Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Workday HCM Pro Core Certification > Configurable Security Fundamentals > Flashcards

Configurable Security Fundamentals Flashcards

1
Q

Security Landscape: Functional Area

A

Highest level of application delivery is in Functional Areas.

Includes areas such as Staffing, Benefits, Core Compensation, Financial Accounting, etc.

FA’s are further broken down into Domains and Business Process Types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Landscape: Domains

A

Collections of items that share the same security.

Can include tasks, delivered reports, report data sources, web service operations and task

  • WD determines the secured items within each domain
  • You can’t change what delivered items are in what domains
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security Landscape: Business Process Types

A

Represents the events or transactions in WD that can be automated using WD’s business process framework

Each BP Type has its own security policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Security Landscape: Domain Security Policies

A

The security policy for a domain.

In the DSP you can configure which security groups have access to the items in the domain

  • Access is configured at the domain level, not item-by-item. Users with access to a domain will have access to all items secured in that domain.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Security Landscape: Business Process Security Policies

A

The security policy for a BP that determines which security groups can do what within a BP, e.g. initiate, do action steps, approve, rescind, cancel, correct, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Security Groups: Delivered and Workday Assigned Security Group Types

A

WD determines the allowed security group types and provides a set of default security groups of these types.

You can also create new security groups of these delivered types (e.g. Aggregation Security Group, Job-Based Security Group (c), Role-Based Security Group (u))

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Security Groups: Constrained vs. Unconstrained

A

CONSTRAINED: Users have contextual access to a subset of data to which the security group has access. Target constraints in WD are typically by org, but can also be for levels and segments.

UNCONSTRAINED: Users have access to all target instances secured by the security group

MIXED: Applies to intersection and aggregation security groups where it depends on the security groups constraints being combined.

EXAMPLE: Jack (U) and Jill (C). Jack can run the report and for any worker. Jill can run the report, but, only for the organizations she supports within the context of her role (e.g. Compensation Partner for APAC).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Security Groups: User-Based (U)

A
  • MEMBERSHIP: Manually assigned. Follows user.
  • CONTEXT: Unconstrained
  • EXAMPLE: HR Administrator, Finance Administrator
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Security Groups: Role-Based (C/U)

A
  • MEMBERSHIP: Based on Role Assignment. Roles are assigned to positions.
  • CONTEXT: (C/U). Constrained by Organization(s) supported in role
  • EXAMPLE: HR Partner, Benefits Partner, Accountant
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Security Groups: Job-Based (C/U)

A
  • MEMBERSHIP: Based on job details (e.g. job profile, management level)
  • CONTEXT: Organization
  • EXAMPLE: CFO, IT Workers, VP’s
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Security Groups: Segment-Based (C)

A
  • MEMBERSHIP: Based on included security groups
  • CONTEXT: Segments
  • EXAMPLE: Documents - Benefits Categories, Manager - Integrations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Security Groups: Location Membership (U)

A
  • MEMBERSHIP: Based on location
  • CONTEXT: Unconstrained
  • EXAMPLE: All USA Workers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security Groups: Organization Membership (C/U)

A
  • MEMBERSHIP: Based on Organization Membership (e.g. Cost Center, Location Hierarchy)
  • CONTEXT: Organization
  • EXAMPLE: EMEA Workers, IT Cost Center Workers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Security Groups: Intersection (Mixed)

A

The “AND” grouping

  • MEMBERSHIP: Members are those in ALL of included security groups
  • CONTEXT: Mixed - depends on included security groups. Constraints intersected.
  • EXAMPLE: Those that are HR Partners (Role) AND located in France (Location)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Security Groups: Aggregation (Mixed)

A

The “OR” grouping

  • MEMBERSHIP: Members are those in ANY of the included security groups
  • CONTEXT: Mixed - depends on included security groups.
  • EXAMPLE: Those that are HR Partners (Role) OR located in France (location)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Security Groups: Service Center (C/U)

A
  • MEMBERSHIP: Based on Service Center. Service center representatives in service center will be members.
  • CONTEXT: Organization
  • EXAMPLE: 3rd Party Help Desk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Security Groups: Integration System (C/U)

A
  • MEMBERSHIP: Manually assigned to Integration System Users
  • CONTEXT: Organization
  • EXAMPLE: Credit Card System
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Security Groups: Level-Based (C)

A
  • MEMBERSHIP: Based on included levels. Requires leveling hierarchy defined, either Compensation Grade or Management Level
  • CONTEXT: Lower Levels, regardless of organization
  • EXAMPLE: Those in Manager Management Level, can access talent card data for all those in lower management levels.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Security Tips: Security methodology

A

Workday’s security framework allows you to configure which users have access to the delivered content via security policy configurations.

Security groups are the bridge between system users and security policies.

You can configure security groups in needed domain or business process security policies to grant access to security group members to delivered areas of Workday.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Security Tips: The steps for configuring security

A

1) Determine users and required access
2) Create Security Groups
3) Attach security groups to Security Policies
4) Activate pending security policy changes
5) Test changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Security Tips: Recommendations

A

KEEP IT SIMPLE

DESIGN TOP DOWN

  • Start w/user-based groups.
  • Layer in role-based (constrained) groups.
  • Think of your business partners first.

KEEP EFFICIENCY IN MIND

  • Assign permissions at the highest node in the hierarchy to take advantage of inheritance, using the option for current and unassigned subordinates.
  • Only assign at the lower levels when necessary.

TEST!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Security Tips: Managing Workforce Security Assignments

A

As part of staffing transactions where workers are terminating or changing jobs, it is important to ensure security group membership, specifically revisiting role-assignments and removing user-based security groups assignments.

  • Use the Assign Roles sub-process in staffing transaction BP definitions
  • Use delivered services, add service steps to staffing transaction BP definitions
    • Service step to Remove User-Based Security Groups
    • Service step to Terminate User Account
  • In addition, leverage delivered reports and shared solutions to audit changes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Security Tips: Security Configuration Restrictions

A

Some domain and BP security policies can be restricted to certain security group types.

WD explicitly disallows you from allowing some security group types to BP or security domain policies to prevent applying security groups to policies for secured content.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Security Tips: Reports and Other Tools

A

LOTS of REPORTS, and you can create custom reports too!

  • Domain Security Policies for Functional Area
  • Business Process Security Policies for Functional Area
  • View Security for Securable Item
  • View Security Reports
  • Security Analysis Reports
  • Role Assignments reports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

WHICH REPORT: How can I tell what security groups a user has?

A

View Security Groups for User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

WHICH REPORT: What can a security group do? What does it have access to?

A

View Security Group
Security Analysis for Security Group
Action Summary for Security Group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

WHICH REPORT: Who are the members of a security group?

A

If user based, you can see it when you View Security Group.

Else, write a custom report on security groups and show members.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

WHICH REPORT: How can I find out if a user is a member of a given security group?

A

Test Security Group Membership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

WHICH REPORT: How can I tell if a user has access to a given target using a given security group?

A

Test Security Group Membership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

WHICH REPORT: How did this user get to this task or item? What security group allowed it?

A

Security Analysis for Action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

WHICH REPORT: Given all a user’s security groups, what is their cumulative access in tenant?

A

Security Analysis for Workday Account

32
Q

WHICH REPORT: How can I tell what security policy to update for a given item?

A

View Security for Securable Item

33
Q

WHICH REPORT: How can I tell who has access to a given task or item?

A

View Security for Securable Item

34
Q

WHICH REPORT: How can I see all the domains and business processes available for a given functional area?

A

Functional Areas

35
Q

WHICH REPORT: How can I see the current security configuration for a given functional area?

A

Domain Security Policies for Functional Area

Business Process Security Policies for Functional Area

36
Q

WHICH REPORT: How can I see what security policy edits are pending activation?

A

Domain Security Policies with Pending Changes

Business Process Security Policies with Pending Changes

37
Q

WHICH REPORT: How can I see an audit trail of changes to security policies? Who did what when?

A

Domain Security Policy History

Business Process Security Policy History

38
Q

WHICH REPORT: How can I audit a given Workday Account?

A

View User or Task or Object Audit Trail

39
Q

WHICH REPORT: How can I revert back to a previous security configuration in tenant?

A

Activate Previous Security Timestamp

40
Q

WHICH REPORT: How can I activate changes to security policies?

A

Activate Pending Security Policy Changes

41
Q

WHICH REPORT: How can I see how many times security has been activated in tenant?

A

View All Security Timestamps

42
Q

WHICH REPORT: How can I see all the roles that are defined in tenant?
What if I need to add new roles?

A

View Assignable Roles

Maintain Assignable Roles

43
Q

WHICH REPORT: How can I see all the security groups in the tenant?

A

View Security Group

44
Q

WHICH REPORT: If using role-based security, how can I tell what roles are unassigned?

A

Unassigned Organization Roles Audit
Unassigned Roles Audit
Unfilled Assigned Roles Audit

45
Q

WHICH REPORT: If using role-based security, how can I tell what roles assignments exist for either a given worker or for a given organization?

A

Role Assignments for Worker Position

Roles for Organizations and subordinates

46
Q

WHICH REPORT: How can I see a history of security changes for either an organization (e.g. role assignments) or for a worker?

A

Security History
Security History for User
Check out report options off worker profile>Security Profile

47
Q

WHICH REPORT: How can I see if there are issues with the security configuration?

A

Security Exception Audit

48
Q

WHICH REPORT: How can I see a full list of reports around security?

A

Run Workday Standard Reports for security related categories

Use Sitemap and look under Security and Audit related categories

Don’t forget you can also write custom reports!

49
Q

HOW TO: How do you navigate functional areas?

A

Run Functional Areas report

Using this report you can filter down / navigate to view domains and BP’s that fall within the various functional areas

50
Q

HOW TO: How do you navigate domain and business security policies by functional area?

A

There are two reports that you can use:

  • Domain Security Policies for Functional Area
  • Business Process Security Policies for Functional Area
51
Q

HOW TO: How do you edit domain security policies?

A

Run the * Domain Security Policies for Functional Area* Report

In the left column, select the domain. On the right, click the “Edit Permissions” button.

Add / remove security groups and select the appropriate view / modify permissions.

52
Q

HOW TO: How do you edit business process security policies?

A

Off the related actions menu for the BP def (any def for a BP type will suffice), select Business Process Policy > Edit.

NOTE: There is only one security policy per BP type (not per BP definition).

53
Q

HOW TO: How do you activate pending security policy changes?

A

Run the Activate Pending Security Policy Changes task

54
Q

HOW TO: How do you identify security reports to help with your configuration, management, and troubleshooting?

A

NEED TO RESEARCH THIS

55
Q

HOW TO: How do you activate previous timestamps?

A

Run the Activate Previous Security Timestamp task.

56
Q

HOW TO: How do you create and manage proxy access policies for environments?

A

TASKS: Create / Edit / View / Delete Proxy Access Policy

When working with a proxy access policy, you must restrict the policy to an environment(s), and then configure which security groups can proxy on behalf of which security groups.

57
Q

User-Based Security Groups: How do you create user-based security groups?

A
  1. Run Create Security Group task
  2. Find the Domains and/or Business Processes
  3. Assign user to User Based Security group
  4. Edit Security Policies
  5. Activate Pending Security Policy Changes
  6. Test
58
Q

User-Based Security Groups: How do you assign uses to user-based security groups?

A

Off the related actions for the security group, select User-Based Security Group > Assign Users

NOTE: No need to activate pending security changes since the policy was not edited.

59
Q

Role-Based Security Groups: How do you Maintain Assignable Roles?

A

Run the Maintain Assignable Roles task.

That task allows you to add, remove, and maintain assignable roles in the tenant.

60
Q

Role-Based Security Groups: How do you create role-based security groups (Constrained vs. Unconstrained)?

A

1) Assignable Roles must be defined and maintained for different organization types
2) Role assignments must be maintained.
3) Role-based security groups must be created with needed constraints.
4) Role-based security groups must be configured in needed domain and/or business process security policies.
5) Activate
6) Test

61
Q

Role-Based Security Groups: How do you assign roles?

A

NEW
Security Profile > Assign Roles – Add/Remove
Security Profile > Assign Roles – Change Assignments

OLD
Security Profile > Assign Roles

62
Q

Job-Based Security Groups: How do you create job-based security groups (Constrained vs. Unconstrained)

A
  1. Run Create Security Group task
  2. Identify needed access to domains or business processes
  3. Edit Security Policies
  4. Activate Pending Security Policy Changes
  5. Test
63
Q

Segment-Based Security Groups: How do you create security segments?

A

Create [option] Security Segment task

Depending on your tenant setup / permissions [option] can be:

  • Business Process Type
  • Integration System
  • Document Category
  • Message Queue
  • Leave Type
  • AND MORE
64
Q

Segment-Based Security Groups: How do you create segment based security segments?

A
  1. Create item security segments
  2. Create Segment-based security groups
  3. Edit Domain Security Policy to enable members to access restricted segment
  4. Activate Pending Security Policy Changes
  5. Test
65
Q

Membership-based security groups: Location Membership

A

Workers are granted access to items in a policy secured with a location-based security group if they are in any of the Locations included in the group.

66
Q

Membership-based security groups: Organization Membership

A

You can define an organization-based security group to include one or more organizations of any type (e.g. Company, Cost Center, Location Hierarchy, Pay Group).

67
Q

HOW TO: How do you create intersection security groups?

A

1) Identify the needed population with a security group. Typically this is done using the Organization Membership (or Location Membership) if populations are location specific.
2) Create an intersection security group that intersects the organization membership security group with the employee-as-self security group.
3) Remove and replace all needed domain and business process security policies with the intersection security group instead of employee-as-self (remove employee-as-self).
4) Activate
5) Test! Test! Test!

68
Q

HOW TO: How do you create aggregate security groups?

A

1) Access the Create Security Group task or the Edit Security Group task.
2) Create or edit the security group:
* If creating a new security group, select the Type of Tenanted Security Group.
* If editing an existing security group, select the Security Group.
3) (Optional) You can inactivate the security group, unless it is:
* Included as a member in another security group.
* Specified as an administrator for another security group.
* Granted any access permission to the Security Configuration domain.
4) Enter the Security Groups to Include.
5) (Optional) Enter the Security Groups to Exclude.

69
Q

What are the limitations of intersection security groups?

A
  1. Remove and Replace in all needed domain and BP security policies. Ensure needed policies are configured with the intersection security group instead of the role-based security groups for consistent behavior for your requirements on target access.
  2. Not all functional areas, domains and business process security policies allow intersection security groups. Be aware of security group type restrictions. There may be domains, for example, where you must use a role-based security group and not intersection.
  3. Run View Security Group for replaced security groups. Review results to identify other areas that may need to be replaced with the intersection security group.
  4. When changing permissions in a business process security policy, it is a good idea to run the Business Process Exception Audit Report to see if any BP definitions require changes in step routing with the changed security.
  5. Maintaining Role Assignments. If you are using intersection security where the intersection security group membership is determined by role assignments across different assignable roles, it is important to ensure role assignments are accurate.
  6. Importance of testing and working closely with partners/Workday as the support for intersection security evolves. For example, known issues include:
  • Reports that prompt on organization may not be able to resolve intersection security access. This can for example impacts reports in Staffing, Compensation, Absence, Talent.
  • Talent – some tasks not yet supported, such as Cascading Goals on locations/organizations or initiating talent reviews.
  1. Assumed organizational context: Certain staffing activities assume a supervisory organizational context. Please refer to this post: https://community.workday.com/doc/core/dan1370797475300
  2. If using Target Exclusion “exceptions to target constraints”:
    * Not all organization types are allowed. For example, Talent Pools are not allowed for exclusion criteria.
    * Target Exclusion criteria was primarily intended for ‘View’ functionality not for business process step routing. Routing a BP step to an intersection security group with target exclusion criteria can cause unassigned tasks.
70
Q

What are the limitations of aggregate security groups?

A

Cannot aggregate other aggregation security groups

71
Q

Service Center-Based Security Groups: How do you create service centers?

A

Run Create Service Center task

72
Q

Service Center-Based Security Groups: How do you create service center security representatives?

A

Off the related actions for a Service Center, select:

Service Center > Create Service Center Representative

To find the rep, search “servicecenter: “

To create the WD account, from the related actions of the rep, select:

Security Profile > Create Workday Account

73
Q

Service Center-Based Security Groups: How do you create service center security groups (constrained and unconstrained)?

A

1) Create a Service Center – a service center must exist.
2) Create Service Center Representatives for the service center. Service Center Representatives will be for each third party user.
3) Create a Workday Account for each Service Center Representative so that they can sign in to the tenant.
4) Create a Service Center based security group (Constrained or Unconstrained) for the Service Center.

[Create Security Group of type = Service Center Security Group (Constrained)]

 a. Members of the security group will be all service center representatives in that service center.
 b. Configure access rights to target instances for defined organizations if constrained.

5) Configure the Service Center Based security group in needed domain or bp security policies.
6) Activate
7) Test

74
Q

Level-Based Security Groups: How do you Maintain Leveling mechanism - Compensation Grade Hierarchy or Management Hierarchy?

A

Compensation Grade Hierarchy

  • Maintain Compensation Grade Hierarchy
  • View Compensation Grade Hierarchy

Management Level Hierarchy

  • Create Management Level Hierarchy
  • Management Level Hierarchy
  • (Use the Maintain Management Types task to define management levels)
75
Q

Level-Based Security Groups: How do you create level-based security groups?

A
  1. Maintain the leveling mechanisms needed: Compensation Grade Hierarchy or Management Level Hierarchy
  2. Create a Compensation Level-based or Manager Level-based security group
  3. Select levels in hierarchy to include as Members:
    a. Applies to All (include all levels – everyone as members)
    b. Applies to Levels (select levels to include as members)
  4. Edit Security Policies
  5. Activate Pending Security Policy Changes
  6. Test (members target access will be constrained to those in lower levels)
76
Q

Integration System Security Groups: How do you assign integration system users to Integration System security groups?

A

1) Create Integration System Users (ISU)
2) Create an Integration System Security Group
3) Assign ISU to Integration System Security Group
4) Edit Security Policies – Integration Permissions
5) Activate
6) Test

Workday HCM Pro Core Certification (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions