CSA - Database Management and Platform Security (30% of the exam) - Section 5

Shared Responsibility Model

The split of security duties between ServiceNow (cloud infrastructure, platform, data centre controls) and the customer (user access, roles and ACLs, data classification, configuration, integrations), and which party is responsible for a described control or incident.

ServiceNow shared responsibility model

Practice question for this objective

Free sampleDatabase Management and Platform Securitymedium

An organisation is documenting who owns which security controls on its hosted production instance, and needs the split that the ServiceNow shared responsibility model describes. Which pairing assigns responsibility correctly?

AServiceNow defines the role hierarchy used by each application on the instance, while the customer maintains the network hardware that carries traffic to it.
BServiceNow maintains the data centre facilities and the platform software beneath the instance, while the customer defines the roles and access control rules that govern record access. Correct
CServiceNow classifies the business data loaded into the instance tables, while the customer patches the operating system and database software that the instance runs on.
DServiceNow configures the instance security settings once the customer has gone live, while the customer arranges redundancy between the paired hosting data centres.

Recognise that ServiceNow owns the hosting facilities and platform software while the customer owns instance configuration, roles and access control. The model draws its line at the boundary of the running platform. ServiceNow is accountable for the data centres, the hardware, the operating environment and the platform code that the instance executes. Everything a subscriber then configures inside that instance, including roles, groups, access control rules and application logic, is authored by the customer and therefore owned by the customer.

Why A is wrong: Tempting because ServiceNow does ship baseline roles with each application, but the customer decides which roles exist for its own applications and who holds them, and the customer never touches the hosting hardware.

Why B is correct: Correct, because the vendor owns everything from the physical facility up to the running platform, and the customer owns what it configures on top of that platform, access control being the clearest example.

Why C is wrong: Tempting because both activities are genuinely necessary, but each sits on the wrong side: only the customer knows the sensitivity of its own data, and the customer has no access to the hosting stack to patch it.

Why D is wrong: Tempting because ServiceNow does supply security guidance at go live, but instance configuration remains customer work, and data centre pairing and failover are arranged by the vendor, not the subscriber.

See more CSA practice questions, answers explained.

Exam traps in Database Management and Platform Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the CSA bank for this domain.

ServiceNow, because the vendor operates the database and the logging framework that retained the message, so log content falls inside the platform it maintains.
Why it is wrong: Tempting because ServiceNow genuinely operates the storage and logging infrastructure, but operating the mechanism does not make the vendor accountable for what customer written code chooses to write into it.
ServiceNow, because the platform hosts the table and its access control engine is what evaluated each read request and returned the records to the users.
Why it is wrong: Tempting because the engine did perform the reads, but an engine that faithfully applies the rule it was given has behaved correctly; the fault lies in the rule, which the vendor did not write.
ServiceNow classifies the payroll data once it has landed in the instance tables, and the customer is left to monitor the running integration for transfer failures.
Why it is wrong: Tempting because the vendor stores the data and could in principle inspect it, but only the customer knows what its own records mean contractually and legally, so classification cannot be delegated upwards.

Examworthy is not affiliated with or endorsed by ServiceNow. Original, blueprint-aligned practice material only.