SNOW-CAD Core Application Development Practice Test 4 — 15 Questions

Question 1

A developer is working on a scoped application and needs to create a REST API endpoint that external systems can call to retrieve a list of records from a custom table. The developer wants to ensure that only authenticated users with a specific role can access the endpoint. Which steps should the developer take to secure the REST API?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Scripted REST API with a resource, and set the 'Requires authentication' checkbox to true, then add an ACL to the custom table restricting read access to the required role.. To secure a Scripted REST API, the 'Requires authentication' option must be enabled to ensure only authenticated users can access it. Additionally, ACLs on the underlying table enforce role-based access, so only users with the required role can read the records. This layered approach is the standard and most secure method.

Answer

Create a Scripted REST API with a resource, and in the script, check gs.hasRole('specific_role') before returning data; no ACL is needed.

Answer

Create a REST API by extending the Table API, and configure a REST API access policy to allow only the specific role.

Answer

Create a Scripted REST API with a resource, and set the 'Requires authentication' checkbox to false, then use basic authentication with a service account that has the specific role.

Question 2

A developer needs to create a Business Rule that runs before a record is inserted into the 'incident' table. The rule must set the 'assignment_group' field to a specific sys_id if the 'category' is 'Software' and the 'priority' is '1 - Critical'. If the category is not 'Software', the assignment group should remain unchanged. Which Business Rule configuration and script logic will achieve this?

Accepted Answer

Before Insert Business Rule with no condition, and script: if (current.category == 'Software' && current.priority == '1') { current.assignment_group = 'sys_id'; }. The requirement is to set assignment_group before insert only when category is Software and priority is critical. A Before Insert Business Rule with no condition and a script that checks both fields is the most reliable approach. It ensures the rule runs on every insert and the script logic controls when to set the field. Using an After Insert rule would require an extra update, and using a condition might have syntax issues or miss records if the condition is not exactly matched. The script approach is clear and meets the requirement.

Answer

Before Insert Business Rule with a condition 'category=Software^priority=1' and script: current.assignment_group = 'sys_id';

Answer

After Insert Business Rule with no condition, and script: if (current.category == 'Software' && current.priority == '1') { current.assignment_group = 'sys_id'; current.update(); }

Answer

Before Insert Business Rule with condition 'category!=Software' and script: current.assignment_group = 'sys_id';

Question 3

A developer is writing a client script to validate a form on the incident table. The script must run when the caller changes the 'category' field and must be able to display a message to the user without blocking the save. Which two script types should the developer use to meet these requirements? (Choose two.)

Accepted Answer

A UI Policy with a script action that runs when category changes. The requirement is a non-blocking message triggered by a specific field change. Both an onChange client script on category and a UI Policy with a script action that runs on category change meet this: each fires when the field changes and can display an informational message without returning false to block submission. onSubmit and onLoad do not match the trigger, and onCellEdit is for list editing.

Answer

onCellEdit client script on a list field

Answer

onLoad client script on the incident table

Answer

onSubmit client script on the incident table

Question 4

A developer is creating a Script Include that will be called from a client script using GlideAjax. The Script Include must be client-callable and perform a query on the 'sys_user' table to return the email address of a user based on the user's sys_id. Which TWO statements about this Script Include are true? (Choose two.)

Accepted Answer

The Script Include must extend the AbstractAjaxProcessor class to be callable from GlideAjax.. To be callable from a client script via GlideAjax, a Script Include must extend AbstractAjaxProcessor and have the 'Client callable' checkbox enabled. These two conditions ensure the Script Include can handle AJAX requests and is accessible from the client side. The other statements are false: Script Includes run server-side and cannot access client-side objects like g_form; the class name does not have to match the record name exactly, though it is a common practice; and the return value is sent back automatically, not via a separate response object.

Answer

The Script Include can directly access the client-side g_form object to validate data before querying.

Answer

The Script Include must be defined as a class with the same name as the Script Include record to be instantiated.

Answer

The Script Include can return a value directly to the client without using the response object.

Question 5

A developer is building a Flow Designer flow that triggers when an incident is created. The flow needs to check if the incident's 'priority' is '1 - Critical' and, if so, create a problem record and link it to the incident. The developer wants to ensure the flow does not run for non-critical incidents. Which approach should the developer use to conditionally execute the actions?

Accepted Answer

Add a Condition step after the trigger that checks if priority is '1', and place the create problem and link actions inside the Condition's true branch.. In Flow Designer, conditional logic is implemented using the Condition step. Placing the create problem and link actions inside the true branch of a Condition step that checks if priority is '1 - Critical' ensures they only run for critical incidents. This is the standard, efficient approach. Filtering the trigger might miss incidents where priority changes, and using a Script step is overkill. Flow Designer does not have an 'If/Else flow logic block'; the Condition step is the correct component. Thus, the Condition step approach is the best practice.

Answer

Configure the trigger to only fire when priority is '1 - Critical' by adding a filter condition to the trigger.

Answer

Use a Script step with a GlideRecord query to check the incident's priority, and if critical, use Flow Designer actions to create and link the problem.

Answer

Add an If/Else flow logic block that checks if priority is '1', and place the actions in the If branch.

Question 6

A company has a custom table 'u_asset' with a reference field 'u_location' pointing to 'cmn_location'. When a user changes the location on an asset record, the system must automatically update the location on all related 'u_asset_software' records. Which approach should the developer use?

Accepted Answer

Create a Business Rule that runs on update of the 'u_asset' table and updates related records.. A Business Rule that runs on the 'update' operation of the 'u_asset' table can directly query and update all related 'u_asset_software' records using GlideRecord. This server-side logic ensures the location change is propagated reliably, regardless of how the asset record is updated (UI, web service, import set, etc.), and it executes within the same database transaction for data consistency.

Answer

Create a Client Script that runs on load to update related records.

Answer

Create an ACL to automatically propagate changes.

Answer

Create a UI Policy that sets the location field on related records.

Question 7

A developer is creating a catalog item that requires a user to upload a file. Which variable type should be used?

Accepted Answer

Attachment. The Attachment variable type is specifically designed for file uploads in ServiceNow catalog items. It provides a built-in file picker and stores the uploaded file as an attachment on the requested record, enabling users to submit documents directly through the catalog form.

Answer

Multi Line Text

Answer

Single Line Text

Answer

Checkbox

Question 8

A company has a custom table 'u_incident_task' that extends 'task'. The developer wants to add a field 'u_approval' that is a reference to 'sysapproval_approver'. Which method is the correct way to create this field?

Accepted Answer

Create a 'Reference' field and set the reference table to 'sysapproval_approver'.. A Reference field is designed to create a link from one table to another, storing the sys_id of the target record. Since 'u_approval' needs to point to a specific record in the 'sysapproval_approver' table, a Reference field with the reference table set to 'sysapproval_approver' is the appropriate method. This ensures referential integrity and allows the platform to resolve display values and enforce relationships.

Answer

Create a 'List' field type and set the table to sysapproval_approver.

Answer

Create a 'Reference' field and set the table to 'task' and the reference field to 'sysapproval_approver'.

Answer

Create a 'Choice' field and populate it with sysapproval_approver values.

Question 9

A developer needs to create a service catalog variable that allows the user to select multiple values from a predefined list. Which variable type should be used?

Accepted Answer

Multiple Choice (Checkbox). The Multiple Choice (Checkbox) variable type in ServiceNow allows users to select multiple values from a predefined list. This is the only variable type that supports multi-select behavior, which is required when a user needs to choose more than one option from a set of choices.

Answer

Single Line Text

Answer

Radio Button

Answer

Select Box

Question 10

Which THREE of the following are true about ACLs (Access Control Lists)? (Choose three.)

Accepted Answer

ACLs can include conditions that must be met for access.. Option A is correct because ACLs are rule sets whose individual entries (ACEs) contain conditions—such as matching user, group, role, source IP, or time—that must be satisfied before the requested access is granted. Option D is correct because ACLs define permissions that explicitly allow or deny operations like read (SELECT/view) and write (INSERT/UPDATE/DELETE) on records or objects, which is their core purpose. Option E is correct because ACLs can be attached to specific resources and scoped to a particular application or context, so permissions apply only within that application's scope. Option B is wrong because ACLs are enforced server-side (by the database, OS, or service), not evaluated on the client, which the client could bypass. Option C is wrong because ACLs apply broadly to many object types—tables, records, files, network interfaces, and other resources—not only to system tables.

Answer

ACLs are evaluated on the client side.

Answer

ACLs are only applicable to system tables.

Question 11

Which TWO of the following are types of UI Policies? (Choose two.)

Accepted Answer

On change. In ServiceNow, UI Policies come in two distinct types: 'on load' policies, which run when a form is first loaded and can set fields to mandatory, read-only, or hidden before the user interacts with the record, and 'on change' policies, which run when a specified field value changes and dynamically adjust other fields' mandatory, read-only, or visible state. Therefore options B (On load) and A (On change) are the two correct UI Policy types. The remaining options do not exist as UI Policy types: 'On submit' (C) is not a UI Policy type (client-side submission logic is handled by onSubmit client scripts or UI Policy actions, not a policy type), 'On delete' (D) is not a UI Policy type (record deletion is governed by business rules or ACLs), and 'On query' (E) is not a UI Policy type (query behavior is controlled by before-query business rules or ACL read restrictions).

Answer

On submit

Answer

On delete

Answer

On query

Question 12

Drag and drop the steps to create a new Catalog Item in ServiceNow into the correct order.

Accepted Answer

Navigate to Maintain Items, then Create New, then Set Category and Details, then Add Variables, then Submit. The correct order: navigate to Maintain Items, create new, set category and details, add variables, and submit.

Answer

Navigate to Maintain Items, then Create New, then Add Variables, then Set Category and Details, then Submit

Answer

Set Category and Details, then Navigate to Maintain Items, then Create New, then Add Variables, then Submit

Answer

Navigate to Maintain Items, then Add Variables, then Create New, then Set Category and Details, then Submit

Question 13

A developer needs to display a warning message to the user when a specific field value changes on a form, but the record should still be savable. Which approach should be used?

Accepted Answer

Create an 'onChange' Client Script using g_form.addErrorMessage() or g_form.showFieldMsg().. An 'onChange' Client Script runs on the client side when a specific field value changes, allowing the developer to display a warning message using g_form.addErrorMessage() or g_form.showFieldMsg() without preventing the record from being saved. This approach ensures the user sees the warning interactively while still being able to submit the form, which matches the requirement exactly.

Answer

Create a UI Policy with a condition and a UI message.

Answer

Create a Business Rule that uses gs.addErrorMessage().

Answer

Create a Data Policy for the field and set a warning message.

Question 14

A company has a Business Rule that runs after a record is updated. The rule needs to update a related record on a different table. However, the related record update is not being saved. What is the most likely cause?

Accepted Answer

The script is missing the .update() method on the GlideRecord object after setting field values.. In ServiceNow, when a Business Rule modifies a GlideRecord object (e.g., setting field values on a related record), the changes are not persisted to the database until the `.update()` method is explicitly called. Without `.update()`, the script runs without error but the modifications are lost, which is the most common cause of an update not being saved.

Answer

There is a script error that is being ignored because the Business Rule is set to 'true' for 'Run asynchronously'.

Answer

The Business Rule runs in a separate transaction and the update is rolled back.

Answer

The user running the script does not have write access to the related table.

Question 15

A developer implemented an ACL to restrict read access on the 'incident' table. The condition script checks if the user is a member of the 'incident_manager' group. However, users who are not in the group are still able to see incidents. What is the most likely reason?

Accepted Answer

There is another ACL with a lower order that grants read access to all users, and the evaluation never reaches the scripted ACL.. ACLs in ServiceNow are evaluated in order of their 'Order' field (lower numbers first). If a lower-order ACL grants read access to all users, the evaluation stops at that ACL and never reaches the scripted ACL that restricts access to the 'incident_manager' group. This is the most common reason for an ACL appearing to not work — a broader, higher-priority ACL is allowing access before the restrictive one is evaluated.

Answer

The ACL is cached and users need to log out and back in for changes to take effect.

Answer

The condition script returns 'true' for users in the group but does not return 'false' for others, so the ACL defaults to 'no decision' and access is allowed.

Answer

The ACL is set to 'Inactive' so it does not apply, leaving access open.