SNOW-CAD Hard Questions — 25 Difficult Questions

Question 1

The Business Rule above runs on the 'incident' table. It is set to run 'before' update. What is the most likely issue with this script?

Accepted Answer

The script will cause a recursive loop because it updates incident records within a Business Rule that runs on the same table.. Updating the same table (incident) within a 'before update' Business Rule that runs on that table creates a recursive loop. Each time the script calls gr.update() on an incident record, it triggers the same Business Rule again, leading to infinite recursion until the system enforces a governor limit or stack overflow. ServiceNow detects and prevents such loops by throwing an error, but the design is fundamentally flawed.

Answer

The script should use 'current' instead of 'gr' to update records.

Answer

The script has a syntax error: missing semicolon after the while loop.

Answer

The script does not commit the changes because it uses 'gr.update()' instead of 'current.update()'.

Question 2

A developer is creating a business rule to automatically assign tasks to a specific group based on the category. The rule is set to run before insert and update on the Task table. The script uses current.assignment_group = 'IT Support'. However, the assignment group is not being set on update even though it works on insert. Which three potential causes should the developer investigate? (Choose three.)

Accepted Answer

The business rule's condition field requires the category to be set. Option A: If the business rule's condition depends on the category field, and the category isn't changed on update, the rule may not run, preventing assignment group update. Option C: If the script only runs on insert but not update, it won't execute on updates. Option E: Another business rule acting after this one could reset the assignment group. Option B: The assignment group being read-only on the form does not stop business rules from setting its value; this is not a cause. Option D: Running only in the global scope does not affect whether the rule runs on update; scope is not a cause.

Answer

The assignment group field is read-only on the form but can be set via business rule

Answer

The business rule is set to run only in the global scope

Question 3

A developer is testing a REST API call to retrieve active users with the ITIL role created since last month. The response returns an error. What is the most likely cause?

Accepted Answer

The query parameter sysparm_query uses a script which is not allowed in REST API calls.. The error occurs because the sysparm_query parameter in a REST API call to the /api/now/table/sys_user endpoint does not support scripts; it only accepts encoded query strings using operators like '=', '^', 'STARTSWITH', etc. Using a script in sysparm_query violates the REST API specification, which expects a simple query string, not executable code, leading to a bad request error.

Answer

The Accept header should be application/xml.

Answer

The endpoint should be /api/now/table/sys_user_list.

Answer

The query should use sysparm_fields instead of sysparm_query.

Question 4

You are a ServiceNow developer at a large healthcare organization. You have created a custom table 'u_medical_device' to track medical equipment. The table has fields: 'u_device_id' (string), 'u_device_type' (choice: 'Monitor', 'Ventilator', 'Pump'), 'u_location' (reference to 'u_location' table), 'u_status' (choice: 'Active', 'Inactive', 'Maintenance'), and 'u_last_calibration_date' (date). You need to implement a business rule that, when a device's status is changed to 'Maintenance', automatically sets the 'u_last_calibration_date' to the current date and creates a 'u_maintenance_log' record with a reference to the device. Additionally, you want to ensure that only users with the 'medical_device_admin' role can change the status to 'Maintenance'. You have written the business rule but it is not firing correctly. The sys_script table shows the rule is active, order 100, when 'before' query and 'after' update. The condition is: current.status.changes() && current.status == 'Maintenance'. The script sets current.u_last_calibration_date = gs.now(); and creates a GlideRecord for u_maintenance_log. However, the calibration date is not updated, and no log record is created. What is the most likely cause?

Accepted Answer

The business rule is set to run 'before' query instead of 'before' update or 'after' update.. The business rule is configured to run on both 'before query' and 'after update' phases. The 'before query' phase only fires when a record is retrieved from the database, not during updates. The 'after update' phase fires after the record is saved, but setting 'current.u_last_calibration_date' at that point does not persist because the record is already committed; the script would need an explicit 'current.update()' to save the change, which is not present. Therefore, the rule should be set to run on 'before update' (to set the date before save) and optionally 'after update' (to create the log). The current configuration fails to execute the intended logic during the update operation, making option B correct: the rule is set to 'before query' instead of 'before update' (or 'after update' alone is insufficient for the date update).

Answer

The script uses 'gs.now()' which returns a date-time string, but 'u_last_calibration_date' is a date field, causing a type mismatch and silent failure.

Answer

The user executing the update does not have the 'medical_device_admin' role, and the business rule lacks an ACL check.

Answer

The condition 'current.status.changes() && current.status == 'Maintenance'' is invalid because 'changes()' returns a boolean and cannot be combined with '=='.

Question 5

A developer is debugging an issue where a Script Action in a Flow Designer flow is not triggering. The flow is configured to run when a record is created or updated in the incident table. The Script Action is supposed to set a field based on a condition, but it never executes. What should the developer check first?

Accepted Answer

Check the flow's trigger conditions to ensure they match the record update.. The most common reason a Script Action fails to trigger is that the flow's trigger conditions do not match the record update event. Flow Designer evaluates trigger conditions before any actions execute; if the conditions are misconfigured (e.g., expecting a specific field change that isn't occurring), the entire flow, including the Script Action, will not run. The developer should first verify that the trigger conditions align with the actual record creation or update scenario.

Answer

Check if the flow is published.

Answer

Check if the script include used in the Script Action is accessible.

Answer

Check if the Script Action script has syntax errors.

Question 6

A ServiceNow instance is being integrated with an external HR system using a SOAP message. The SOAP call is failing intermittently. The developer notices that the XML payload contains special characters like '&' and '<'. What is the best practice to handle these characters in SOAP messages?

Accepted Answer

Escape the characters using XML entities (e.g., & for &).. SOAP messages are XML-based, and special characters like '&' and '<' must be escaped using XML entities (e.g., & for &, < for <) to maintain valid XML syntax. This ensures the XML parser correctly interprets the payload without breaking the message structure, which is the standard practice per the XML specification and SOAP protocol.

Answer

Wrap the payload in a CDATA section.

Answer

Encode the entire payload in Base64.

Answer

Use URL encoding for the payload.

Question 7

A developer creates a script include named 'Utils' with a function that uses gs.log('message'). When called from a business rule on the incident table, the log is written. However, when called from a scheduled job in the same scope, no log appears. What could be the reason?

Accepted Answer

The script include is not global.. If the script include is not global (i.e., it is scoped to a specific application), it may not be accessible from all execution contexts. Even though the scheduled job is defined in the same scope, scheduled jobs can run under a different context (such as the global scope) or have additional restrictions that prevent access to non-global script includes. This explains why the business rule works (as it runs in the application scope) but the scheduled job does not. Option A is incorrect because log level settings do not affect script include accessibility—they control whether log messages are displayed. Option B is incorrect because the scenario states the scheduled job is in the same scope. Option D is incorrect because user context does not affect script include visibility; it affects record access.

Answer

The scheduled job's log level is set to 'errors only'.

Answer

The business rule runs in the same scope but the scheduled job runs in a different scope.

Answer

The scheduled job runs with a different user context.

Question 8

A UI Macro on a form is causing slow load times. The macro uses multiple GlideRecord queries in its server-side script. The developer wants to optimize performance without altering functionality. Which action is most effective?

Accepted Answer

Replace GlideRecord queries with GlideAggregate and cache the results. Replacing multiple GlideRecord queries with a single GlideAggregate query reduces the number of database calls, improving performance. Caching the results further avoids redundant queries. Option A is incorrect because asynchronous loading does not reduce the total server processing. Option B is incorrect because moving queries to a client script via GlideAjax only shifts the load but still requires server-side processing. Option C is incorrect because g_form.addOption() is for adding options to a select field, which does not address the macro's performance issue.

Answer

Load the macro asynchronously using UI Macro configuration

Answer

Move the queries to a client script using GlideAjax to reduce server load

Answer

Use g_form.addOption() to populate a reference field instead of building the macro

Question 9

A UI Macro that displays a custom header is not appearing on the form. The macro is referenced in a UI16 theme. What is the first troubleshooting step?

Accepted Answer

Examine the UI Macro record for syntax errors in the HTML or Jelly script.. The first troubleshooting step is to examine the UI Macro record for syntax errors in the HTML or Jelly script (Option D). Syntax errors are the most common cause of a macro not rendering. Checking the browser's HTML source (A) is possible but not the first step. Ensuring the UI Macro is in global scope (B) is less likely the issue, as macros are typically accessible within the theme. Verifying UI Scripts (C) is unrelated because UI Scripts are separate client-side resources, not the macro's own code.

Answer

Check the browser's HTML source for the macro's placeholder.

Answer

Ensure the UI Macro is in the global scope.

Answer

Verify that all referenced UI Scripts are loaded.

Question 10

A developer is designing a data architecture for a multi-tenant environment where each company's data must be isolated. Which TWO strategies can achieve this? (Choose two.)

Accepted Answer

Implement domain separation.. Options A and E are correct. Domain separation (A) provides built-in data isolation by partitioning data based on domains, ensuring each company sees only its own data. Separate tables for each company (E) physically isolate data at the database level. Option B (ACLs) adds security but does not inherently isolate data in a multi-tenant architecture. Option C (database views) filters data but does not enforce isolation at the application layer. Option D (GlideRecord conditions) relies on developer discipline and is not a robust architectural solution.

Answer

Use access control lists (ACLs) on each record.

Answer

Create database views that filter data by company.

Answer

Add a condition to every GlideRecord query to filter by company.

Question 11

An organization uses an LDAP integration to import user accounts into ServiceNow. The integration creates a large number of users, but some users are missing their manager field. The manager field in LDAP is a distinguished name (DN). The transform map uses a reference field mapping with "Display value" unchecked. The target field "manager" on sys_user is a reference to sys_user. The import set log shows no errors for those records. What is the most likely cause?

Accepted Answer

The LDAP DN values do not match the sys_id of the manager users.. The manager field is a reference to sys_user. When mapping an LDAP DN (distinguished name) to a reference field with 'Display value' unchecked, the system expects a sys_id or a value that can be matched via a reference qualifier. Since the DN is not a sys_id and no other matching logic is applied, the mapping fails silently, leaving the field empty. The import set log shows no errors because the transformation completes but the field is not populated.

Answer

The transform map's "Coalesce" field is set on manager.

Answer

The import set's "On Conflict" setting is set to "Ignore".

Answer

The manager field in LDAP is empty for some users.

Question 12

Which THREE of the following are correct statements about Service Portal client controllers?

Accepted Answer

They can use AngularJS services like $http and $timeout.. Service Portal client controllers are AngularJS controllers that run in the browser. They can use standard AngularJS services such as $http for making AJAX calls to external APIs or the instance, and $timeout for delaying execution, which are both injected as dependencies.

Answer

They run on the server and are called via server-side includes.

Answer

They must define a $scope variable explicitly to bind data to the template.

Question 13

A developer is troubleshooting a client script that hides a field on a form when a condition is met, but it is not working. The script is attached to the 'g_form' object in Studio. What is the most likely reason?

Accepted Answer

The client script is set to run on the 'Load' event instead of 'Change'.. The most likely reason because client scripts that need to react to a condition change must be set to run on 'Change' event rather than 'Load'. If the script runs only on 'Load', it executes once when the form loads and will not re-run when the condition changes, so the field remains visible. Option B is incorrect because the API for hiding fields (e.g., g_form.setVisible) is not deprecated. Option C is incorrect because client scripts do not have a 'Run As' role; that applies to server-side scripts. Option D is incorrect because client scripts can access any field present on the form regardless of the field's scope.

Answer

The script is using a deprecated API.

Answer

The script is not running due to a missing 'Run As' role.

Answer

The field is not part of the application scope.

Question 14

A company has a business rule on the Task table that runs on 'before' insert. The rule uses current.gotoField('short_description') and current.setValue('short_description', 'Default'). The rule is ordered to run at 500. However, a second business rule on the same table with order 100 also sets the short_description. What will be the final value of short_description?

Accepted Answer

'Default'. Business rules execute in ascending order based on their 'order' field. The rule at order 100 runs first and sets the short_description. Then the rule at order 500 runs and overrides that value with 'Default' using current.setValue(). Since both are 'before' insert rules, the final value written to the database is the one set by the last-executed rule, which is order 500.

Answer

Both values will be concatenated

Answer

The value set by the rule at order 100

Answer

The field will be empty because gotoField() clears it

Question 15

A large financial institution has a custom application for managing trade requests. The application uses a business rule on the 'Trade' table that calculates and sets the 'net_value' field based on 'quantity' and 'price'. Recently, traders have reported that when they update existing trades via a REST API integration, the 'net_value' field is not being recalculated. The business rule is set to run 'before' insert and 'before' update. The REST API uses GlideRecord to update the trade records. Upon investigation, the developer finds that the business rule script includes a check: 'if (current.changes('quantity') || current.changes('price')) { // recalculate }'. The script works correctly when updates are made from the UI. What is the most likely cause of the issue?

Accepted Answer

The GlideRecord used in the REST API does not load the record's previous values, so changes() returns false.. The GlideRecord API used in REST API integrations does not automatically load the previous values of fields into the `changes()` method. When a record is updated via GlideRecord in a scripted REST API, the `current` object in the business rule does not have the 'previous' values populated, so `current.changes('quantity')` and `current.changes('price')` both return `false`. This causes the recalculation logic to be skipped, even though the business rule is set to run 'before update'. In contrast, UI updates load previous values correctly, making `changes()` work as expected.

Answer

The business rule is set to run 'before' update, but the REST API triggers 'after' update.

Answer

The REST API sends the update request to a different instance, bypassing the business rule.

Answer

The condition 'current.changes('quantity') || current.changes('price')' is incorrectly formatted; it should use 'current.changes('quantity') || current.changes('price')'.

Question 16

A team is using a SOAP web service integration. The response contains namespaced XML, and the script that parses it is not extracting values correctly. What is the most likely issue?

Accepted Answer

Missing or incorrect namespace prefix handling in the script. Namespaced XML requires proper namespace prefix handling to extract values; if the script lacks or mismatches prefixes, parsing fails. Option A is incorrect because WSDL caching affects endpoint updates, not parsing. Option B is incorrect because SOAP version mismatch typically causes communication errors, not parsing issues. Option C is incorrect because HTTP timeout would result in no response, not incorrect value extraction.

Answer

WSDL caching prevents updated endpoint

Answer

SOAP version mismatch between request and response

Answer

HTTP timeout during response retrieval

Question 17

An administrator is designing a data model to manage vendor contracts. The solution must allow contracts to be associated with multiple departments and multiple vendors. Which THREE approaches are valid to model this many-to-many relationship in ServiceNow? (Choose three.)

Accepted Answer

Create an intermediate table 'ContractDepartment' with reference fields to Contract and Department. Options A, C, and D are valid approaches for modeling a many-to-many relationship in ServiceNow. Option A creates an intermediate table with reference fields, which is a standard relational method. Option C uses a GlideList field, which allows storing multiple references in a single field and can be used for many-to-many relationships. Option D uses a multi-reference field, which is specifically designed for many-to-many relationships. Option B is invalid because a single 'Department' field cannot store multiple records. Option E is invalid because storing comma-separated sys_ids in a String field is not a recommended practice and breaks data integrity.

Answer

Create a single 'Department' field on the Contract table and use it to store all department records

Answer

Use a 'String' field on the Contract table to store a comma-separated list of department sys_ids

Question 18

Refer to the exhibit. A developer created this dictionary override for a new field. When saving, an error occurs. What is the cause?

Accepted Answer

Integer fields do not support the max_length property. Integer fields in ServiceNow do not support the max_length attribute; that property is only applicable to string fields. The system rejects the dictionary override because max_length is invalid for an integer. Option A is wrong because labels can contain spaces. Option C is wrong because 'integer' is correctly spelled; the issue is not a typo. Option D is wrong because the order of JSON properties does not matter in dictionary overrides.

Answer

The label 'Custom Count' contains spaces

Answer

internal_type should be 'integer' not 'integer' (typo)

Answer

The JSON properties must be in alphabetical order

Question 19

A developer writes a script include that uses GlideRecord to query a large table. The script is called multiple times in a single transaction. What is the best practice to optimize performance?

Accepted Answer

Use a single GlideRecord query with multiple conditions and call .getRowCount() at the end.. When a script include queries a large table multiple times in a single transaction, the best practice is to minimize database round-trips. Using a single GlideRecord query with multiple conditions (combined via OR/AND) reduces the number of queries executed. Calling .getRowCount() at the end forces the query to execute once and caches the result, avoiding redundant queries for counts. This is more efficient than separate queries (A), which each require a round-trip. createOrGetRecord (B) is designed for single-record operations and doesn't optimize multiple queries. setEncodeQuery(false) (D) disables encoding but does not improve performance for repeated calls.

Answer

Use separate GlideRecord queries for each call.

Answer

Use createOrGetRecord for each call to cache the result.

Answer

Use setEncodeQuery(false) to speed up the query.

Question 20

Refer to the exhibit. What security risk is present in this implementation?

Accepted Answer

The data is not subject to the same ACLs as server-side calls. Using client-side $http calls bypasses the server-side ACL evaluation that occurs when using spUtil or server scripts. Client-side REST API calls still respect ACLs based on the user's session, but they may expose sensitive data that goes through different security checks. However, a more critical risk is that the endpoint might be susceptible to CSRF if not protected. In the context of Service Portal, the recommended approach is to use spUtil.get or a server script to ensure proper data access control. Option D highlights the risk of inconsistent ACL enforcement.

Answer

The request exposes internal API credentials

Answer

The endpoint does not require authentication

Answer

The client exposes the widget to XSS attacks