SNOW-CSA Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. A user reports that the category field is not becoming mandatory on the incident form even when priority is set to '3' and the system property 'myapp.high_priority' is set to 'true'. What is the most likely cause?

Accepted Answer

The UI Policy is set to run on load only, and the priority field change does not trigger re-evaluation.. Option C is correct because UI Policies have a 'Run on load' and 'Run on change' setting. By default, UI Policies run only when the form loads. If the policy is set to run on load only, changing the priority field after the form has loaded will not trigger re-evaluation, so the category field will not become mandatory even when the condition is met.

Answer

The system property 'myapp.high_priority' is set to 'false'.

Answer

The condition script uses 'g_form.getValue' which is not available in a UI Policy condition.

Answer

The user must refresh the page after changing priority for the UI Policy to take effect.

Question 2

A business rule is configured to run on 'after' update. Which TWO of the following conditions would cause the rule to execute? (Select two.)

Accepted Answer

The condition checkbox is unchecked (no condition).. Option B is correct because when the condition checkbox is unchecked, the business rule has no condition script, so it always executes on the specified event (after update). Option D is correct because a condition script that returns true explicitly tells the rule to run. The 'after' update timing means the rule runs after the database write, but the condition still controls whether execution occurs.

Answer

The condition script returns false.

Answer

The condition checkbox is checked but script returns false.

Answer

The table is not the specified table.

Question 3

A business rule set to run 'async' is supposed to update a large number of child records. The administrator notices that the updates are not being applied consistently. What is the most likely reason?

Accepted Answer

The async queue processes multiple instances simultaneously, causing race conditions. When a business rule is set to run 'async', it executes asynchronously via the system's queue. If the business rule updates a large number of child records, multiple instances of the same async business rule can be processed simultaneously by different queue workers. This concurrency can lead to race conditions, where one instance reads stale data or overwrites changes made by another instance, resulting in inconsistent updates.

Answer

The business rule condition is incorrect

Answer

The system property 'glide.sys.schedulers.max_threads' is set too low

Answer

The business rule is running 'before' instead of 'after'

Question 4

A system administrator notices that users in the 'itil' role can see the 'cost' field on the 'cmdb_ci_server' table, but the requirement is to hide it from all except users with the 'cmdb_admin' role. The administrator has already created an ACL with 'read' operation, type 'record', condition 'current.cost' (no script) and granted 'no access' to all roles. However, the field is still visible. What is missing?

Accepted Answer

The ACL type must be 'field' instead of 'record'. Option D is correct because a 'record' ACL controls access to the entire record, but the requirement is to hide a specific field ('cost') from certain roles. To control visibility at the field level, the ACL type must be 'field', not 'record'. A 'record' ACL determines whether a user can see or interact with the whole record, while a 'field' ACL governs access to individual fields. Since the 'cost' field is still visible, the existing 'record' ACL is not applied to the field itself, allowing the 'itil' role to see it via default field-level access.

Answer

The ACL condition should use a script instead of a condition

Answer

The ACL must be set to 'mandatory'

Answer

The user must be removed from the 'itil' role

Question 5

A notification is configured to send an email when a new incident is created. The email template uses the field 'Short Description', but the email shows empty for that field. The template is correct. What is the most likely cause?

Accepted Answer

The 'Short Description' field is not populated at the time the notification is sent. Option D is correct because the notification fires when the incident is created, but the 'Short Description' field may not yet be populated at that exact moment if the record is saved before the field is filled. Notifications are triggered by the database write operation, and if the field is empty at that time, the email template will render it as blank, even though the template itself is correct.

Answer

The notification is not set to fire on create

Answer

The email template has a syntax error

Answer

The 'Short Description' field is read-only on the form

Question 6

Which TWO of the following are best practices when working with ACLs?

Accepted Answer

Ensure ACLs are scoped to the application that needs them. Option B is correct because ACLs should be scoped to the specific application that requires them. This ensures that only the necessary records and fields are accessible, following the principle of least privilege. Overly broad ACLs can expose sensitive data and violate data security requirements.

Answer

Always create a single, broad ACL that covers all needs

Answer

Grant 'read' access to all users on all tables to simplify administration

Answer

Write complex scripts in ACLs to handle all edge cases

Question 7

An ACL has a condition script that returns true if the user is a member of the 'service_desk' group and the record's 'state' is 'New'. The ACL type is 'read'. A user in the 'service_desk' group reports that they cannot see a record with state 'New'. What is the most likely cause?

Accepted Answer

The condition script does not have a default return false statement, so it returns undefined.. Option C is correct because in ServiceNow, ACL condition scripts that lack an explicit return statement will return undefined, which is a falsy value. When the condition script returns undefined, the ACL does not grant read access, effectively denying the user from seeing the record even though they meet the intended group and state criteria. This is a common pitfall where developers forget to add a default return true or return false at the end of the script.

Answer

The ACL is defined on a different table that extends 'incident'.

Answer

The script uses gs.hasRole('service_desk') which checks role, not group membership.

Answer

Another read ACL exists that explicitly denies read access to the 'service_desk' group.

Question 8

A user is able to view records in the Incident table but cannot edit them. Which ACL type is preventing the edit?

Accepted Answer

write. The correct answer is A (write). In ServiceNow, the write ACL controls the ability to update or edit existing records. Since the user can view records (read ACL allows this) but cannot edit them, the write ACL is the one blocking the operation. The write ACL is evaluated when a user attempts to modify a record after it has been created.

Answer

read

Answer

create

Answer

delete

Question 9

An ACL on the Incident table has a script condition that returns true if the user is in the role 'incident_manager'. A user with the 'incident_manager' role still cannot update incidents. What could be the issue?

Accepted Answer

The script has a syntax error but is still returning false.. Option C is correct because if the script condition has a syntax error, it will not execute properly and will return false by default, even if the user has the 'incident_manager' role. In ServiceNow, ACL script conditions that fail due to syntax errors are treated as false, denying access. The user's role is irrelevant if the condition itself does not evaluate to true.

Answer

The ACL is set to 'read' instead of 'write'.

Answer

The user also has a role that explicitly denies access.

Answer

The ACL has a condition order that is not correct.

Question 10

Refer to the exhibit. This ACL is applied to the Incident table for 'write' operation. A user is editing their own incident but is still denied. What is the issue?

Accepted Answer

The script returns true but another ACL denies.. Option D is correct because when an ACL is applied to a table for 'write' operations, multiple ACLs can evaluate the same operation. Even if one ACL (the one shown) returns true, another ACL on the same table for the same operation may return false, causing the overall write to be denied. The exhibit shows a script that checks `current.caller_id == gs.getUserID()`, which should allow the user to edit their own incident, but another ACL with a higher order or a different condition is blocking the write.

Answer

The script returns false because current.caller_id is not the user's sys_id.

Answer

The ACL is set to 'read' instead of 'write'.

Answer

The user does not have the necessary role.

Question 11

A catalog item uses a 'Catalog Client Script' to hide a variable when another variable is set to 'No'. However, the script is not working. The script is of type 'onChange' and the variable to hide is a 'Single Line Text'. What is the most likely cause?

Accepted Answer

The variable's 'Display' property is set to 'Static' or 'Read only'.. Option D is correct because when a variable's 'Display' property is set to 'Static' or 'Read only', the client-side script cannot override that setting via `g_form.setDisplay()`. The catalog client script runs on the client, but the variable's display behavior is enforced by the platform's UI policy layer, which takes precedence over client script calls. This is a common misconfiguration where the variable's display property is locked, preventing the onChange script from hiding it.

Answer

The variable type 'Single Line Text' does not support hiding.

Answer

The script is missing a 'g_form.setDisplay()' call.

Answer

The script should be of type 'onSubmit' instead of 'onChange'.

Question 12

Refer to the exhibit. This condition script is used in a notification. For which states will the notification trigger?

Accepted Answer

Both state 2 and state 3. The condition script uses `current.state.changesTo(3)` which returns true only when the state transitions to 3 from a different state. Since the script also includes `current.state == 2`, the notification triggers for state 2 as well. Therefore, both state 2 and state 3 will cause the notification to fire.

Answer

Only state 3

Answer

Only state 2

Answer

Neither state 2 nor state 3

Question 13

Which TWO of the following are true about business rules in ServiceNow? (Choose two.)

Accepted Answer

They can be configured to run 'before' or 'after' a database operation.. Option B is correct because business rules in ServiceNow can be configured to run 'before' or 'after' a database operation (insert, update, delete, or query). This allows administrators to perform actions such as data validation or modification at specific points in the database transaction lifecycle, ensuring data integrity and automating business logic.

Answer

They are only available in the global scope.

Answer

They can be scheduled to run at specific times.

Answer

They run on the client side to provide immediate feedback.

Question 14

A company wants to allow managers to view all incidents, but only their own direct reports' incidents to be editable. Which ACL approach is most efficient?

Accepted Answer

Create a read ACL for managers and a write ACL with a script condition checking manager relationship.. Option A is correct because it uses a read ACL to grant all managers view access to all incidents, and a separate write ACL with a script condition that dynamically checks whether the incident's assigned user is a direct report of the current manager. This approach is efficient as it avoids duplicating ACLs per manager or per group, leveraging a single script condition to enforce the manager–direct report relationship at runtime.

Answer

Use a business rule to set a field indicating editable and use ACL on that field.

Answer

Use role-based ACLs and assign a separate role for each manager.

Answer

Create separate write ACLs for each manager's direct reports.

Question 15

A developer wants to create a Scripted REST API endpoint that returns data from a custom table. The endpoint must only be accessible to users with the 'api_user' role. Which of the following is the best practice to enforce this restriction?

Accepted Answer

Define a read ACL on the custom table that requires the 'api_user' role.. Option D is correct because the best practice for restricting access to a Scripted REST API endpoint in ServiceNow is to use an ACL (Access Control List) on the underlying table. When the endpoint is set to 'Requires authentication', the platform automatically evaluates table-level ACLs for each record operation. By defining a read ACL that requires the 'api_user' role, you enforce role-based access at the data layer, which is more secure and maintainable than checking roles in script.

Answer

Add a condition in the script that checks gs.hasRole('api_user') for each request.

Answer

Set the system property 'glide.service.catalog.enforce_acl' to true.

Answer

Use a 'read' ACL on the table and set the endpoint to 'Requires authentication'.

SNOW-CSA Practice Test 23 — 15 Questions

Exhibit

SNOW-CSA Practice Test 23 — 15 Questions

Exhibit