SNOW-CSA Application Rules, ACL and Notifications Practice Test 1 — 15 Questions

Question 1

A company has a custom table 'u_employee_data' with a before query business rule that sets 'u_department' to 'Engineering' when the current user is in the 'ITIL' role. After the business rule is activated, users in the 'ITIL' role report that when they query the table, they see only records with department 'Engineering'. However, the business rule is intended to set the default department for new records only. What is the most likely cause?

Accepted Answer

The business rule is running on 'before query' instead of 'before insert'.. The business rule is configured to run on the 'before query' operation, which means it executes every time a query is made against the 'u_employee_data' table. This causes the condition to set the 'u_department' field to 'Engineering' for all records returned by the query, effectively filtering the result set to only those with that department. The intended behavior is to set the default department only when a new record is created, which requires the business rule to run on the 'before insert' operation instead.

Answer

The business rule should be set to 'async' to avoid affecting queries.

Answer

The business rule is set to run on the client side instead of server side.

Answer

The condition script uses 'gs.getUser().hasRole("ITIL")' incorrectly.

Question 2

An administrator creates a new ACL for the 'incident' table with type 'record', operation 'read', condition script 'current.assignment_group == gs.getUser().getMyGroups()', and requires role 'snc_internal'. A user with role 'snc_internal' who is a member of group 'Service Desk' can view incidents assigned to 'Service Desk' but cannot view incidents assigned to 'Network Support'. What is the most likely reason?

Accepted Answer

Another ACL with higher order denies read access to all incidents not matching the condition.. Option D is correct because ACLs in ServiceNow are evaluated in order of their 'order' field, and the first matching ACL (either allowing or denying access) determines the outcome. If another ACL with a higher order (lower numeric value) denies read access to incidents not matching the condition, that deny rule will take precedence over the new ACL, preventing the user from viewing incidents assigned to 'Network Support' even though the new ACL would allow it. The user's role and group membership are satisfied, so the issue lies in ACL ordering and a conflicting deny rule.

Answer

The condition script uses 'current.assignment_group' which returns a sys_id, but 'gs.getUser().getMyGroups()' returns a list of group names.

Answer

The condition script should use 'current.assignment_group.isOneOf(gs.getUser().getMyGroups())' instead.

Answer

The user does not have the 'snc_internal' role.

Question 3

An administrator wants to send an email notification when a change request state changes to 'scheduled'. The notification should be sent to the change manager. Which two fields must be configured in the notification record?

Accepted Answer

"Who will receive" tab: add 'Change manager' role to 'Recipients'. Option C is correct because the 'Who will receive' tab allows you to specify the recipients of the notification by role, user, or group. Adding the 'Change manager' role ensures that all users with that role receive the email when the notification triggers. Option D is correct because the 'When to send' tab defines the condition that must be met for the notification to fire; setting it to 'State changes to scheduled' ensures the notification is sent precisely when the change request state transitions to 'scheduled'.

Answer

"Advanced" tab: register an event to trigger the notification

Answer

"Email template" tab: select an existing template

Question 4

A junior administrator configures the above business rule and ACL. When a user without any role opens an incident with category 'database' and state 1, the priority is set to 1 correctly. However, the user cannot view the incident record. What is the most likely reason?

Accepted Answer

The ACL requires a role (empty role list means no role requirement? Actually requires role checked, but no roles listed means any authenticated user, but unauthenticated? The user has no role, and condition fails because assignment group mismatch.. Option C is correct because the ACL condition checks if the assignment group's sys_id matches a value, but the user has no role and the assignment group field likely stores the display value (group name) rather than the sys_id. This mismatch causes the ACL to deny read access, even though the business rule sets the priority correctly. The empty role list in the ACL means no roles are required, but the condition still fails due to the sys_id vs. display value mismatch.

Answer

The ACL condition uses sys_id of assignment group, but the field stores display value.

Answer

The business rule runs before insert, but the ACL check occurs after insert.

Answer

The business rule order (100) is too low and another rule overrides the priority.

Question 5

Which TWO conditions must be met for a business rule to execute on a table? (Choose TWO.)

Accepted Answer

The business rule must be associated with a table.. Option A is correct because a business rule in ServiceNow is always scoped to a specific table; it cannot execute without being associated with one. The rule's 'Table' field defines the database table on which the rule triggers, and the platform checks this association before any execution logic runs.

Answer

The business rule must have at least one role specified in the 'Condition' tab.

Answer

The business rule must have an 'Advanced' script defined.

Answer

The business rule must have an order less than 100.

Question 6

Which THREE statements about Access Control Lists (ACLs) are true? (Choose THREE.)

Accepted Answer

ACLs can be defined for tables, records, fields, and scripts.. Option A is correct because in ServiceNow, Access Control Lists (ACLs) can be defined to control access at multiple granularity levels: tables (entire table operations), records (specific rows), fields (individual columns), and scripts (execution of business rules or script includes). This allows administrators to enforce security policies precisely where needed.

Answer

An ACL can only have one role specified.

Answer

An ACL must have a script to evaluate conditions.

Question 7

An administrator creates a notification for the 'incident' table to send an email when the state changes to 'resolved'. The notification works for most users, but some users report not receiving the email. What is the most likely cause?

Accepted Answer

The users have set their 'Notification' preference to 'Do not send' for that type.. The most likely cause is that the users have configured their personal Notification preference to 'Do not send' for that notification type. In ServiceNow, users can override system-level notification settings by setting their preference to suppress specific notification types, which would prevent the email from being sent even though the notification is active and properly configured.

Answer

The notification weight is set too high.

Answer

The notification is not set to 'Active'.

Answer

The notification does not have an email template selected.

Question 8

A company wants to block all update operations on the 'problem' table for users with only the 'itil' role, except for the user who created the record. Which ACL configuration should be used?

Accepted Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by != gs.getUserID()', and set 'Requires role' true.. Option C is correct because it uses a condition script that denies write access to users with the 'itil' role when the current record's creator is not the logged-in user. The ACL type 'record' with operation 'write' and 'Requires role' checked ensures that only users with the 'itil' role are evaluated, and the condition script 'current.created_by != gs.getUserID()' returns true for users who did not create the record, thus blocking their update operations. This matches the requirement to block all updates except for the record creator.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.assignment_group == gs.getUser().getMyGroups()', and set 'Requires role' true.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script empty, and uncheck 'Requires role'.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by == gs.getUserID()', and set 'Requires role' true.

Question 9

A business rule is set to run on 'before update' on the 'incident' table. The script updates 'current.description' and then calls 'current.update()'. What is the likely outcome?

Accepted Answer

The script causes a recursion error or multiple updates.. In ServiceNow, calling `current.update()` inside a 'before update' business rule triggers a recursive loop because the update operation re-invokes the same business rule. The platform detects this recursion and typically throws an error or causes multiple updates, leading to the described outcome. Option B is correct because the script explicitly calls `current.update()`, which is prohibited in before business rules to prevent infinite loops.

Answer

The description is updated and no error occurs.

Answer

The script fails silently because current.update() is not allowed in before business rules.

Answer

The script runs but the description is not updated.

Question 10

Based on the exhibit, who will receive the email notification?

Accepted Answer

The caller only.. Option B is correct because the exhibit shows that the 'Caller' checkbox is selected in the notification's 'Who will receive' configuration, while the 'Assigned user' checkbox is not selected. In ServiceNow, when only the 'Caller' option is checked, the notification is sent exclusively to the user listed as the caller on the record, regardless of who the record is assigned to.

Answer

No one receives the email.

Answer

The assigned user only.

Answer

Both assigned user and caller.

Question 11

A notification should be sent to the change manager when a change request is submitted. Which TWO fields must be configured? (Choose TWO.)

Accepted Answer

Set the condition 'State changes to new' in 'When to send' tab.. Option C is correct because the 'When to send' tab defines the trigger condition for the notification. Setting the condition to 'State changes to new' ensures the notification is sent exactly when a change request is submitted (i.e., when its state transitions to 'new'). Option D is correct because the 'Who will receive' tab specifies the recipients; adding the 'Change manager' role ensures that all users with that role receive the notification.

Answer

Set the notification to active.

Answer

Set a weight value.

Answer

Select an email template.

Question 12

You are a ServiceNow administrator for a large enterprise. The company has a custom application that uses a table 'u_asset_tracking' to track IT assets. The table has a before insert business rule that sets the 'u_assigned_to' field to the current user if the field is empty. Recently, the security team reported that some users are able to view asset records that they should not see. After investigation, you find that the 'u_asset_tracking' table has no ACLs defined, and the default table ACL allows read access to all authenticated users. The business rule is working correctly. You need to restrict read access so that users can only see records where 'u_assigned_to' is themselves or where they are in the same 'u_department' as the record's 'u_department'. You must ensure that the solution does not affect other tables. Which approach should you take?

Accepted Answer

Create a new ACL for the 'u_asset_tracking' table with type 'record', operation 'read', condition script 'current.u_assigned_to == gs.getUserID() || current.u_department == gs.getUser().getDepartment()', and set order to 0. Ensure 'Requires role' is unchecked.. Option B is correct because it creates a record-level ACL with a condition script that enforces row-level security: users can only read records where they are the assigned user or share the same department. The order of 0 ensures this ACL is evaluated before the default table ACL, and leaving 'Requires role' unchecked allows the condition to grant access without requiring a specific role, thus restricting read access based solely on the condition.

Answer

Modify the default table ACL for the 'u_asset_tracking' table to require the 'asset_user' role.

Answer

Add a business rule to restrict read access by deleting records from the glide record set.

Answer

Create a new ACL for the 'u_asset_tracking' table with type 'record', operation 'read', condition script 'current.u_assigned_to == gs.getUserID()', and require the 'asset_user' role.

Question 13

A system administrator needs to allow users with the 'incident_manager' role to delete incidents only if the incident state is 'New' or 'Work in Progress'. They create an ACL with the following conditions: type='record', operation='delete', name='incident', condition: gs.hasRole('incident_manager') && current.state == 1 || current.state == 2. After testing, users with the role can delete incidents in any state. What is the most likely cause?

Accepted Answer

The condition lacks parentheses to group the state checks.. The condition `gs.hasRole('incident_manager') && current.state == 1 || current.state == 2` is evaluated by JavaScript operator precedence, where `&&` binds tighter than `||`. This means it is parsed as `(gs.hasRole('incident_manager') && current.state == 1) || current.state == 2`. Consequently, any user (even without the role) can delete incidents in state 2 (Work in Progress), and users with the role can delete incidents in any state because the role check only applies to state 1. Adding parentheses—`gs.hasRole('incident_manager') && (current.state == 1 || current.state == 2)`—fixes the logic.

Answer

The ACL is set on the 'incident' table but should be on the 'task' table.

Answer

The ACL should be created using the condition builder instead of script.

Answer

The condition does not check for the 'incident_manager' role.

Question 14

Which THREE of the following are true regarding business rules and their execution order?

Accepted Answer

After business rules run after the database write operation.. Option A is correct because 'After' business rules are configured to execute after the database write operation has completed. This means they run once the record has been successfully saved to the database, allowing them to perform actions that depend on the record's existence, such as triggering notifications or updating related records.

Answer

Before business rules cannot prevent the record from being saved.

Answer

Async business rules run in the same transaction as the triggering event.

Question 15

A ServiceNow administrator is troubleshooting a notification issue. The company has a 'Customer Satisfaction Survey' notification that is supposed to send an email to the 'caller' of an incident when the incident state changes to 'Resolved' (state=6). The notification is configured with table 'incident', condition 'state changes to 6', and recipient 'caller'. However, the email is not being sent. The administrator checks the system log and finds no errors. The notification has an advanced script that checks if the 'caller' has a valid email address. The script is: if (current.caller_id.email == '') { return false; }. The administrator confirms that the caller's email field is populated. What is the most likely reason the notification is not sending?

Accepted Answer

The notification condition should be 'state is 6' rather than 'state changes to 6'.. Option B is correct because the notification condition 'state changes to 6' triggers only when the state field transitions from a different value to 6. If the incident is already at state 6 when the notification is evaluated (e.g., after a business rule or update that sets state to 6 without a prior change), the condition will not fire. Using 'state is 6' ensures the notification sends whenever the incident is in that state, regardless of how it got there. The advanced script is not the issue since the caller's email is populated, and the recipient field is correctly configured.

Answer

The advanced script should be removed because it is blocking valid emails.

Answer

The script should check for null instead of empty string.

Answer

The recipient field should use the email field directly instead of the reference 'caller'.