SNOW-CAD Hard Questions — 25 Difficult Questions

Question 1

Which THREE of the following are true about ACLs (Access Control Lists)? (Choose three.)

Accepted Answer

ACLs can include conditions that must be met for access.. Option A is correct because ACLs are rule sets whose individual entries (ACEs) contain conditions—such as matching user, group, role, source IP, or time—that must be satisfied before the requested access is granted. Option D is correct because ACLs define permissions that explicitly allow or deny operations like read (SELECT/view) and write (INSERT/UPDATE/DELETE) on records or objects, which is their core purpose. Option E is correct because ACLs can be attached to specific resources and scoped to a particular application or context, so permissions apply only within that application's scope. Option B is wrong because ACLs are enforced server-side (by the database, OS, or service), not evaluated on the client, which the client could bypass. Option C is wrong because ACLs apply broadly to many object types—tables, records, files, network interfaces, and other resources—not only to system tables.

Answer

ACLs are evaluated on the client side.

Answer

ACLs are only applicable to system tables.

Question 2

A developer is creating a custom Service Portal widget that displays a list of records from a custom table. The widget must allow users to filter the list by multiple criteria and sort the results. The developer wants to implement this using standard Service Portal features. Which two approaches are valid for enabling filtering and sorting in the widget? (Choose two.)

Accepted Answer

Use the 'spList' directive to render the list, and configure it with a filter and sort options.. The 'spList' directive is the standard Service Portal component for rendering lists with filtering and sorting. It can be configured with filter and sort options directly, and its attributes can be bound to scope variables that users can change, enabling dynamic interaction. The other options either require custom development, use directives for different purposes, or add unnecessary complexity. Thus, the two valid approaches are using spList with configured options and binding its filter/sort attributes to user-modifiable variables.

Answer

Use the 'spModal' service to open a modal with filter options, and then refresh the list based on the selected filters.

Answer

Implement a custom client-side filter using AngularJS and call the server to retrieve filtered data via GlideAjax.

Answer

Use the 'spWidget' directive to embed a list widget that includes filtering and sorting controls.

Question 3

A developer is working on a scoped application and needs to create a REST API endpoint that external systems can call to retrieve a list of records from a custom table. The developer wants to ensure that only authenticated users with a specific role can access the endpoint. Which steps should the developer take to secure the REST API?

Accepted Answer

Create a Scripted REST API with a resource, and set the 'Requires authentication' checkbox to true, then add an ACL to the custom table restricting read access to the required role.. To secure a Scripted REST API, the 'Requires authentication' option must be enabled to ensure only authenticated users can access it. Additionally, ACLs on the underlying table enforce role-based access, so only users with the required role can read the records. This layered approach is the standard and most secure method.

Answer

Create a Scripted REST API with a resource, and in the script, check gs.hasRole('specific_role') before returning data; no ACL is needed.

Answer

Create a REST API by extending the Table API, and configure a REST API access policy to allow only the specific role.

Answer

Create a Scripted REST API with a resource, and set the 'Requires authentication' checkbox to false, then use basic authentication with a service account that has the specific role.

Question 4

A script include has a function that uses the 'GlideRecordSecure' class. When called from a Business Rule in a different scope, it throws a security exception. What is the most likely cause?

Accepted Answer

The script include does not have the 'Accessible from' property set to all scopes.. The 'Accessible from' property on a Script Include controls which scopes can invoke its functions. When this property is not set to 'All scopes', a Business Rule in a different scope cannot call the Script Include, resulting in a security exception. The GlideRecordSecure class itself is accessible across scopes, but the Script Include's access restriction prevents the call.

Answer

The function is not defined as a static function.

Answer

The GlideRecordSecure class is not accessible from other scopes.

Answer

The script include is not marked as public.

Question 5

A developer is creating a business rule to automatically assign tasks to a specific group based on the category. The rule is set to run before insert and update on the Task table. The script uses current.assignment_group = 'IT Support'. However, the assignment group is not being set on update even though it works on insert. Which three potential causes should the developer investigate? (Choose three.)

Accepted Answer

The business rule's condition field requires the category to be set. Option A: If the business rule's condition depends on the category field, and the category isn't changed on update, the rule may not run, preventing assignment group update. Option C: If the script only runs on insert but not update, it won't execute on updates. Option E: Another business rule acting after this one could reset the assignment group. Option B: The assignment group being read-only on the form does not stop business rules from setting its value; this is not a cause. Option D: Running only in the global scope does not affect whether the rule runs on update; scope is not a cause.

Answer

The assignment group field is read-only on the form but can be set via business rule

Answer

The business rule is set to run only in the global scope

Question 6

A developer is building a custom Service Portal widget that must display a count of active incidents for the logged-in user's assignment group. The count must be computed on the server and returned to the client controller for display without a full page reload. Which approach correctly retrieves the count from the server?

Accepted Answer

Call a Scripted REST API from the client controller and have the API return the count as JSON.. The server script of a Service Portal widget already executes on the server and can use GlideAggregate or GlideRecord to compute the count. To return that value to the client controller without a page reload, the widget's server script should populate the data object, and the client controller reads it from the c.data object. A Scripted REST API is also a valid server-side mechanism, but the most direct and idiomatic portal approach is to compute the count in the widget server script and expose it via c.data.

Answer

Use g_form.getValue('assignment_group') in the client controller to read the group, then query the incident table client-side.

Answer

Embed a UI Page that runs a GlideAggregate on the incident table and include it in the widget's HTML template.

Answer

Use GlideAjax with a client-callable script include that returns the count from a GlideAggregate.

Question 7

A developer creates a script include named 'Utils' with a function that uses gs.log('message'). When called from a business rule on the incident table, the log is written. However, when called from a scheduled job in the same scope, no log appears. What could be the reason?

Accepted Answer

The script include is not global.. A script include that is not marked 'Accessible from all scopes' (i.e., not global) can only be called from scripts within its own application scope. If the business rule and script include share a scope, the call succeeds; if the scheduled job runs in a different scope, the call fails silently and no log is written. Making the script include global (or adding a cross-scope access privilege) resolves it.

Answer

The scheduled job's log level is set to 'errors only'.

Answer

The business rule runs in the same scope but the scheduled job runs in a different scope.

Answer

The scheduled job runs with a different user context.

Question 8

A developer creates a UI Page that uses Jelly to render a form-like interface. The developer wants a field named 'cmdb_ci' to appear on the page, but when the page is rendered, the field does not appear. The Jelly script includes a <g:ui_reference> tag for the field. What is the most likely cause?

Accepted Answer

The tag requires a 'name' attribute that matches the field name, and it is missing or incorrect.. The Jelly tag renders a reference field and requires a 'name' attribute that matches the field name on the table. If that attribute is missing, misspelled, or does not correspond to an actual field such as cmdb_ci, the tag will not render the field. This is the most common cause of a field not appearing in a Jelly-rendered UI Page.

Answer

The 'cmdb_ci' field is not present on the form layout used by the UI Page.

Answer

The 'cmdb_ci' field is read-only on the table, so Jelly cannot render it.

Answer

The UI Page lacks a 'client script' that populates the field value before rendering.

Question 9

A ServiceNow instance is configured to use LDAP for user authentication and role membership. After a recent LDAP schema change, users can authenticate but some users are missing their assigned roles. The LDAP server is returning all attributes correctly. What is the most likely cause of this issue?

Accepted Answer

The 'LDAP Group DN' format in the LDAP server configuration does not match the new schema. The LDAP Group DN format defines how ServiceNow maps LDAP groups to roles. After a schema change, if the DN structure for groups has been altered (e.g., OU names changed), the stored format in the LDAP server configuration will no longer match, causing role membership to fail even though user authentication (which uses a separate base DN and filter) still works. The LDAP server returning all attributes correctly confirms the issue is in the mapping configuration, not in data retrieval.

Answer

The LDAP server's base DN for user search has changed

Answer

The 'Use secure connection' checkbox is unchecked in the LDAP configuration

Answer

The LDAP server is not returning the 'memberOf' attribute for users

Question 10

A UI Macro on a form is causing slow load times. The macro uses multiple GlideRecord queries in its server-side script. The developer wants to optimize performance without altering functionality. Which action is most effective?

Accepted Answer

Replace GlideRecord queries with GlideAggregate and cache the results. Replacing multiple GlideRecord queries with GlideAggregate and caching the results is the most effective optimization because GlideAggregate performs aggregation at the database level, reducing the number of queries and the amount of data transferred. Caching the results further avoids repeated database hits on subsequent form loads, directly addressing the slow load times without changing functionality.

Answer

Load the macro asynchronously using UI Macro configuration

Answer

Move the queries to a client script using GlideAjax to reduce server load

Answer

Use g_form.addOption() to populate a reference field instead of building the macro

Question 11

A large enterprise runs ServiceNow on a single instance. They have a custom table 'u_project_task' that stores task details for projects. Each project task has a reference field to the 'u_project' table. The 'u_project' table has approximately 50,000 records, and the 'u_project_task' table has about 2 million records. Users report that opening a project record and viewing its related tasks takes over 30 seconds. The system uses an out-of-box related list to display tasks. The instance has standard hardware resources. The administrator has already confirmed that there are no performance issues with the database server or network. Which course of action should the administrator take to improve the performance of the related list?

Accepted Answer

Create a database index on the 'u_project' field in the 'u_project_task' table to speed up the join.. The performance bottleneck is the database query that joins the large 'u_project_task' table (2M records) with the 'u_project' table on the reference field. Without an index on the 'u_project' field in 'u_project_task', the database must perform a full table scan for each related list query. Creating a database index on that foreign key column allows the database to use an index seek, dramatically reducing query time.

Answer

Archive project tasks older than 1 year to a separate table to reduce the data volume.

Answer

Increase the glide.ui.related_list.max_timeout property to allow the query more time.

Answer

Add additional application nodes to the instance to distribute the load.

Question 12

An organization uses an LDAP integration to import user accounts into ServiceNow. The integration creates a large number of users, but some users are missing their manager field. The manager field in LDAP is a distinguished name (DN). The transform map uses a reference field mapping with "Display value" unchecked. The target field "manager" on sys_user is a reference to sys_user. The import set log shows no errors for those records. What is the most likely cause?

Accepted Answer

The LDAP DN values do not match the sys_id of the manager users.. The manager field is a reference to sys_user. When mapping an LDAP DN (distinguished name) to a reference field with 'Display value' unchecked, the system expects a sys_id or a value that can be matched via a reference qualifier. Since the DN is not a sys_id and no other matching logic is applied, the mapping fails silently, leaving the field empty. The import set log shows no errors because the transformation completes but the field is not populated.

Answer

The transform map's "Coalesce" field is set on manager.

Answer

The import set's "On Conflict" setting is set to "Ignore".

Answer

The manager field in LDAP is empty for some users.

Question 13

A developer is testing a REST API call to retrieve active users with the ITIL role created since last month. The response returns an error. What is the most likely cause?

Accepted Answer

The query parameter sysparm_query uses a script which is not allowed in REST API calls.. The error occurs because the sysparm_query parameter in a REST API call to the /api/now/table/sys_user endpoint does not support scripts; it only accepts encoded query strings using operators like '=', '^', 'STARTSWITH', etc. Using a script in sysparm_query violates the REST API specification, which expects a simple query string, not executable code, leading to a bad request error.

Answer

The Accept header should be application/xml.

Answer

The endpoint should be /api/now/table/sys_user_list.

Answer

The query should use sysparm_fields instead of sysparm_query.

Question 14

A company has developed a custom Scripted REST API endpoint that processes incoming orders and then makes synchronous outbound REST calls to an external shipping system for validation. During testing with low concurrency, the endpoint works correctly. However, in production with high concurrency, the endpoint frequently times out and returns 504 errors to the caller. The performance team has confirmed that the external shipping system is responsive and the network latency is acceptable. Which course of action should the development team take to resolve the timeout issue?

Accepted Answer

Refactor the script to make asynchronous HTTP requests and process the shipping validation response using a separate queue or business rule.. The issue is that synchronous outbound REST calls block the incoming request thread, and under high concurrency, threads are exhausted, causing timeouts and 504 errors. Refactoring to asynchronous HTTP requests allows the incoming request to complete quickly, while the shipping validation response is processed separately via a queue or business rule. This decouples the processing and scales better under load.

Answer

Deploy additional MID Servers to distribute the outbound call load.

Answer

Implement a caching layer to store shipping validation results and avoid repeated calls to the external system.

Answer

Increase the timeout value in the outbound REST Message record to accommodate peak loads.

Question 15

A company has a custom table 'u_training_course' with a reference field to 'sys_user' named 'u_instructor'. The requirement is that only users with the 'instructor' role can be selected in this field. Which approach should be used to enforce this?

Accepted Answer

Add a reference qualifier on the field to filter users with the 'instructor' role. A reference qualifier is the declarative way to filter the records available in a reference field on ServiceNow. By adding a condition like 'roles=instructor' to the reference qualifier of the 'u_instructor' field, only users with the 'instructor' role will appear in the lookup, enforcing the requirement at the database query level without custom scripting.

Answer

Create a business rule on the table to check the role and reject invalid selections

Answer

Use a client script to validate the selection before form submission

Answer

Configure an ACL on the reference field to restrict write access

Question 16

A developer is debugging a Business Rule that runs on 'before' but not showing expected behavior. In Studio, which tool can show the execution order and triggered scripts?

Accepted Answer

Debugger. The Debugger in Studio allows stepping through scripts and viewing execution order, making it ideal for debugging a Business Rule that runs on 'before' but is not showing expected behavior. Option A is wrong; Scripts Background is for running ad-hoc server-side scripts, not for debugging execution order. Option B is wrong; Update Set tracks changes to configuration items, not script execution. Option D is wrong; Flow Designer is for creating and managing flows, not for debugging script execution order.

Answer

Scripts Background

Answer

Update Set

Answer

Flow Designer

Question 17

A developer reports that an after business rule on the Change Request table is running twice for each update. The business rule is not scheduled or async. Which is the most likely cause?

Accepted Answer

The business rule script updates the same record, causing a loop. An after business rule that updates the same record it triggered on will cause the business rule to fire again on the subsequent update, creating a recursive loop. Since the rule is not scheduled or async, each update triggers the rule synchronously, and if the script performs a `current.update()` or similar operation on the same table, it re-fires the same business rule, leading to duplicate execution.

Answer

The business rule is set to run 'On Update' and also 'On Insert'

Answer

The business rule order is too high

Answer

The business rule exists in two different scoped applications

Question 18

A developer is creating a REST API integration that retrieves data from an external system and updates ServiceNow records. Which THREE considerations are critical for handling authentication securely? (Choose three.)

Accepted Answer

Store credentials in the ServiceNow Credential Store instead of scripts. Storing credentials directly in scripts exposes them to unauthorized access and makes rotation difficult. The ServiceNow Credential Store securely encrypts and manages credentials, allowing scripts to reference them by alias without hardcoding sensitive data, which is a fundamental security best practice for REST API integrations.

Answer

Enable credential monitoring in the Security Operations Center

Answer

Configure the external system to authenticate ServiceNow requests

Question 19

Refer to the exhibit. A MID Server is failing to connect to an external Oracle database. The error log shows the above message. Which is the most likely cause?

Accepted Answer

The database instance name (service name) is incorrect in the configuration.. The error log in the exhibit (ORA-12514 or similar 'listener does not currently know of service requested') indicates the MID Server reached the listener but the service name it requested is not registered. This points to an incorrect database instance/service name in the MID Server's Oracle configuration, not a network or client issue.

Answer

The firewall is blocking port 1521.

Answer

The Oracle client is not installed.

Answer

The MID Server is not running.

Question 20

Which THREE statements are correct about script includes and their usage across scopes? (Select THREE)

Accepted Answer

A script include can be accessed from a Business Rule in a different scope if the script include is defined as a global script include.. Option A is correct because a global script include resides in the global scope, which is accessible from any scoped application, so a Business Rule in a different scope can call it. Option C is correct because, for a script include in a scoped application to be callable from outside that scope, its Accessible from setting must be set to 'All application scopes' (i.e., made public); otherwise it remains private to its own scope. Option E is correct because the 'Accessible from' property on a script include can be configured either as 'All application scopes' or restricted to specific scopes via the scope selector. Option B is wrong because 'public' is not a standalone script include property value; the actual control is the 'Accessible from' setting, and even public script includes are subject to scope-access rules. Option D is wrong because cross-scope calls do not require a global scope prefix; you reference the script include by its class name, and access is governed by the Accessible from configuration rather than a mandatory prefix.

Answer

Script includes defined as 'public' can be accessed from any scope without restriction.

Answer

To call a script include from another scope, you must use the global scope prefix.