SNOW-CSA Application Rules, ACL and Notifications Practice Test 2 — 15 Questions

Question 1

A business rule set to run 'async' is supposed to update a large number of child records. The administrator notices that the updates are not being applied consistently. What is the most likely reason?

Accepted Answer

The async queue processes multiple instances simultaneously, causing race conditions. When a business rule is set to run 'async', it executes asynchronously via the system's queue. If the business rule updates a large number of child records, multiple instances of the same async business rule can be processed simultaneously by different queue workers. This concurrency can lead to race conditions, where one instance reads stale data or overwrites changes made by another instance, resulting in inconsistent updates.

Answer

The business rule condition is incorrect

Answer

The system property 'glide.sys.schedulers.max_threads' is set too low

Answer

The business rule is running 'before' instead of 'after'

Question 2

Which TWO of the following are valid ways to control the visibility of a field on a form for specific users?

Accepted Answer

Create a UI Policy that sets the field's 'visible' attribute to false based on user role. Option A is correct because a UI Policy is the purpose-built mechanism for dynamically controlling form field attributes such as visible, mandatory, and read-only, and it can be conditioned on user role (or other conditions) to hide the field for specific users. Option C is correct because a field-level ACL with operation 'read' set to 'no access' for the unwanted roles prevents those users from reading the field, which effectively removes it from their view of the form. Option B is not correct because Data Policies enforce data integrity (mandatory, read-only, default values) on the server and do not control field visibility on a form. Option D is not correct because, while g_form.setVisible() can hide a field, a Client Script is not the standard, role-based declarative way to control visibility and is generally discouraged for this purpose. Option E is not correct because a Business Rule runs on the server against database records and cannot directly control the visibility of a field on a form.

Answer

Create a Data Policy with a read condition

Answer

Create a Client Script that sets g_form.setVisible() on load

Answer

Create a Business Rule that hides the field

Question 3

Which TWO of the following are best practices when working with ACLs?

Accepted Answer

Ensure ACLs are scoped to the application that needs them. Option B is correct because ACLs should follow the principle of least privilege, meaning each ACL must be scoped narrowly to the specific application, table, or record that requires access rather than granting broader permissions than necessary. Option C is correct because ServiceNow's condition builder provides a declarative, maintainable, and less error-prone way to express simple conditions, avoiding the overhead and risk of custom scripts when they are not needed. Option A is incorrect because a single broad ACL violates least privilege and creates a large security and maintenance risk. Option D is incorrect because granting read access to all users on all tables exposes sensitive data and defeats the purpose of access control. Option E is incorrect because writing complex scripts for all edge cases makes ACLs harder to maintain, slower to evaluate, and more likely to introduce security flaws.

Answer

Always create a single, broad ACL that covers all needs

Answer

Grant 'read' access to all users on all tables to simplify administration

Answer

Write complex scripts in ACLs to handle all edge cases

Question 4

A company has a business rule that runs on the Incident table during update. The rule checks if the state is 'In Progress' and sets a field. However, after saving, the field is not being set. Which of the following is the most likely cause?

Accepted Answer

The business rule is set to run after the record updates but another business rule with a higher order reverts the field.. If a business rule runs after the record updates (i.e., 'When to run' is set to 'After'), and another business rule with a higher order number runs later and reverts the field, the first rule's change will be overwritten. The order of execution is determined by the 'Order' field; lower numbers run first. Since the field is not being set after save, a higher-order 'After' rule is the most likely culprit, as it can undo the change made by the original rule.

Answer

The business rule is using 'setValue' instead of 'setDisplayValue'.

Answer

The business rule has the condition 'Current state changes' unchecked.

Answer

The business rule is set to run on 'display' instead of 'update'.

Question 5

A notification is configured to send an email when an incident is assigned to a user. However, users are receiving duplicate emails. Which of the following is the most likely cause?

Accepted Answer

The notification has 'Who will receive' set to both 'Assigned user' and 'User in group'.. When 'Who will receive' is set to both 'Assigned user' and 'User in group', the notification can be sent to the same user twice if that user is both the assigned user and a member of the group. This is a common cause of duplicate emails in ServiceNow notifications, as the system evaluates each recipient list independently and sends separate emails.

Answer

The notification is triggered by a business rule that runs on after update.

Answer

The notification has two separate conditions that both evaluate to true.

Answer

The notification is set to 'Send for each record' and the record is being updated multiple times.

Question 6

An ACL on the Incident table has a script condition that returns true if the user is in the role 'incident_manager'. A user with the 'incident_manager' role still cannot update incidents. What could be the issue?

Accepted Answer

The script has a syntax error but is still returning false.. If the script condition has a syntax error, it will not execute properly and will return false by default, even if the user has the 'incident_manager' role. In ServiceNow, ACL script conditions that fail due to syntax errors are treated as false, denying access. The user's role is irrelevant if the condition itself does not evaluate to true.

Answer

The ACL is set to 'read' instead of 'write'.

Answer

The user also has a role that explicitly denies access.

Answer

The ACL has a condition order that is not correct.

Question 7

A catalog client script is supposed to show a variable when another variable equals 'Yes'. The script runs on 'onChange' of the first variable. However, the second variable does not appear. What is a possible cause?

Accepted Answer

The client script is not set to 'All' catalog items.. A client script that is not set to run on 'All' catalog items will only execute on the specific catalog item it was created for. If the script is scoped to a different item, the onChange event for the first variable on the current item will not trigger the script, so the second variable will never be shown. In ServiceNow, catalog client scripts must be explicitly associated with the correct catalog item or set to 'All' to apply globally.

Answer

The g_form.setDisplay() method is used incorrectly.

Answer

The condition is written with 'g_form.getValue' for the wrong variable.

Answer

The script is set to 'onLoad' instead of 'onChange'.

Question 8

An ACL on the Task table has a role condition requiring the 'itil' role. A user with the 'itil' role is trying to update a task but is denied. Which TWO factors could be causing this? (Select two.)

Accepted Answer

The update operation requires a specific condition script that returns false.. In ServiceNow, ACLs are evaluated as a chain: even if the role condition on one ACL is satisfied, a condition script on the write ACL that evaluates to false will block the update, so option B is correct because a failing condition script denies the operation regardless of role. Option D is also correct because ACLs on the same table are additive in a deny-by-default model — if any other ACL covering the write operation on the Task table evaluates to false or explicitly denies, the user is denied even though the itil role ACL passed. Option A is not correct because roles do not carry explicit deny permissions in ServiceNow; ACLs deny by not matching, not by a role that 'denies' access. Option C is not correct because record locking prevents concurrent edits but does not cause an ACL-based access denial. Option E is not correct because an ACL set to Create would simply not apply to the update/write operation, and the scenario states the user is denied on update, which points to write-related ACL evaluation rather than a mislabeled operation type.

Answer

The user also has a role that denies access.

Answer

The record is locked by another user.

Answer

The ACL is set to 'Create' instead of 'Write'.

Question 9

A notification is set to send an email when an incident is updated with 'Urgency' = 'High'. The notification is not sending. Which THREE of the following could be the cause? (Select three.)

Accepted Answer

The notification has a condition that also checks 'State' which is not met.. Option A is correct because a notification only fires when ALL of its conditions evaluate to true; if the notification includes an additional condition on 'State' that the incident does not satisfy, the notification will be suppressed even though Urgency = High is met. Option B is correct because email notifications require a valid recipient address; if the user record tied to the incident (e.g., caller, assigned to, or watched by) has no email address populated, the system has no destination and the email will not be sent. Option D is correct because an inactive notification (Active = false) is disabled and will never be evaluated or triggered, regardless of matching conditions. Option C is not the best answer because an unreachable SMTP server would typically cause delivery failures or errors rather than the notification not being triggered at all, and it is not marked correct here. Option E is not correct because updates made via web services or REST/SOAP APIs generally do trigger business rules and notifications in ServiceNow unless explicitly bypassed, so this is not a valid cause in this scenario.

Answer

The email notification system is configured with SMTP but the mail server is unreachable.

Answer

The incident record is being updated by a web service that does not trigger business rules.

Question 10

Refer to the exhibit. The business rule is set to run 'before' update. When a user changes the state to 'Resolved' (value 3), the comments field is updated. However, the change does not appear on the form after save. What is the most likely reason?

Accepted Answer

The script uses current.update() causing recursion and rollback.. Calling current.update() inside a 'before' business rule triggers the same business rule again, causing recursion. ServiceNow detects this recursion and rolls back the update to prevent an infinite loop, so the comment field change is not saved. A 'before' business rule should modify fields directly without calling update(), as the system handles the save automatically.

Answer

The state condition is incorrect because state 3 is not 'Resolved'.

Answer

The script should use current.setValue() instead of assignment.

Answer

The business rule should be 'after' instead of 'before'.

Question 11

Refer to the exhibit. This ACL is applied to the Incident table for 'write' operation. A user is editing their own incident but is still denied. What is the issue?

Accepted Answer

The script returns true but another ACL denies.. When an ACL is applied to a table for 'write' operations, multiple ACLs can evaluate the same operation. Even if one ACL (the one shown) returns true, another ACL on the same table for the same operation may return false, causing the overall write to be denied. The exhibit shows a script that checks `current.caller_id == gs.getUserID()`, which should allow the user to edit their own incident, but another ACL with a higher order or a different condition is blocking the write.

Answer

The script returns false because current.caller_id is not the user's sys_id.

Answer

The ACL is set to 'read' instead of 'write'.

Answer

The user does not have the necessary role.

Question 12

Refer to the exhibit. This condition script is used in a notification. For which states will the notification trigger?

Accepted Answer

Both state 2 and state 3. The condition script uses `current.state.changesTo(3)` which returns true only when the state transitions to 3 from a different state. Since the script also includes `current.state == 2`, the notification triggers for state 2 as well. Therefore, both state 2 and state 3 will cause the notification to fire.

Answer

Only state 3

Answer

Only state 2

Answer

Neither state 2 nor state 3

Question 13

A user reports that they are unable to see any records in the 'incident' table, even though they have the itil role. The administrator checks the ACLs and finds that there are no read ACLs defined for the incident table. What will happen?

Accepted Answer

No users can read any incident records.. In ServiceNow, if no read ACLs are defined for a table, the system defaults to a 'deny all' behavior. This means that no users, including those with the itil role, can read any records in the incident table. The itil role grants access to incident records only when a read ACL explicitly allows it; without any read ACL, the implicit denial takes effect.

Answer

The system will create a default read ACL that grants access to the itil role.

Answer

All users can read all incident records.

Answer

Only users with the admin role can read incident records.

Question 14

A developer wants to create a Scripted REST API endpoint that returns data from a custom table. The endpoint must only be accessible to users with the 'api_user' role. Which of the following is the best practice to enforce this restriction?

Accepted Answer

Define a read ACL on the custom table that requires the 'api_user' role.. The best practice for restricting access to a Scripted REST API endpoint in ServiceNow is to use an ACL (Access Control List) on the underlying table. When the endpoint is set to 'Requires authentication', the platform automatically evaluates table-level ACLs for each record operation. By defining a read ACL that requires the 'api_user' role, you enforce role-based access at the data layer, which is more secure and maintainable than checking roles in script.

Answer

Add a condition in the script that checks gs.hasRole('api_user') for each request.

Answer

Set the system property 'glide.service.catalog.enforce_acl' to true.

Answer

Use a 'read' ACL on the table and set the endpoint to 'Requires authentication'.

Question 15

A notification on the 'incident' table is configured to send an email when the 'state' field changes to 'Resolved'. The condition uses the condition builder with 'State changes to Resolved'. However, the notification also sends when an incident is updated without a state change. What is the most likely cause?

Accepted Answer

A business rule in the background updates the state to 'Resolved' on every update, so the notification fires each time.. The most likely cause is that a business rule is updating the state to 'Resolved' on every update to the incident record. This means that even when an agent updates a different field, the business rule sets state to 'Resolved', which triggers the notification condition 'State changes to Resolved'. Option A is incorrect because using 'State equals Resolved' would not help; it would fire on any update where state is already Resolved, not only on changes. Option B is incorrect because multiple subscribers cause duplicate notifications, not triggering on non-state changes. Option C is incorrect because 'Record is updated' is the appropriate 'Send when' setting for a notification that should fire on updates; using 'Inserted or updated' would also fire on insert, which is not indicated as an issue. Therefore, the background business rule is the most likely cause.

Answer

The condition builder is incorrectly configured and should use 'State equals Resolved'.

Answer

The notification has multiple subscribers causing duplicate evaluations.

Answer

The 'Send when' field is set to 'Record is updated' instead of 'Record is inserted or updated'.