SNOW-CSA Application Rules, ACL and Notifications Practice Test 4 — 15 Questions

Question 1

A developer wants to create a Scripted REST API endpoint that returns data from a custom table. The endpoint must only be accessible to users with the 'api_user' role. Which of the following is the best practice to enforce this restriction?

Accepted Answer

Define a read ACL on the custom table that requires the 'api_user' role.. Option D is correct because the best practice for restricting access to a Scripted REST API endpoint in ServiceNow is to use an ACL (Access Control List) on the underlying table. When the endpoint is set to 'Requires authentication', the platform automatically evaluates table-level ACLs for each record operation. By defining a read ACL that requires the 'api_user' role, you enforce role-based access at the data layer, which is more secure and maintainable than checking roles in script.

Answer

Add a condition in the script that checks gs.hasRole('api_user') for each request.

Answer

Set the system property 'glide.service.catalog.enforce_acl' to true.

Answer

Use a 'read' ACL on the table and set the endpoint to 'Requires authentication'.

Question 2

A notification on the 'incident' table is configured to send an email when the 'state' field changes to 'Resolved'. The condition uses the condition builder with 'State changes to Resolved'. However, the notification also sends when an incident is updated without a state change. What is the most likely cause?

Accepted Answer

A business rule in the background updates the state to 'Resolved' on every update, so the notification fires each time.. Option C is correct. The condition builder 'State changes to Resolved' fires on any update that meets the condition, but if there is no state change, it might still fire if the condition script is not properly checking the previous value. The most common cause is that the notification is also triggered by a business rule that updates the incident and sets state to Resolved even when state didn't change. Option A is wrong because the condition builder is fine. Option B is wrong because the 'Send when' setting does not cause that. Option D is wrong because subscribers don't affect condition.

Answer

The condition builder is incorrectly configured and should use 'State equals Resolved'.

Answer

The notification has multiple subscribers causing duplicate evaluations.

Answer

The 'Send when' field is set to 'Record is updated' instead of 'Record is inserted or updated'.

Question 3

An administrator is troubleshooting an ACL that grants 'write' access to the 'incident' table for the 'itil' role. Despite the ACL being active, users with the 'itil' role cannot update incidents. The administrator confirms that no other write ACLs exist. What is the most likely reason?

Accepted Answer

The 'Required roles' field on the 'incident' table form layout requires a different role to update.. The most likely reason is that the 'Required roles' field on the 'incident' table form layout restricts update operations to a specific role that the 'itil' users do not have. Even though the ACL grants 'write' access to the 'itil' role, the form layout's 'Required roles' setting overrides ACL permissions by preventing the form from being submitted or updated by users without the specified role. This is a common misconfiguration where form-level restrictions are overlooked during ACL troubleshooting.

Answer

The ACL is defined on a different table that extends 'incident'.

Answer

There is a read ACL that denies read access, which prevents any write operations.

Answer

The table is set to 'High Security' in the application properties.

Question 4

A business rule runs on 'before update' of the 'incident' table and sets the 'assigned_to' field to the current user if the assignment group is empty. The rule is in the global scope. However, when a user from another application scope updates an incident via a web service, the field is not being set. What is the most likely cause?

Accepted Answer

The business rule is not configured to run in the 'System' (global) scope across all applications.. The business rule is in the global scope, but by default, business rules in the global scope only run for updates made within the global scope itself. When a user from another application scope updates an incident via a web service, the update originates from that other scope, and the global-scope business rule does not execute unless it is explicitly configured to run in the 'System' (global) scope across all applications. This is controlled by the 'Run in all scopes' checkbox on the business rule record.

Answer

The user making the web service call does not have the 'itil' role.

Answer

The business rule runs after the web service update and the field is already committed.

Answer

The business rule condition is incorrect for web service updates.

Question 5

An administrator needs to send an email notification to the manager of the caller when an incident is assigned to a specific group. Which combination of notification configuration is correct?

Accepted Answer

Condition: 'Assignment group changes to '; Recipient: Caller's manager.. Option D is correct because the requirement is to notify the caller's manager when an incident is assigned to a specific group. The condition 'Assignment group changes to ' triggers the notification precisely when the assignment group changes to the target group, and the recipient 'Caller's manager' ensures the email goes to the manager of the person who reported the incident. This matches the exact business need without extraneous conditions or incorrect recipients.

Answer

Condition: 'Record is inserted'; Recipient: Manager of the assignment group.

Answer

Condition: 'Assigned to changes to Caller's manager'; Recipient: Caller.

Answer

Condition: 'State changes'; Recipient: Caller via email client.

Question 6

An ACL has a condition script that returns true if the user is a member of the 'service_desk' group and the record's 'state' is 'New'. The ACL type is 'read'. A user in the 'service_desk' group reports that they cannot see a record with state 'New'. What is the most likely cause?

Accepted Answer

The condition script does not have a default return false statement, so it returns undefined.. Option C is correct because in ServiceNow, ACL condition scripts that lack an explicit return statement will return undefined, which is a falsy value. When the condition script returns undefined, the ACL does not grant read access, effectively denying the user from seeing the record even though they meet the intended group and state criteria. This is a common pitfall where developers forget to add a default return true or return false at the end of the script.

Answer

The ACL is defined on a different table that extends 'incident'.

Answer

The script uses gs.hasRole('service_desk') which checks role, not group membership.

Answer

Another read ACL exists that explicitly denies read access to the 'service_desk' group.

Question 7

An administrator wants to create a notification that sends an email to the 'Assignment group' members whenever an incident is assigned to that group. Which of the following should the administrator configure in the notification's 'Who will receive' list?

Accepted Answer

Assignment group members. Option C is correct because the 'Assignment group members' option in the notification's 'Who will receive' list dynamically resolves to all users who are members of the group currently populated in the 'Assignment group' field on the incident record. This ensures that when an incident is assigned to a specific group, every member of that group receives the email notification, which matches the administrator's requirement exactly.

Answer

Group members (on the record)

Answer

Caller

Answer

Assigned user

Question 8

Which TWO of the following are valid ways to define who receives a notification in ServiceNow? (Choose two.)

Accepted Answer

Users in a role. Option B is correct because ServiceNow allows notifications to be sent to all users who have a specific role assigned. When 'Users in a role' is selected as the recipient type, the system evaluates the role membership at runtime and sends the notification to every active user with that role, making it a valid and commonly used recipient definition.

Answer

Email address

Answer

Dynamic recipient

Answer

Group

Question 9

Which THREE of the following statements about ACL evaluation are true? (Choose three.)

Accepted Answer

An ACL's 'Requires role' field can have multiple roles separated by commas.. Options B, D, and E are correct. B: ACLs are ORed, meaning if one grants access, access is granted. D: If no ACL exists, access is denied. E: 'Requires role' on ACL can specify multiple roles, and the user needs any one. Option A is wrong because ACLs are processed in order of type (table, record, etc.), not alphabetically. Option C is wrong because 'Deny' ACLs do not exist; all ACLs grant, but conditions can restrict.

Answer

An ACL with type 'deny' will override all other ACLs.

Answer

ACLs are evaluated in alphabetical order by name.

Question 10

Which TWO of the following are true about business rules in ServiceNow? (Choose two.)

Accepted Answer

They can be configured to run 'before' or 'after' a database operation.. Option B is correct because business rules in ServiceNow can be configured to run 'before' or 'after' a database operation (insert, update, delete, or query). This allows administrators to perform actions such as data validation or modification at specific points in the database transaction lifecycle, ensuring data integrity and automating business logic.

Answer

They are only available in the global scope.

Answer

They can be scheduled to run at specific times.

Answer

They run on the client side to provide immediate feedback.

Question 11

Your company uses ServiceNow for IT Service Management. The 'incident' table has a custom 'create' ACL that restricts creation of incidents to users with the 'snc_internal' role. However, external users with the 'snc_external' role should also be able to create incidents via a portal. The portal uses a REST message that authenticates as a specific integration user. The integration user has the 'snc_internal' role. Despite the REST API call being successful, external users report that they cannot submit incidents through the portal. The system logs show that the REST API call returns a success, but the incident record is not created. What is the most likely cause?

Accepted Answer

The ACL is evaluated against the portal user, who lacks the 'snc_internal' role.. Option C is correct because ServiceNow ACLs are evaluated against the user who initiated the request, not the integration user making the REST API call. In this scenario, the portal widget executes under the context of the portal user (who lacks 'snc_internal'), so the 'create' ACL on the 'incident' table checks that user's roles, not the integration user's roles. Even though the REST message authenticates as an integration user with 'snc_internal', the system logs a success for the API call itself, but the ACL evaluation fails silently when the record creation is attempted, resulting in no incident record being created.

Answer

The integration user's session has expired during the request.

Answer

The portal widget is using a different table name in the API call.

Answer

The REST API endpoint is mapped to the wrong table.

Question 12

Your organization has implemented a notification on the 'incident' table to send an email when an incident's priority is changed. The notification is configured with a condition: 'Priority changes to 1 - Critical' and uses the 'Send email' action. Recently, administrators noticed that for a single incident that was updated multiple times, duplicate emails were sent. The incident record's audit history shows that the priority was only changed once. What is the most likely cause?

Accepted Answer

The notification condition has a script that incorrectly evaluates to true multiple times.. Option D is correct because the notification condition uses a script that evaluates to true multiple times during a single update, causing the 'Send email' action to fire repeatedly. Even though the audit history shows the priority changed only once, a flawed script can return true for other field changes or on subsequent database operations, leading to duplicate emails. This is a common issue when conditions are not properly scoped to detect only the specific field change.

Answer

The email notification is configured with 'Send when record is updated' and the update triggers multiple business rules that each fire the notification.

Answer

The 'Send email' action is set to 'Send to all users in the role' and multiple users have the same role.

Answer

The notification is also triggered by the 'cmdb_ci' field update.

Question 13

A system administrator is configuring ACLs for a custom table 'u_employee_info' that should be visible to all employees but editable only by HR managers. The administrator creates two ACLs: one read ACL for the 'employee' role with type 'read', and one write ACL for the 'hr_manager' role with type 'write'. However, employees with the 'employee' role report that they cannot see any records in the table. The administrator verifies that the ACLs are active. What is the most likely issue?

Accepted Answer

The read ACL is set to require a role 'snc_employee' instead of 'employee'.. Option D is correct because ServiceNow ACLs are role-based, and the read ACL must specify the exact role name as it exists in the system. If the role is named 'snc_employee' but the ACL references 'employee', the ACL will not match, and the system will deny read access by default. The administrator likely misconfigured the role name in the ACL condition.

Answer

The read ACL is set to type 'record' instead of 'table'.

Answer

The table 'u_employee_info' has no 'read' ACL defined by default, so access is denied.

Answer

The write ACL is overriding the read ACL because it has a higher priority.

Question 14

A ServiceNow administrator deployed an Access Control Rule (ACL) to restrict access to the 'u_employee_salary' field on the 'u_employee' table. The ACL is defined as type 'field', with condition 'current.roles.contains("admin")', and 'read' and 'write' operations set to 'requires role'. After activating the ACL, non-admin users with the 'employee' role can still see the 'u_employee_salary' field on forms and lists. The administrator has verified that the 'employee' role does not have any other ACLs granting access to this field. Which of the following is the most likely cause of the issue?

Accepted Answer

The ACL is applied to the wrong table or the field name is misspelled.. Option B is correct because the most likely cause is that the ACL is applied to the wrong table or the field name is misspelled. If the ACL's table or field name does not exactly match the target field, the ACL will not enforce on that field, allowing non-admin users to see it. The administrator verified no other ACLs grant access, so a mismatch in the ACL definition is the primary suspect.

Answer

A higher-priority ACL with the same name is overriding this ACL.

Answer

The ACL is missing a script condition that returns false for non-admin users.

Answer

The ACL is of type 'record' instead of 'field'.

Question 15

An organization has a notification configured to send an email to the caller's manager when an incident is resolved. The notification is active, uses the 'Email - Incident' template, and has a condition script: 'current.state.changesTo(6)'. The email properties (SMTP, etc.) are working correctly for other notifications. Recently, managers are not receiving these resolved-incident emails. The administrator checks that the 'Manager' field on the caller's user record is populated for all callers. The notification's 'Who will receive' list is set to 'Caller and caller's manager' and the 'Operation' is 'record updated'. The 'Advanced' view shows that the 'Recipients' tab includes the email field 'mail' for the caller and the manager. What should the administrator investigate next?

Accepted Answer

Check the notification template for the correct email field reference for the manager.. The notification is configured correctly to send to the caller and caller's manager, and the condition script triggers on state change to 6 (Resolved). Since other notifications work, SMTP is fine. The issue likely lies in the notification template: if the template references an incorrect email field for the manager (e.g., 'email' instead of 'mail'), the system cannot resolve the manager's email address, causing the email not to be sent. Option B directly addresses this by checking the template's field reference.

Answer

Add a condition script to verify that the manager exists before sending.

Answer

Change the notification to 'event-based' using a business rule.

Answer

Verify that the 'Manager' field on the user record has a read ACL that allows the system user to access it.