SNOW-CSA Application Rules, ACL and Notifications — 20 Questions

Question 1

A junior administrator configures the above business rule and ACL. When a user without any role opens an incident with category 'database' and state 1, the priority is set to 1 correctly. However, the user cannot view the incident record. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ACL requires a role (empty role list means no role requirement? Actually requires role checked, but no roles listed means any authenticated user, but unauthenticated? The user has no role, and condition fails because assignment group mismatch.. The ACL's condition checks if the assignment group's sys_id matches a specific value, but the assignment group field on the incident record stores the display value (group name) rather than the sys_id. This mismatch causes the condition to evaluate to false, denying read access. The empty role list in the ACL means that no roles are required, so the user's lack of roles is not the issue. The business rule runs before insert and sets priority correctly, but the ACL check occurs after the record is saved, so the condition failure prevents the user from viewing the incident.

Answer

The ACL condition uses sys_id of assignment group, but the field stores display value.

Answer

The business rule runs before insert, but the ACL check occurs after insert.

Answer

The business rule order (100) is too low and another rule overrides the priority.

Question 2

A company has an advanced business rule running on the 'incident' table with condition 'current.state == 2' (In Progress). The business rule creates a new child incident and also updates a field on the parent. However, when a state changes from 1 to 2 via a sys_created_by script, the child incident is created but the parent field is not updated. What is the most likely reason?

Accepted Answer

The business rule runs 'before' and there is an uncaught script error that aborts the update. In a 'before' business rule, an uncaught script error aborts the entire database transaction, rolling back all changes that were part of that transaction. However, if the child incident was created via a separate mechanism (e.g., an asynchronous script action or a GlideRecord operation with its own commit), it might persist independently of the aborted transaction. The parent field update fails because it is part of the same transaction that is rolled back due to the error. The condition 'current.state == 2' is met, so the business rule runs, but the uncaught error prevents the parent update from being committed.

Answer

The business rule condition is not met

Answer

The child incident creation also fails

Answer

The business rule runs 'after' instead of 'before'

Question 3

A company has a custom table 'u_employee_data' with a before query business rule that sets 'u_department' to 'Engineering' when the current user is in the 'ITIL' role. After the business rule is activated, users in the 'ITIL' role report that when they query the table, they see only records with department 'Engineering'. However, the business rule is intended to set the default department for new records only. What is the most likely cause?

Accepted Answer

The business rule is running on 'before query' instead of 'before insert'.. The business rule is configured to run on the 'before query' operation, which means it executes every time a query is made against the 'u_employee_data' table. This causes the condition to set the 'u_department' field to 'Engineering' for all records returned by the query, effectively filtering the result set to only those with that department. The intended behavior is to set the default department only when a new record is created, which requires the business rule to run on the 'before insert' operation instead.

Answer

The business rule should be set to 'async' to avoid affecting queries.

Answer

The business rule is set to run on the client side instead of server side.

Answer

The condition script uses 'gs.getUser().hasRole("ITIL")' incorrectly.

Question 4

An administrator creates a new ACL for the 'incident' table with type 'record', operation 'read', condition script 'current.assignment_group == gs.getUser().getMyGroups()', and requires role 'snc_internal'. A user with role 'snc_internal' who is a member of group 'Service Desk' can view incidents assigned to 'Service Desk' but cannot view incidents assigned to 'Network Support'. What is the most likely reason?

Accepted Answer

Another ACL with higher order denies read access to all incidents not matching the condition.. ACLs in ServiceNow are evaluated in order of their 'order' field, and the first matching ACL (either allowing or denying access) determines the outcome. If another ACL with a higher order (lower numeric value) denies read access to incidents not matching the condition, that deny rule will take precedence over the new ACL, preventing the user from viewing incidents assigned to 'Network Support' even though the new ACL would allow it. The user's role and group membership are satisfied, so the issue lies in ACL ordering and a conflicting deny rule.

Answer

The condition script uses 'current.assignment_group' which returns a sys_id, but 'gs.getUser().getMyGroups()' returns a list of group names.

Answer

The condition script should use 'current.assignment_group.isOneOf(gs.getUser().getMyGroups())' instead.

Answer

The user does not have the 'snc_internal' role.

Question 5

An administrator wants to send an email notification when a change request state changes to 'scheduled'. The notification should be sent to the change manager. Which two fields must be configured in the notification record?

Accepted Answer

"Who will receive" tab: add 'Change manager' role to 'Recipients'. The 'Who will receive' tab allows you to specify the recipients of the notification by role, user, or group. Adding the 'Change manager' role ensures that all users with that role receive the email when the notification triggers. Option D is correct because the 'When to send' tab defines the condition that must be met for the notification to fire; setting it to 'State changes to scheduled' ensures the notification is sent precisely when the change request state transitions to 'scheduled'.

Answer

"Advanced" tab: register an event to trigger the notification

Answer

"Email template" tab: select an existing template

Question 6

Which TWO conditions must be met for a business rule to execute on a table? (Choose TWO.)

Accepted Answer

The business rule must be associated with a table.. A business rule in ServiceNow is always scoped to a specific table; it cannot execute without being associated with one. The rule's 'Table' field defines the database table on which the rule triggers, and the platform checks this association before any execution logic runs.

Answer

The business rule must have at least one role specified in the 'Condition' tab.

Answer

The business rule must have an 'Advanced' script defined.

Answer

The business rule must have an order less than 100.

Question 7

Which THREE statements about Access Control Lists (ACLs) are true? (Choose THREE.)

Accepted Answer

ACLs can be defined for tables, records, fields, and scripts.. In ServiceNow, Access Control Lists (ACLs) can be defined to control access at multiple granularity levels: tables (entire table operations), records (specific rows), fields (individual columns), and scripts (execution of business rules or script includes). This allows administrators to enforce security policies precisely where needed.

Answer

An ACL can only have one role specified.

Answer

An ACL must have a script to evaluate conditions.

Question 8

An administrator creates a notification for the 'incident' table to send an email when the state changes to 'resolved'. The notification works for most users, but some users report not receiving the email. What is the most likely cause?

Accepted Answer

The users have set their 'Notification' preference to 'Do not send' for that type.. The most likely cause is that the users have configured their personal Notification preference to 'Do not send' for that notification type. In ServiceNow, users can override system-level notification settings by setting their preference to suppress specific notification types, which would prevent the email from being sent even though the notification is active and properly configured.

Answer

The notification weight is set too high.

Answer

The notification is not set to 'Active'.

Answer

The notification does not have an email template selected.

Question 9

A company wants to block all update operations on the 'problem' table for users with only the 'itil' role, except for the user who created the record. Which ACL configuration should be used?

Accepted Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by != gs.getUserID()', and set 'Requires role' true.. It uses a condition script that denies write access to users with the 'itil' role when the current record's creator is not the logged-in user. The ACL type 'record' with operation 'write' and 'Requires role' checked ensures that only users with the 'itil' role are evaluated, and the condition script 'current.created_by != gs.getUserID()' returns true for users who did not create the record, thus blocking their update operations. This matches the requirement to block all updates except for the record creator.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.assignment_group == gs.getUser().getMyGroups()', and set 'Requires role' true.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script empty, and uncheck 'Requires role'.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by == gs.getUserID()', and set 'Requires role' true.

Question 10

A business rule is set to run on 'before update' on the 'incident' table. The script updates 'current.description' and then calls 'current.update()'. What is the likely outcome?

Accepted Answer

The script causes a recursion error or multiple updates.. In ServiceNow, calling `current.update()` inside a 'before update' business rule triggers a recursive loop because the update operation re-invokes the same business rule. The platform detects this recursion and typically throws an error or causes multiple updates, leading to the described outcome. Option B is correct because the script explicitly calls `current.update()`, which is prohibited in before business rules to prevent infinite loops.

Answer

The description is updated and no error occurs.

Answer

The script fails silently because current.update() is not allowed in before business rules.

Answer

The script runs but the description is not updated.

Question 11

Based on the exhibit, who will receive the email notification?

Accepted Answer

The caller only.. The exhibit shows that the 'Caller' checkbox is selected in the notification's 'Who will receive' configuration, while the 'Assigned user' checkbox is not selected. In ServiceNow, when only the 'Caller' option is checked, the notification is sent exclusively to the user listed as the caller on the record, regardless of who the record is assigned to.

Answer

No one receives the email.

Answer

The assigned user only.

Answer

Both assigned user and caller.

Question 12

A notification should be sent to the change manager when a change request is submitted. Which TWO fields must be configured? (Choose TWO.)

Accepted Answer

Set the condition 'State changes to new' in 'When to send' tab.. The 'When to send' tab defines the trigger condition for the notification. Setting the condition to 'State changes to new' ensures the notification is sent exactly when a change request is submitted (i.e., when its state transitions to 'new'). Option D is correct because the 'Who will receive' tab specifies the recipients; adding the 'Change manager' role ensures that all users with that role receive the notification.

Answer

Set the notification to active.

Answer

Set a weight value.

Answer

Select an email template.

Question 13

You are a ServiceNow administrator for a large enterprise. The company has a custom application that uses a table 'u_asset_tracking' to track IT assets. The table has a before insert business rule that sets the 'u_assigned_to' field to the current user if the field is empty. Recently, the security team reported that some users are able to view asset records that they should not see. After investigation, you find that the 'u_asset_tracking' table has no ACLs defined, and the default table ACL allows read access to all authenticated users. The business rule is working correctly. You need to restrict read access so that users can only see records where 'u_assigned_to' is themselves or where they are in the same 'u_department' as the record's 'u_department'. You must ensure that the solution does not affect other tables. Which approach should you take?

Accepted Answer

Create a new ACL for the 'u_asset_tracking' table with type 'record', operation 'read', condition script 'current.u_assigned_to == gs.getUserID() || current.u_department == gs.getUser().getDepartment()', and set order to 0. Ensure 'Requires role' is unchecked.. It creates a record-level ACL with a condition script that enforces row-level security: users can only read records where they are the assigned user or share the same department. The order of 0 ensures this ACL is evaluated before the default table ACL, and leaving 'Requires role' unchecked allows the condition to grant access without requiring a specific role, thus restricting read access based solely on the condition.

Answer

Modify the default table ACL for the 'u_asset_tracking' table to require the 'asset_user' role.

Answer

Add a business rule to restrict read access by deleting records from the glide record set.

Answer

Create a new ACL for the 'u_asset_tracking' table with type 'record', operation 'read', condition script 'current.u_assigned_to == gs.getUserID()', and require the 'asset_user' role.

Question 14

A system administrator needs to allow users with the 'incident_manager' role to delete incidents only if the incident state is 'New' or 'Work in Progress'. They create an ACL with the following conditions: type='record', operation='delete', name='incident', condition: gs.hasRole('incident_manager') && current.state == 1 || current.state == 2. After testing, users with the role can delete incidents in any state. What is the most likely cause?

Accepted Answer

The condition lacks parentheses to group the state checks.. The condition `gs.hasRole('incident_manager') && current.state == 1 || current.state == 2` is evaluated by JavaScript operator precedence, where `&&` binds tighter than `||`. This means it is parsed as `(gs.hasRole('incident_manager') && current.state == 1) || current.state == 2`. Consequently, any user (even without the role) can delete incidents in state 2 (Work in Progress), and users with the role can delete incidents in any state because the role check only applies to state 1. Adding parentheses—`gs.hasRole('incident_manager') && (current.state == 1 || current.state == 2)`—fixes the logic.

Answer

The ACL is set on the 'incident' table but should be on the 'task' table.

Answer

The ACL should be created using the condition builder instead of script.

Answer

The condition does not check for the 'incident_manager' role.

Question 15

Which THREE of the following are true regarding business rules and their execution order?

Accepted Answer

After business rules run after the database write operation.. 'After' business rules are configured to execute after the database write operation has completed. This means they run once the record has been successfully saved to the database, allowing them to perform actions that depend on the record's existence, such as triggering notifications or updating related records.

Answer

Before business rules cannot prevent the record from being saved.

Answer

Async business rules run in the same transaction as the triggering event.

Question 16

A ServiceNow administrator is troubleshooting a notification issue. The company has a 'Customer Satisfaction Survey' notification that is supposed to send an email to the 'caller' of an incident when the incident state changes to 'Resolved' (state=6). The notification is configured with table 'incident', condition 'state changes to 6', and recipient 'caller'. However, the email is not being sent. The administrator checks the system log and finds no errors. The notification has an advanced script that checks if the 'caller' has a valid email address. The script is: if (current.caller_id.email == '') { return false; }. The administrator confirms that the caller's email field is populated. What is the most likely reason the notification is not sending?

Accepted Answer

The advanced script should be removed because it is blocking valid emails.. The advanced script in the notification must explicitly return true to send the email. If no value is returned, the notification is suppressed. The script only returns false when the email is an empty string; otherwise it falls through without returning a value, which blocks the notification even when the caller has a valid email. Removing the script eliminates this blockage and allows the notification to send as intended. The condition 'state changes to 6' correctly triggers on transition to Resolved, and the recipient field 'caller' is properly configured. The other options suggest changes that would not fix the real issue.

Answer

The notification condition should be 'state is 6' rather than 'state changes to 6'.

Answer

The script should check for null instead of empty string.

Answer

The recipient field should use the email field directly instead of the reference 'caller'.

Question 17

Drag and drop the steps to configure an inbound email action in ServiceNow into the correct order.

Accepted Answer

1. Create a new inbound email action record. 2. Define the conditions (table, type, condition script). 3. Write the action script. 4. Save and activate the inbound action.. The correct sequence for configuring an inbound email action in ServiceNow is to first create the action record, then define the conditions (such as the table and condition script), then write the action script that processes incoming emails, and finally save and activate the action. This order ensures that all necessary fields are properly set and the action works as intended.

Answer

1. Write the action script. 2. Create a new inbound email action record. 3. Define the conditions. 4. Save and activate.

Answer

1. Create a new inbound email action record. 2. Write the action script. 3. Define the conditions. 4. Save and activate.

Answer

1. Define the conditions. 2. Create a new inbound email action record. 3. Write the action script. 4. Save and activate.

Question 18

Match each ServiceNow module to its function.

Accepted Answer

Incident Management: Restores normal service operation as quickly as possible. Correct matches: Incident Management restores service, Problem Management finds root causes, Change Management manages changes. Distractors swap Service Catalog and Knowledge Management definitions.

Answer

Service Catalog: Stores knowledge articles for self-help

Answer

Knowledge Management: Provides a menu of services users can request

Question 19

A system administrator needs to prevent users from deleting any records in the 'incident' table. Which method will achieve this most effectively?

Accepted Answer

Create an application ACL on the incident table with the 'delete' operation set to 'no access'. An Application ACL with the 'delete' operation set to 'no access' explicitly denies the delete operation on the 'incident' table, regardless of any other ACLs or user roles. This is the most effective method to prevent record deletion because it directly targets the delete operation at the table level, overriding any inherited or role-based permissions.

Answer

Create a write ACL on the incident table with condition 'false'

Answer

Create a read ACL on the incident table with condition 'false'

Answer

Set the incident table 'Update' access to 'none' in the table configuration

Question 20

A business rule is configured to run 'before' a record is updated. If the business rule sets a field value and then a subsequent 'after' business rule also updates the same field, what will be the final value stored in the database?

Accepted Answer

The value set by the 'after' business rule. In ServiceNow, business rules execute in a defined order: 'before' business rules run first, followed by 'after' business rules. When both a 'before' and an 'after' business rule update the same field, the 'after' business rule executes later in the transaction and its value overwrites the 'before' business rule's value. The final value stored in the database is therefore the one set by the 'after' business rule, because the database write occurs after all business rules have completed.

Answer

Both values are stored in a history field

Answer

The database rejects the second change

Answer

The value set by the 'before' business rule