ServiceNow Admin Role Quiz Explained

ServiceNow role management is a critical topic that often appears in certification exams—and it can be tricky. In this article, we’ll break down a real ServiceNow quiz question related to the admin role, review the correct answers, analyze common mistakes, and provide a clear justification for each option.

---

❓ Quiz Question

Which of the following is a true statement about the admin role?

👉 Select 3 answers from the options below.

---

✅ Correct Answers

1. Non-admin users cannot add users to a group containing the admin role.

2. To grant the admin role to a user, the granting user must also have the admin role.

3. A user with only the admin role cannot grant the security_admin role to other users.

---

❌ Incorrect / Commonly Misunderstood Options

• A user with only the user_admin role can grant the admin role to other users.

• A non-admin user with only the security_admin role can add a user to a group that contains the security_admin role.

---

🔍 Detailed Explanation

Let’s walk through each statement and understand why it is correct or incorrect.

---

✔️ 1. Non-admin users cannot add users to a group containing the admin role

This statement is true.

• The admin role is highly privileged.

• Only users who already have the admin role can manage group membership for groups that contain the admin role.

• This restriction prevents privilege escalation by non-admin users.

🔐 Key takeaway: Admin access is tightly controlled and cannot be indirectly granted via group management by non-admin users.

---

✔️ 2. To grant the admin role to a user, the granting user must also have the admin role

This statement is true.

• ServiceNow enforces a same-role-or-higher rule.

• You cannot grant a role that you do not already possess.

• Therefore, only users with the admin role can grant the admin role to others.

📌 Exam tip: Role delegation always requires equal or higher privileges.

---

✔️ 3. A user with only the admin role cannot grant the security_admin role to other users

This statement is true.

• The security_admin role is more sensitive than the standard admin role.

• Even admins cannot grant this role unless:

  1. They already have the admin role, and

  2. They elevate to security_admin explicitly.

🛡️ Why this matters: ServiceNow adds an extra layer of protection around security-related configurations.

---

❌ 4. A user with only the user_admin role can grant the admin role to other users

This statement is false.

• The user_admin role allows management of users and groups.

• However, it does not allow granting the admin role.

• Granting admin access always requires the admin role itself.

🚫 Common pitfall: Assuming user_admin is powerful enough to grant all roles.

---

❌ 5. A non-admin user with only the security_admin role can add a user to a group that contains the security_admin role

This statement is false.

• Even though security_admin is a powerful role, group management for privileged roles still requires admin access.

• Additionally, security_admin must be elevated and is session-based, not permanent.

⚠️ Important note: Security roles are controlled more strictly than standard administrative roles.

---

🧠 Overall Summary

Here’s a consolidated view of the rules tested in this question:

• ❌ Non-admin users cannot manage admin group membership.

• ❌ The user_admin role cannot grant the admin role.

• ✅ To grant admin, you must already be admin.

• ❌ The admin role alone cannot grant security_admin.

• ✅ To grant security_admin, a user must:

  • Have the admin role

  • Elevate to security_admin before assigning it

---

The elevation step is mandatory and time-bound, reinforcing ServiceNow’s defense-in-depth security model.

---

🏁 Final Thoughts

Questions like this test not just memorization, but your understanding of ServiceNow’s security and role hierarchy. If you’re preparing for a CSA, CAD, or other advanced ServiceNow certifications, mastering these nuances is essential.

Happy learning 🚀