SNOW-CAD Platform Features and Integration Practice Test 4 — 15 Questions

Question 1

A ServiceNow instance is configured to use LDAP for user authentication and role membership. After a recent LDAP schema change, users can authenticate but some users are missing their assigned roles. The LDAP server is returning all attributes correctly. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'LDAP Group DN' format in the LDAP server configuration does not match the new schema. The LDAP Group DN format defines how ServiceNow maps LDAP groups to roles. After a schema change, if the DN structure for groups has been altered (e.g., OU names changed), the stored format in the LDAP server configuration will no longer match, causing role membership to fail even though user authentication (which uses a separate base DN and filter) still works. The LDAP server returning all attributes correctly confirms the issue is in the mapping configuration, not in data retrieval.

Answer

The LDAP server's base DN for user search has changed

Answer

The 'Use secure connection' checkbox is unchecked in the LDAP configuration

Answer

The LDAP server is not returning the 'memberOf' attribute for users

Question 2

A ServiceNow developer is building an integration using IntegrationHub to connect to a third-party system via REST. The system requires OAuth 2.0 with client credentials grant flow. Which TWO configurations are mandatory for setting up this integration in IntegrationHub?

Accepted Answer

Token request endpoint URL (e.g., https://example.com/oauth/token). Option B is correct because the client credentials grant flow requires the integration to POST the credentials to the OAuth 2.0 token endpoint (e.g., https://example.com/oauth/token) to obtain an access token before calling the protected REST API. Option E is correct because the client credentials grant authenticates the client application itself, so the OAuth client ID and client secret issued by the third-party system are mandatory to identify and authenticate the integration. Option A is not required, since a discovery URL is only needed for flows that rely on OpenID Connect/OAuth metadata discovery, not for a basic client credentials token request. Option C is not required, because ServiceNow handles the HTTP Basic Authorization header encoding of the client ID and secret internally when configured in the OAuth credential record. Option D is not required, since the client credentials grant does not involve a resource owner's username and password or user impersonation.

Answer

OAuth server discovery URL (well-known endpoint)

Answer

Base64 encoding of the client secret

Answer

Username and password for user impersonation

Question 3

A company uses ServiceNow to manage IT assets. An integration sends asset data from an external CMDB to ServiceNow via REST API. The external system sends a payload that includes the asset's serial number, location, and status. The developer has created a Scripted REST API to receive this data. However, when testing, the external system receives an HTTP 500 error. The developer inspects the script log and sees the error: 'java.lang.NullPointerException' at line 10 of the script. The script uses the GlideRecord API to query for an existing asset by serial number. The relevant code is: var gr = new GlideRecord('alm_asset'); gr.get('serial_number', request.body.serial); What is the most likely cause of the NullPointerException?

Accepted Answer

The request body is not being parsed; 'request.body' is null because the content type is not set to JSON or the API is not expecting a body. The NullPointerException occurs when trying to access a property of a null object. In this case, `request.body` is null, meaning the request body was not parsed into a JavaScript object. This typically happens when the Content-Type header is not set to `application/json` or the Scripted REST API endpoint is not configured to expect a request body, so `request.body.serial` evaluates to `null.serial`, causing the exception.

Answer

The 'serial_number' field in the 'alm_asset' table does not exist or is misspelled

Answer

The GlideRecord.get() method is incorrectly used; it should be gr.get('serial_number') without the value

Answer

The external system is sending the serial number as part of the URL instead of the request body

Question 4

A company has developed a custom Scripted REST API endpoint that processes incoming orders and then makes synchronous outbound REST calls to an external shipping system for validation. During testing with low concurrency, the endpoint works correctly. However, in production with high concurrency, the endpoint frequently times out and returns 504 errors to the caller. The performance team has confirmed that the external shipping system is responsive and the network latency is acceptable. Which course of action should the development team take to resolve the timeout issue?

Accepted Answer

Refactor the script to make asynchronous HTTP requests and process the shipping validation response using a separate queue or business rule.. The issue is that synchronous outbound REST calls block the incoming request thread, and under high concurrency, threads are exhausted, causing timeouts and 504 errors. Refactoring to asynchronous HTTP requests allows the incoming request to complete quickly, while the shipping validation response is processed separately via a queue or business rule. This decouples the processing and scales better under load.

Answer

Deploy additional MID Servers to distribute the outbound call load.

Answer

Implement a caching layer to store shipping validation results and avoid repeated calls to the external system.

Answer

Increase the timeout value in the outbound REST Message record to accommodate peak loads.

Question 5

A developer needs to create a REST API endpoint in ServiceNow that external clients will call to retrieve incident data. The endpoint must only respond to GET requests at the path /api/now/custom/incidents and must return JSON. Which platform feature should the developer use to implement this endpoint?

Accepted Answer

Scripted REST API. A custom REST endpoint that responds to GET at a specific path and returns JSON requires defining the endpoint on the platform. Scripted REST API provides the ability to create API definitions and resources with custom scripts, allowing full control over HTTP methods, paths, and response formats. Outbound REST messages and SOAP or import set APIs do not offer this inbound customization.

Answer

Import Set REST API

Answer

Scripted SOAP Web Service

Answer

REST Message

Question 6

A developer needs to expose a custom Scripted REST API endpoint that accepts a JSON payload containing an 'accountNumber' field and returns account details. The endpoint must validate that the caller supplies a valid API key in the request header before any business logic executes. Where should the API key validation be implemented?

Accepted Answer

In the resource script, before processing the request body, by reading the request header and comparing it to a stored API key record.. Scripted REST APIs in ServiceNow do not include a built-in API key authentication type, so developers must implement key validation manually. The resource script is the earliest point where the incoming request is accessible, allowing the header to be read and compared to a stored key before any data processing occurs. This ensures unauthorized calls are rejected promptly and consistently.

Answer

In the Scripted REST API's security configuration, by setting the authentication type to 'API Key' and selecting the API key record.

Answer

In a Before Query business rule on the table being accessed, checking the request header against the API key.

Answer

In a Script Include that is called from the REST API's 'Get' method, by passing the API key as a parameter.

Question 7

A developer needs to create a custom REST API endpoint in ServiceNow that accepts a JSON payload containing a case number and returns the case status. The endpoint must be accessible without authentication for a short pilot. Which approach should the developer use?

Accepted Answer

Create a Scripted REST API with a resource, and in the resource script set the response body and status code.. A Scripted REST API is the platform feature designed for building custom inbound REST endpoints. By defining a resource and writing server-side script, the developer can parse the incoming JSON, look up the case, and return the status with the appropriate HTTP status code. This is the standard, supported method for creating custom APIs in ServiceNow.

Answer

Create a Business Rule on the Case table that triggers on insert and returns the status via an outbound REST call.

Answer

Create a Script Include of type 'REST' and expose it using a UI Page.

Answer

Create a REST Message record and configure an HTTP method to receive the case number.

Question 8

A developer is building a Flow Designer flow that integrates with an external REST API. The API returns a JSON response that includes a nested array of items. The developer needs to iterate over each item and create a record in ServiceNow. Which Flow Designer action should be used to process the array?

Accepted Answer

Use the 'For Each' flow logic to loop through the array and create records.. Flow Designer's 'For Each' flow logic is specifically built to iterate over a list of items, such as an array from a REST response. Within the loop, a 'Create Record' action can be used to insert each item into the desired table. This approach keeps the flow declarative and maintainable, leveraging built-in actions rather than custom scripts.

Answer

Use the 'Ask for Approval' action to manually review each item before creation.

Answer

Use the 'Do the following in parallel' flow logic to process each item simultaneously.

Answer

Use a 'Script' step to parse the JSON and create records using GlideRecord.

Question 9

A developer must expose a custom REST endpoint that accepts a JSON payload containing an incident number and a short work note. The endpoint should look up the incident by number, append the work note, and return the updated incident's sys_id and state. The developer creates a Scripted REST API with a resource. Which object within the script provides access to the request body and the query parameters?

Accepted Answer

request. Within a Scripted REST API resource, the platform automatically injects a request object holding the inbound HTTP details and a response object for the outbound result. Reading the JSON payload and query string requires the request object, while the response object is only for setting status, headers, and body. The other names are not valid bindings in this execution context, so they cannot supply the incident number or work note.

Answer

RESTAPIRequest

Answer

g_request

Answer

response

Question 10

A developer needs to create a script that runs when a new incident is created via the REST API. The script must set the 'Assignment group' based on the 'Category' field. Which platform feature should the developer use to implement this logic?

Accepted Answer

Business Rule. Business Rules are the appropriate server-side mechanism to enforce logic on record insert, update, or delete, regardless of the source. They run on the server and can execute before or after the database operation. A before insert Business Rule can set the Assignment group based on Category, ensuring the logic applies to incidents created via REST API, import, or UI.

Answer

UI Policy

Answer

Client Script

Answer

Scripted REST API

Question 11

A developer needs to integrate ServiceNow with an external system that requires OAuth 2.0 authentication. The external system uses the authorization code grant type. Which ServiceNow record must be configured to store the OAuth credentials and define the token endpoint?

Accepted Answer

OAuth Application Registry. The OAuth Application Registry is where ServiceNow stores OAuth 2.0 provider configurations for outbound integrations. It includes fields for the client ID, client secret, authorization and token endpoints, and scopes. When using the authorization code grant, ServiceNow can obtain and refresh tokens automatically. This registry is essential for setting up OAuth authentication with external systems.

Answer

Connection & Credential Alias

Answer

SOAP Message

Answer

REST Message

Question 12

A developer builds an outbound REST integration using a REST Message with an HTTP method that posts JSON to a vendor API. The vendor requires a bearer token that expires every 60 minutes. The developer wants ServiceNow to obtain and refresh the token automatically without storing credentials in the message record. Which platform capability should be configured?

Accepted Answer

An OAuth 2.0 provider profile referenced by the REST Message, with the vendor's token endpoint and client credentials.. When an outbound REST Message must present a short-lived bearer token, the platform's OAuth 2.0 provider profile handles the token request, caching, and refresh cycle. Pointing the REST Message at that profile means credentials live in the profile rather than the message, and expired tokens are renewed automatically. The other choices either use a static credential scheme the vendor rejects or place secrets where they do not belong.

Answer

A MID Server capability with a JWT signing key installed on the MID Server host.

Answer

A REST Message HTTP header named Authorization with a hardcoded bearer value.

Answer

A Basic Auth credential record attached to the REST Message HTTP method.

Question 13

A developer needs to create a reusable server-side script that can be called from multiple Business Rules and Script Includes. The script should accept parameters and return a value. Which platform feature should the developer use?

Accepted Answer

Script Include. Script Includes are the platform's mechanism for creating reusable server-side JavaScript. They can be called from Business Rules, other Script Includes, and scheduled jobs. By defining methods with parameters, developers can encapsulate logic and promote code reuse. This is the recommended approach for shared server-side functionality.

Answer

UI Action

Answer

Client Script

Answer

Business Rule

Question 14

A developer is building a Flow Designer flow that calls an external REST API through a REST step. The vendor API occasionally returns HTTP 429 with a Retry-After header. The developer wants the flow to handle these transient failures without failing the entire flow. Which two Flow Designer capabilities should be used? (Choose two.)

Accepted Answer

Configure the REST step's error handling to continue on error and branch based on the returned status code.. Transient 429 responses are best handled by letting the REST step fail softly, inspecting the status code, and branching into a wait-and-retry loop that honors the Retry-After header. That combination keeps the flow running and respects the vendor's throttling. Timeout tweaks, elevated user context, and circuit breakers do not implement a bounded retry that follows the header.

Answer

Enable the flow's Run as user to an administrator so throttled calls bypass the vendor's rate limit.

Answer

Set the REST step's timeout to zero so it waits indefinitely for a successful response.

Answer

Create an outbound REST Message with a Circuit Breaker policy to open after repeated failures.

Question 15

A developer is configuring a REST Message to integrate with an external API. The API requires a dynamic authentication token that must be refreshed every hour. The token is obtained via a separate authentication endpoint. Which two actions should the developer take to ensure the REST Message uses a valid token? (Choose two.)

Accepted Answer

Create an OAuth 2.0 profile in the OAuth Application Registry and associate it with the REST Message.. To use a dynamic OAuth token with a REST Message, you must first create an OAuth 2.0 profile in the OAuth Application Registry. Then, on the REST Message, set the authentication type to OAuth 2.0 and select that profile. This enables ServiceNow to automatically obtain, attach, and refresh the token as needed, ensuring each request uses a valid token without manual intervention.

Answer

Create a Business Rule that runs before each REST call to generate a new token.

Answer

Use a Scripted REST API to proxy the request and inject the token.

Answer

Configure a scheduled job to call the authentication endpoint, retrieve the token, and update a system property.