SNOW-CAD Platform Features and Integration Practice Test 2 — 15 Questions

Question 1

A developer needs to create a flow in Flow Designer that sends an email to a manager when a high-priority incident is created. The flow should retrieve the manager's email from the caller's user record. Which data pill should be used to access the caller's manager's email in the 'Send Email' action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{{trigger.caller.manager.email}}. In Flow Designer, the dot-walking syntax `trigger.caller.manager.email` navigates from the incident record's caller field to the user record, then to the manager reference field (which is a sys_user record), and finally retrieves the email attribute of that manager's user record. This directly accesses the caller's manager's email address without needing an intermediate lookup.

Answer

Answer

Answer

Question 2

A ServiceNow instance needs to expose a REST API endpoint for external applications to query incident data. The developer creates a Scripted REST API and needs to ensure that only authorized applications can access it. Which THREE methods can be used to secure the Scripted REST API?

Accepted Answer

Require the request to include a valid ServiceNow username and password (Basic Authentication). Option A is correct because ServiceNow Scripted REST APIs can be secured by requiring HTTP Basic Authentication, where the external application supplies a valid ServiceNow username and password that the instance validates against its user records. Option C is correct because ServiceNow supports OAuth 2.0 for REST API authentication, requiring the caller to present a valid access token in the Authorization header (Bearer token) that the instance validates before granting access. Option D is correct because ServiceNow provides an API Keys application (com.glide.token_based_auth or the API Key module) that allows administrators to generate API keys and validate them from the incoming request header, restricting access to authorized applications. Option B is incorrect because SAML 2.0 assertions are used for federated SSO browser-based authentication, not for securing inbound REST API calls to a Scripted REST API. Option E is incorrect because LDAP is a directory service protocol for user authentication and lookup, not an IP-address-based access control mechanism for REST endpoints.

Answer

Require a valid SAML 2.0 assertion in the request body

Answer

Require that the request originates from an IP address within a specified LDAP directory

Question 3

An organization has a ServiceNow instance that integrates with an external HR system using a scheduled job that runs every hour. The job uses a REST message to fetch new hire records and creates user accounts in ServiceNow via a transform map. Recently, the number of new hires has increased significantly, and the job now takes over an hour to complete, causing the next job to start before the previous one finishes. The administrator notices that the transform map is using 'Coalesce' set to 'false' because the external system does not provide a unique identifier. The job also creates a large number of intermediate records that are later updated. The administrator wants to optimize the process to prevent overlapping job runs. Which course of action should the administrator take?

Accepted Answer

Set the 'Maximum rows to load' property on the transform map to a value that ensures the job finishes within 60 minutes. Setting the 'Maximum rows to load' property on the transform map limits the number of rows processed per run, ensuring the job completes within the 60-minute window. This prevents overlapping runs by capping the workload, allowing the scheduled job to finish before the next trigger, without requiring changes to the integration logic or external system.

Answer

Increase the scheduled job's interval to run every 2 hours to avoid overlap

Answer

Change the transform map to run asynchronously using a flow triggered by the import set row

Answer

Configure the import set table loader to run in multiple parallel threads to process records faster

Question 4

A ServiceNow administrator is configuring Single Sign-On (SSO) using SAML 2.0 with a corporate identity provider. Users report that after authenticating, they are redirected back to ServiceNow but see an error: 'Unable to process SAML response. Invalid user.' The administrator checks the SSO log and sees the message: 'No user found with username: [user@company.com]'. The username format in the SAML assertion is userPrincipalName (e.g., user@company.com). ServiceNow user records use the 'User ID' field (e.g., 'user'). What configuration change should the administrator make to resolve this issue?

Accepted Answer

Set the 'User Field' property to 'User ID' in the SAML2 configuration to match users based on their User ID. The SAML assertion contains the userPrincipalName (user@company.com), but ServiceNow's default user matching field is the 'User ID' field, which stores only the username (e.g., 'user'). By setting the 'User Field' property to 'User ID' in the SAML2 configuration, ServiceNow will extract the username portion from the NameID (or a custom attribute) and match it against the 'User ID' field, resolving the mismatch. This avoids the need to change user records or the NameID format.

Answer

Change the 'NameID format' from 'Unspecified' to 'EmailAddress' in the SAML2 configuration

Answer

Create an LDAP integration to automatically create ServiceNow users from the identity provider

Answer

Update all ServiceNow user records to have the 'User ID' field populated as full email addresses

Question 5

An organization has a ServiceNow instance that integrates with a third-party monitoring tool using a webhook. The monitoring tool sends HTTP POST requests to a Scripted REST API in ServiceNow to create incidents automatically. Recently, the monitoring tool started sending duplicate requests due to a retry mechanism. The developer wants to ensure that duplicate incidents are not created. The Scripted REST API currently creates a new incident record for every request without checking for duplicates. The request payload includes a unique 'alert_id' field. The developer decides to implement idempotency logic. Which approach should the developer use to prevent duplicate incident creation?

Accepted Answer

In the Scripted REST API, use a GlideRecord to query the incident table with a condition on the 'alert_id' field before inserting a new record; if a record exists, skip creation and return the existing record's sys_id. It implements idempotency directly within the Scripted REST API by querying the incident table using GlideRecord with a condition on the unique 'alert_id' field before inserting. If a record with that 'alert_id' already exists, the API skips creation and returns the existing sys_id, ensuring no duplicate incidents are created despite duplicate webhook requests.

Answer

Create a GlideAggregate script that counts incidents with the same 'alert_id'; proceed only if count is zero

Answer

Add a before-insert business rule on the incident table that checks for duplicates using the 'alert_id' field

Answer

Use a flow in Flow Designer triggered by the REST API that creates an incident only if the 'alert_id' is not already present in a custom table

Question 6

Which TWO of the following are valid authentication options for a Scripted REST API in ServiceNow?

Accepted Answer

Basic Auth. Basic Auth (B) is a valid authentication option for a Scripted REST API in ServiceNow because the REST API framework supports HTTP Basic authentication, where credentials are passed in the Authorization header and validated against a user record. OAuth 2.0 (E) is also valid because ServiceNow supports OAuth 2.0 as an authentication mechanism for inbound REST API calls, allowing token-based access via configured OAuth providers and application registries. JWT (A) is not a standalone authentication option for Scripted REST APIs in ServiceNow; while JWTs may be used within OAuth flows, ServiceNow does not offer JWT as a direct authentication type for these APIs. API Key (C) is not a supported authentication method for Scripted REST APIs, as ServiceNow does not natively validate API keys for this purpose. SAML 2.0 (D) is a browser-based SSO protocol for user authentication, not an authentication option for direct REST API calls to a Scripted REST API.

Answer

JWT

Answer

API Key

Answer

SAML 2.0

Question 7

Refer to the exhibit. An IntegrationHub flow using this REST step is failing with a 401 error. What is the most likely cause?

Accepted Answer

The MID Server is not configured with the username and password variables.. The 401 error indicates an authentication failure. In IntegrationHub, when a REST step uses a MID Server, the MID Server must have the necessary credentials (username and password) stored as variables in its configuration to authenticate with the target endpoint. If these variables are missing or misconfigured, the MID Server cannot supply valid credentials, resulting in a 401 error.

Answer

The endpoint URL is incorrect.

Answer

The authentication type should be OAuth 2.0.

Answer

The Content-Type header should be text/plain.

Question 8

A developer must expose a Scripted REST API that external partners will call. The API must return a custom error payload with HTTP status 422 and a JSON body containing validation details when incoming data fails business rules. In the Scripted REST API resource script, the developer writes logic that throws an exception. Partners report that they receive a generic HTTP 500 response with no JSON body. Which change should the developer make to return the required response?

Accepted Answer

Set response.setStatus(422) and write the JSON validation details using response.getStreamWriter().writeString().. To return a custom HTTP status and JSON body from a Scripted REST API resource, the developer must use the RESTResponse object's setStatus method and write the payload through getStreamWriter. Throwing an exception yields a generic 500. Explicitly setting 422 and writing the JSON validation details ensures partners receive the required structured error response.

Answer

Configure the REST API's error handler to intercept exceptions and return a fixed JSON template with status 422.

Answer

Use the RESTResponse object's setStatus and setBody methods, then call response.getStreamWriter() to write the JSON payload.

Answer

Throw a new sn_ws_err.ServiceError with a message and rely on the platform to map it to HTTP 422 with the JSON body.

Question 9

A developer is building a Flow Designer flow that calls an external REST API using the REST step. The API occasionally returns a 429 status code. The developer wants the flow to automatically retry the request after a short delay. Which approach should the developer use?

Accepted Answer

Configure the REST step's error handling to retry on failure with a custom retry policy.. The REST step in Flow Designer includes built-in error handling where you can define retry policies for specific HTTP status codes. Configuring a retry policy for 429 allows the flow to automatically reattempt the request after a delay, handling rate limiting gracefully. Other methods either are unsupported, overly complex, or do not integrate with the flow's execution.

Answer

Use a Script step to call the REST API and implement a loop with sleep to retry.

Answer

Set the REST step to continue on error and add a separate flow that triggers on error to retry.

Answer

Wrap the REST step in a try/catch and use a scheduled job to retry the request later.

Question 10

A developer creates an Inbound REST API using a Scripted REST API resource. The resource script calls a subflow using the sn_fd.FlowAPI.executeSubflow() method. During testing, the API returns a success response but the subflow does not appear to run. The developer confirms the subflow is active and the API user has the flow.runner role. What is the most likely cause?

Accepted Answer

The subflow inputs are not being passed correctly, causing the subflow to fail silently.. The FlowAPI executeSubflow() method requires inputs to be passed as an object with keys that exactly match the subflow's input variable names. If a required input is missing, the subflow may not run or may fail silently, especially if error handling is not configured. The REST response might still return success if the script does not check the subflow result. Verifying input mapping and adding error logging resolves such issues.

Answer

The subflow must be published before it can be called by FlowAPI, and the developer forgot to publish it.

Answer

The subflow must be triggered using a REST message instead of the FlowAPI method.

Answer

The API user lacks the rest_api_explorer role, which is required to invoke subflows.

Question 11

A developer is configuring an IntegrationHub action that uses a REST step to call an external system. The external system requires OAuth 2.0 authentication with a refresh token. Which two configurations are required to enable the action to authenticate successfully? (Choose two.)

Accepted Answer

Ensure the OAuth provider is configured with the correct token URL and client credentials.. For OAuth 2.0 authentication in IntegrationHub, you must create an OAuth provider record with the correct token URL and client credentials, and then associate it with a REST message via an OAuth 2.0 profile. The REST step then uses that REST message, allowing automatic token management. Manual token handling or alternative auth types are not required and would not work correctly.

Answer

Add a Script step before the REST step to manually fetch and set the access token in the request headers.

Answer

Configure the REST step to use the OAuth 2.0 profile and set the 'Use MID Server' option.

Answer

Set the REST step's authentication type to 'Basic Auth' and provide the OAuth token as the password.

Question 12

A company uses a Scheduled REST Message to import currency exchange rates from an external API every morning. The API occasionally returns HTTP 429 (Too Many Requests). The developer wants the integration to automatically retry after a delay without failing the job. Which approach should the developer take?

Accepted Answer

In the Scheduled Job script, catch the error response and use a GlideSystem method to reschedule the job after a delay.. To handle HTTP 429 gracefully, the developer should implement custom retry logic in the scheduled job script. Catching the error and using GlideSystem to pause and retry allows the integration to respect the rate limit and succeed later. This is more flexible than global retry properties and avoids failing the job. The script can inspect the response status and decide whether to retry or log the failure.

Answer

Use a Flow Designer action with a 'Retry' policy configured on the REST step.

Answer

Enable the 'Retry on failure' option on the REST Message record and set the retry count to 3.

Answer

Configure the REST Message's HTTP method to use a retry policy with exponential backoff.

Question 13

A developer must expose a custom Scripted REST API that external partners will call to create incident records. Partners authenticate with a bearer token, and the API must reject any request that does not include the required scope. Which configuration on the Scripted REST API resource enforces the scope check before the script runs?

Accepted Answer

Add the scope to the Scripted REST API's Security tab under OAuth scopes and mark the resource's Requires authentication property as true.. Scripted REST APIs enforce OAuth scopes through the API definition's Security tab. When Requires authentication is true and a token is presented, the platform checks that the token carries a scope registered for that API before the resource handler executes. Registering the scope and enabling authentication blocks under-scoped partners early, keeping the custom script free from manual token inspection.

Answer

Add an ACL on the sys_rest_api table granting read to the partner user and set the script's response to return 403 when the token is missing.

Answer

Create a before-query business rule on the Incident table that reads gs.getSession().getTokenScope() and aborts when the value is empty.

Answer

Set the resource's Requires authentication property to true and add the required scope to the resource's Requires role field.

Question 14

A developer builds a Flow Designer flow that calls an external REST endpoint through a REST step. The endpoint occasionally returns HTTP 503. The developer wants the flow to retry the call up to three times with increasing delay before failing. Which configuration achieves this within Flow Designer?

Accepted Answer

Configure the REST step's Retry Policy with a maximum retry count of three and a retry interval, then enable the step's error handling to continue on failure.. REST steps in Flow Designer include a Retry Policy that governs automatic re-invocation when the endpoint returns a retryable HTTP status such as 503. Setting the maximum retry count and interval produces the desired three attempts with increasing delay without custom scripting. Pairing this with step-level error handling lets the flow continue down an error path once retries are exhausted, preserving visibility and control.

Answer

Add a Script step after the REST step that uses sn_ws.RESTMessageV2 to reissue the request when the response code is not 200.

Answer

Create a scheduled flow that triggers every minute and checks a flag on the target record to determine whether the REST call already succeeded.

Answer

Wrap the REST step in a For Each flow logic block that iterates three times and add a Wait for duration action between iterations.

Question 15

A developer is configuring an outbound REST integration from ServiceNow to a partner API that requires authentication. The instance must not store the partner credentials in the outbound REST message record itself. Which two platform features should the developer use to meet this requirement? (Choose two.)

Accepted Answer

Create a Connection and Credential alias record and reference it from the REST message's authentication configuration.. Connection and Credential aliases and OAuth 2.0 Credentials records both externalize secrets from the REST message definition. The alias centralizes endpoint and credential data with rotation and auditing, while OAuth 2.0 Credentials manage token acquisition and refresh. Either approach keeps the partner secrets out of the outbound REST message record, satisfying the stated security constraint.

Answer

Hard-code the partner token in the REST message's HTTP header field so it is transmitted with every request.

Answer

Enable basic authentication on the REST message and enter the partner username and password in the message's authentication fields.

Answer

Store the partner API key in a system property of type password and read it in a scripted authentication header.