errors and warnings (D): The audit provides recommendations for corrective actions to address any identified errors and warnings. This is part of the audit management process, where continuous monitoring using indicators and CMDB evidence helps in building or editing pre-built workflows for audit engagements, control or risk assessments, and remediation3.

• Ability to re-run the audit (E): After addressing the issues, the audit can be re-run to verify that the errors have been resolved and that the domain is functioning correctly. This ensures ongoing compliance and security within the ServiceNow environment2.

Incorrect user domain logins (A) and escalating errors as incidents (B) are not typically included in the domain audit results or actions. Instead, these aspects are more related to the operational monitoring and incident management processes within ServiceNow2.

Before using domain separation for Service Catalog items, the first step an administrator must perform is to activate the Service Catalog - Domain Separation plugin (com.glideapp.servicecatalog.domain_separation). This plugin enables domain separation within the Service Catalog, allowing for the separation of data, processes, and administrative tasks into logical groupings called domains1. By activating this plugin, the admin ensures that the Service Catalog is prepared to handle the complexities of a domain-separated environment, which is essential for maintaining data integrity and proper access controls across different domains21.

In ServiceNow, providing data access to a user outside of their domain hierarchy can be achieved through the following methods:

1. Access Control Lists (ACLs): ACLs are used to define permissions for accessing data within ServiceNow. By configuring ACLs, you can grant specific users or groups access to data outside their domain hierarchy. This is done by setting up rules that allow or deny access based on various conditions, such as roles, user attributes, or specific field values1.

2. sys_visibility.domain system property: This system property can be configured to control the visibility of records across different domains. By setting this property, you can define which domains’ data should be visible to users outside their own domain hierarchy. This allows for more granular control over data access and visibility2.

These methods ensure that users can access the necessary data while maintaining the integrity and security of the domain separation model.

1: ServiceNow ACL Documentation

2: ServiceNow Domain Separation Documentation

When handling process domains in ServiceNow, the recommended approach is to create overrides in the process domain rather than updating the global processes. This strategy ensures that any customizations or specific requirements for a particular domain do not interfere with the global processes, which are intended to be standard and consistent across the entire organization.

Creating overrides in the process domain allows for more granular control and flexibility, enabling specific adjustments without impacting the overall system’s integrity. This approach aligns with best practices for maintaining system stability and ensuring that updates or changes are isolated to the relevant domain.

For more detailed information, you can refer to the following resources:

• ServiceNow Learning Portal

• ServiceNow Knowledge Base

• ServiceNow Developer Portal

The Default domain in ServiceNow is specifically used for the following purposes:

1. Help identify integrations that are incorrectly creating global data: The Default domain can be used to track and identify any integrations that are mistakenly creating data in the global domain instead of the intended specific domain. This helps in maintaining data integrity and ensuring that data is correctly segregated.

2. Capture records with no domain on tables that should not have global data: The Default domain is also used to capture records that do not have a domain specified on tables where global data should not be present. This ensures that such records are not incorrectly placed in the global domain, maintaining the separation and security of data.

For more detailed information, you can refer to the following resources:

• ServiceNow Support Article on Domain Separation

• Developing Domain-Separated Applications

The purpose of the Domain Separation Center in ServiceNow is to configure and review domain configuration audits for errors and warnings. This tool is essential for administrators to ensure that domain separation is correctly implemented and maintained. It helps in identifying and resolving any issues related to domain configurations, thereby maintaining the integrity and proper functioning of the domain-separated environment.

References:

• ServiceNow Domain Separation - Basics

• ServiceNow Domain Separation - Advanced Concepts

Best practices for setting up a domain hierarchy in ServiceNow recommend creating a structure that is not too shallow or too deep. A hierarchy that is 3-5 layers deep is considered optimal as it allows for the use of ‘contains’ relationships where necessary12. This structure should include a default domain, which typically serves as the catch-all layer for any data that does not belong to a more specific domain3. The default domain is often the TOP domain or a domain just below it. This setup facilitates better organization and management of data and processes across different domains within the instance45.

In ServiceNow, domain separation is used to separate data, processes, and administrative tasks into logical groupings called domains. This allows for control over various aspects of this separation1. However, certain process-related tables are excluded from domain separation to maintain the integrity and functionality of the system across different domains.

• Business Rules (B): Business rules are global by nature and are designed to apply system-wide logic before or after database operations, regardless of the domain. This is why they are excluded from domain separation.

• Access Controls ©: Access controls (ACLs) define what data users can access and how they can interact with it. Similar to business rules, ACLs are also global and not domain-specific to ensure consistent security practices across the platform.

• System Property (D): System properties are configuration settings that affect the entire ServiceNow instance. Since these settings can have far-reaching implications on the system’s behavior, they are not separated by domain to avoid conflicts and ensure uniformity in configuration.

These exclusions are necessary to ensure that fundamental system behaviors remain consistent and predictable, regardless of the domain context. It’s important to note that while these tables are excluded from domain separation, the data within other tables can be separated and controlled as per domain requirements2.

In ServiceNow, domain separation allows organizations to segregate data, processes, and administrative tasks into logical groupings called domains1. This is particularly useful for Managed Service Providers (MSPs), where multiple organizations or customers use the same ServiceNow instance but require isolation from each other2.

When a user has the ITIL role within the MSP domain, they inherently have that role across all domains they have access to. This is because roles in ServiceNow are global by default, meaning they apply across all domains unless specifically restricted31. The ITIL role is a set of permissions that typically includes the ability to manage incident, problem, and change records, which are fundamental to IT service management.

The other options, such as being granted the Admin role in other domains (B), administering other domains by granting the Domain Admin role ©, or being restricted to self-service in other domains by granting the Self-Service role (D), are actions that require explicit configuration by an administrator with the appropriate level of access and are not automatic outcomes of having the ITIL role in the MSP domain4.

It’s important to note that while the ITIL role may be global, access to specific records and the ability to perform certain actions can still be controlled within each domain through ACLs (Access Control Lists) and other domain-specific configurations1.

Visibility in ServiceNow can be granted to users through Group Membership and Role.

• Group Membership: Users can be assigned to specific groups, and these groups can be granted visibility to certain records or functionalities within ServiceNow. This method allows for efficient management of user permissions based on their group affiliations.

• Role: Roles define a set of permissions that can be assigned to users. By assigning roles to users, administrators can control what users can see and do within the platform. Roles are a fundamental part of access control in ServiceNow.

References:

• ServiceNow User Criteria and Access Control

• ServiceNow Group Management