The Domain Separation Center is a centralized user interface designed for administrators to perform the overall configuration and ongoing management of the domain separation architecture within a ServiceNow instance. It consolidates various tools and settings, including system properties, domain management, and configuration validation, into a single dashboard. Its primary purpose is to streamline the administration of the entire domain-separated environment, from initial setup to routine maintenance and troubleshooting.

A. This is too vague. While the center facilitates the management of activities, its core purpose is the direct configuration and administration of the domain structure itself.

C. The Domain Separation Center is intended for global administrators (e.g., users with the domainadmin role) to manage the entire instance's domain hierarchy, not for individual domain administrators to manage their own specific domains.

D. Reviewing configuration audits is a key feature available within the Domain Separation Center, but it is not its sole or overarching purpose. The center's purpose is broader, encompassing all aspects of configuration and management.

1. ServiceNow Product Documentation: The official documentation explicitly states the purpose of the tool.

Reference: ServiceNow Product Documentation, "Domain Separation Center". In the overview section, it states, "The Domain Separation Center provides a centralized interface for configuring and managing domain separation." This directly supports that its purpose is configuration and management.

2. ServiceNow Now Learning Courseware: The official Domain Separation Implementation course details the function of the Domain Separation Center.

Reference: ServiceNow Now Learning, "Domain Separation Implementation" course materials, Module: "Domain Separation Administration". The course describes the Domain Separation Center as the primary tool for administrators to set up, validate, and manage the domain separation configuration for the instance.

By default, a user's domain is determined by the domain associated with their Company record. To override this inheritance, you must explicitly populate the Domain field on the user's record (sysuser table). This action directly assigns the user to the specified domain, taking precedence over the company's domain. The "Managed domain" property, which is set on the domain record itself (not the user record), is a related configuration that designates the domain as one that can be manually assigned to records and users.

B. Use a Source Script on your LDAP transform.

This is a specific implementation method for an LDAP integration, not the general platform mechanism for assigning a user's domain.

C. Set Default to true on their domain record.

The 'Default' flag on a domain record is used for users without a company or whose company has no domain; it does not override an existing company-based domain assignment.

D. Change their Company reference to a company with the desired domain.

This describes the standard, default behavior. The question explicitly asks for a method to assign a domain other than the one based on the user's company.

---

1. ServiceNow Product Documentation - Domain Separation - Assign users to a domain:

The documentation states, "By default, a user's session domain is determined by the domain of their Company record. You can override this default behavior by explicitly assigning a user to a specific domain... To override the domain that is derived from the user's company, you can explicitly assign a user to a domain. To do this, you populate the Domain field on the user's record." This directly supports the core action described in the correct answer.

2. ServiceNow Product Documentation - Domain Separation - Domain Configuration:

This document explains the fields on the Domain [domain] form, including the "Managed domain" checkbox. It notes that this setting is used to indicate that the domain can be manually selected, which aligns with the process of explicitly assigning a domain to a user or record.

The recommended best practice for designing a domain hierarchy is to create a structure that is logical but not overly complex, typically 3-5 layers deep. This depth provides sufficient granularity for customer and data separation without creating excessive administrative overhead. The design must leverage the 'contains' relationship, which allows parent domains visibility into child domain data—a core function for Managed Service Providers (MSPs). Furthermore, the structure must include the system-provided 'default' domain, which is essential for housing global records and processes that are not assigned to a specific domain.

B. Using Service Offerings in the domain hierarchy

Service Offerings are data records (Configuration Items) that are domain-separated; they do not form the structural hierarchy of the domains themselves.

C. A domain heirarchy 3-5 layers deep that allows for use of contains if needed and does not contain a defualt domain

The 'default' domain is a mandatory, out-of-the-box component of the domain separation architecture and cannot be excluded from the hierarchy.

D. Having a totally flat domain heirarchy with no TOP domain

The 'TOP' domain is the mandatory root of any domain hierarchy; all other domains are its children. A hierarchy cannot exist without it.

E. Adding several domain layers below TOP before getting to the customer domain

While structuring layers between TOP and customer domains is common (e.g., for the MSP), this statement is less comprehensive than option A, which includes depth, 'contains' relationships, and the 'default' domain.

---

1. ServiceNow Product Documentation - Domain Separation: The documentation states, "The domain hierarchy is the structure of all domains in an instance... The TOP domain is the parent of all other domains." It also explains, "The instance includes a default domain for records that are not assigned to a specific domain." This confirms the mandatory nature of TOP and default domains. (Refer to the "Domain hierarchy" and "Base system domains" sections in the Domain Separation documentation for the relevant ServiceNow release).

2. ServiceNow White Paper - Domain Separation Technical Best Practices: This guide often advises on hierarchy design, stating, "Keep the domain hierarchy as flat as possible to meet business needs... A deep hierarchy can be difficult to troubleshoot and maintain." A 3-5 layer depth is a common interpretation of this principle, balancing separation with manageability. (Refer to the section on "Domain Hierarchy Design").

3. ServiceNow Product Documentation - Domain separation options: The documentation details how data visibility works, which is directly tied to the 'contains' relationship inherent in the parent-child hierarchy. (Refer to the section "How domain separation works").

When an administrator in a child domain attempts to modify a record (such as a policy or business rule) that belongs to a parent or global domain, the system prevents direct modification. Instead, it creates a copy of the record in the administrator's current domain. This new record is called an override. To maintain the relationship between the original record and the new override, the system automatically populates the sysoverrides field on the new record with the sysid of the original record. This allows the system to use the domain-specific version for users in that domain.

B. sysprimarydomain: This is not a standard system field used in the domain override process.

C. sysadmindomain: This is not a standard system field used in the domain override process.

D. sysdomainowner: This is not the correct field name. The standard field that links an override to the original record is sysoverrides.

1. ServiceNow Product Documentation - Domain Separation Explained: In the section "How domain separation works," the documentation details the override process: "When a user in a child domain modifies a record from a parent or global domain, the system creates a copy of the record in the child domain. This copy is called an override. The system then adds a reference to the original record in the sysoverrides field on the new record."

2. ServiceNow Product Documentation - Dictionary Overrides: The documentation on Dictionary Overrides explains the function of the sysoverrides field, stating, "The Overrides field (sysoverrides) contains the sysid of the record it overrides." This confirms the field's purpose in linking a domain-specific version to its global or parent counterpart.

To enable data separation for a table, a sysdomain field must be added to its dictionary definition. This field is essential for the system to associate each record with a specific domain. The field must be a direct reference to the Domain [sysdomain] table. This reference relationship allows the platform to apply domain visibility rules, ensuring that users can only see records belonging to their own domain and any child domains. Using a reference field is the fundamental architectural requirement for the domain separation mechanism to function correctly.

A. A 'String' field type is incorrect because it cannot establish the required relational link to the sysdomain table, which is necessary for enforcing domain hierarchy and visibility rules.

C. While using the 'Domain ID' field type is a recommended shortcut that creates the correct reference, the fundamental requirement is the reference itself. Option B describes the underlying database structure, which is the core principle.

D. The field must be named sysdomain and must reference the Domain [sysdomain] table. Referencing the Company table is incorrect and would not enable domain separation.

1. ServiceNow Product Documentation: "Domain separate a table".

The documentation states, "Add a sysdomain field to the table dictionary entry... you can create a reference field that refers to the Domain [sysdomain] table." This confirms that the core requirement is a reference field named sysdomain pointing to the sysdomain table. (Accessed on various ServiceNow release documentation sites, e.g., Washington DC).

2. ServiceNow Training Courseware: "Domain Separation Implementation" On-Demand Course.

Module: "Domain Separating a Custom Application". The course material specifies: "To domain-separate a table, add a column to it named sysdomain. This column must be a reference to the Domain [sysdomain] table." This directly supports the answer by defining the essential field name and type.

A domain 'contains' relationship is a good practice and a specific mechanism used to grant users in one domain visibility into data in another domain that is not in a direct parent-child hierarchical path. In many Service Provider (SP) architectures, the SP operates from its own domain, which is a peer to its customer domains (e.g., both are children of the TOP domain). In this common scenario, establishing a 'contains' relationship from the SP's domain to each customer's domain is the correct and necessary action to allow SP users to view all customer data while maintaining proper data segregation.

B. Put customer data in Global: This is incorrect as it violates the core principle of domain separation, which is to segregate customer data. Global data is visible to all users in all domains.

C. No action required: This is only true if a specific parent-child domain hierarchy is already established where the SP is in the parent domain. It is not a universally applicable practice "to allow" visibility, as action is required if this structure is not in place.

D. Setup a visibility group: While visibility groups also grant cross-domain access, they are typically used for specific sets of users or roles. A 'contains' relationship is a broader, domain-to-domain rule, making it more suitable for granting visibility to the entire SP organization.

1. ServiceNow Product Documentation - Domain contains relationships: "A contains relationship grants users in one domain visibility into another domain that is in a separate branch of the domain hierarchy. For example, you can create a contains relationship that grants users in the Service Provider domain visibility into the Customer A and Customer B domains." This directly validates the use of 'contains' relationships as a primary method for SP visibility. (ServiceNow. (2023). Domain contains relationships. ServiceNow Product Documentation for Utah release).

2. ServiceNow Product Documentation - Domain Visibility: "There are two types of domain visibility: hierarchical and granted. By default, users can see data in their own domain and in child domains. This is hierarchical visibility. You can also grant users visibility to domains outside their hierarchy." This document distinguishes between the default hierarchical visibility and explicitly "granted" visibility, for which 'contains' relationships are a key tool. (ServiceNow. (2023). Domain visibility. ServiceNow Product Documentation for Utah release).

Delegated administration is a core ServiceNow capability, particularly crucial in a Service Provider (SP) environment. It allows the primary instance administrator (the Service Provider) to grant specific, scoped administrative permissions to non-administrator users, such as customer administrators. This enables customers to self-manage aspects of their own domain, like creating and managing their users, groups, and roles, without granting them full system-wide admin privileges. This approach enhances customer autonomy while maintaining the security and integrity of the shared instance.

A. This describes Delegated Development, which is a specific application of delegated administration for scoped application creation, not the general concept itself.

C. This describes the user delegate feature, where a user can temporarily assign their approvals and tasks to a colleague, which is different from granting administrative permissions.

D. Process Separation is a feature of Domain Separation that segregates business logic and processes between domains; it is not synonymous with delegated administration.

1. ServiceNow Product Documentation, "Domain separation and delegated administration": "Delegated administration enables service providers to delegate user administration to their customers. For example, you can grant a customer administrator the useradmin role to administer users and groups for their company." This directly supports the correct answer (B) by defining the feature in the specific context of a Service Provider.

2. ServiceNow Product Documentation, "Delegated administration": "Delegated administration allows administrators to grant specific permissions to non-administrator users. Use this capability to extend permissions to users to manage users, groups, and roles for a specific application..." This provides the general platform definition, reinforcing that the concept is about granting scoped admin rights.

3. ServiceNow Product Documentation, "Delegates": "Set up a delegate to receive and act on your behalf for tasks and approvals." This document clearly defines the functionality described in option (C) as a separate feature named "Delegates," confirming it is not "delegated administration."

The TOP domain serves a dual, fundamental purpose in a ServiceNow domain-separated instance. Structurally, it is the ultimate parent domain at the root of the domain hierarchy map, from which all other domains inherit. Functionally, it acts as the "core data domain" by containing all global records, processes, and configurations (like Business Rules, UI Policies, and foundational data) that are intended to be shared and accessible across all child domains. This combination of being the structural parent and the container for shared core data makes it the foundational layer of the entire domain-separated architecture.

A. This is incomplete. While the TOP domain is the parent in the mapping diagram, this answer omits its primary function of holding shared, core data.

B. This is less precise. "Core data" is a more comprehensive term than "process domain," as it includes not only processes but also foundational data and configurations.

C. This is incorrect. The purpose of domain separation is to segregate customer data into child domains, while the TOP domain holds global, non-customer-specific data.

1. ServiceNow Product Documentation - Domain separation hierarchy: "The domain hierarchy is a tree structure of all domains in an instance. The top-level domain is called TOP. All other domains are children of TOP... The TOP domain contains the data that is shared by all domains." This source confirms its role as both the parent ("top-level") and the container for shared ("core") data.

2. ServiceNow Product Documentation - Domain separation and the global domain: "Records in the global domain are accessible to all users, regardless of the user's domain... The global domain is conceptually part of the TOP domain, containing the core platform data and processes." This clarifies that the global, or core, data resides within the TOP domain's scope.

On a baseline ServiceNow instance where the Domain Support - MSP Extension plugin is activated, several default domain types are created to support common Managed Service Provider (MSP) business structures. These predefined types are 'MSP', 'Customer', and 'Vendor'. They serve as classifications within the [domain] table to logically organize the domain hierarchy. The 'MSP' type is for the provider's own domain, 'Customer' for client domains, and 'Vendor' for third-party supplier domains, enabling tailored data and process segregation.

B. Primary: 'Primary' is not a domain type; it refers to the default domain assigned to a user in their user record, determining their domain upon login.

C. TOP: 'TOP' is the name of the root record in the domain hierarchy from which all other domains extend. It is not a classification or a 'type' of domain.

1. ServiceNow Product Documentation - Domain separation setup: In the section "Default domain types," it is stated: "The Domain Support - MSP extension plugin creates the following domain types by default: Customer, MSP, Vendor." This directly confirms the correct answers. (ServiceNow Product Documentation, Utah release, "Domain separation setup").

2. ServiceNow Product Documentation - Domain separation for Managed Service Providers (MSPs): This document explains the intended use of these types: "Classify domains as either MSP, Customer, or Vendor domains to logically separate them. For example, you can create business rules that apply only to domains classified as Customer domains." (ServiceNow Product Documentation, Utah release, "Domain separation for Managed Service Providers (MSPs)").

The system property csmautoaccountdomaingeneration is a feature of the Customer Service with Domain Separation plugin. When this property is set to True, the system is configured to automatically create a new domain in the domain hierarchy each time a new customer account (from the customeraccount table) is created. This automation streamlines the process of onboarding new customers into a domain-separated environment, ensuring immediate data segregation without manual intervention.

A. This property automates the creation and linking of a domain to a new account, making the assignment implicit and automatic, not optional.

B. While domain separation achieves this data segregation, this option describes a general outcome of domain separation, not the specific action performed by this property.

D. This reverses the logic. The property triggers the creation of a domain when an account is added, not the creation of an account when a domain is added.

1. ServiceNow Product Documentation. (2024). Domain separation for Customer Service Management. ServiceNow. Retrieved from the ServiceNow documentation site. In the section "Configure domain separation for Customer Service Management," the documentation states: "The Customer Service with Domain Separation plugin ([com.sncsmdomainseparation]) adds the csmautoaccountdomaingeneration system property. When this property is set to true, a new domain is automatically created for each new customer account."