SNOW-CSA Application Rules, ACL and Notifications — Timed 10 Questions

Question 1

A company has a custom table 'u_employee_data' with a before query business rule that sets 'u_department' to 'Engineering' when the current user is in the 'ITIL' role. After the business rule is activated, users in the 'ITIL' role report that when they query the table, they see only records with department 'Engineering'. However, the business rule is intended to set the default department for new records only. What is the most likely cause?

Accepted Answer

The business rule is running on 'before query' instead of 'before insert'.. The business rule is configured to run on the 'before query' operation, which means it executes every time a query is made against the 'u_employee_data' table. This causes the condition to set the 'u_department' field to 'Engineering' for all records returned by the query, effectively filtering the result set to only those with that department. The intended behavior is to set the default department only when a new record is created, which requires the business rule to run on the 'before insert' operation instead.

Answer

The business rule should be set to 'async' to avoid affecting queries.

Answer

The business rule is set to run on the client side instead of server side.

Answer

The condition script uses 'gs.getUser().hasRole("ITIL")' incorrectly.

Question 2

An administrator creates a new ACL for the 'incident' table with type 'record', operation 'read', condition script 'current.assignment_group == gs.getUser().getMyGroups()', and requires role 'snc_internal'. A user with role 'snc_internal' who is a member of group 'Service Desk' can view incidents assigned to 'Service Desk' but cannot view incidents assigned to 'Network Support'. What is the most likely reason?

Accepted Answer

Another ACL with higher order denies read access to all incidents not matching the condition.. Option D is correct because ACLs in ServiceNow are evaluated in order of their 'order' field, and the first matching ACL (either allowing or denying access) determines the outcome. If another ACL with a higher order (lower numeric value) denies read access to incidents not matching the condition, that deny rule will take precedence over the new ACL, preventing the user from viewing incidents assigned to 'Network Support' even though the new ACL would allow it. The user's role and group membership are satisfied, so the issue lies in ACL ordering and a conflicting deny rule.

Answer

The condition script uses 'current.assignment_group' which returns a sys_id, but 'gs.getUser().getMyGroups()' returns a list of group names.

Answer

The condition script should use 'current.assignment_group.isOneOf(gs.getUser().getMyGroups())' instead.

Answer

The user does not have the 'snc_internal' role.

Question 3

An administrator wants to send an email notification when a change request state changes to 'scheduled'. The notification should be sent to the change manager. Which two fields must be configured in the notification record?

Accepted Answer

"Who will receive" tab: add 'Change manager' role to 'Recipients'. Option C is correct because the 'Who will receive' tab allows you to specify the recipients of the notification by role, user, or group. Adding the 'Change manager' role ensures that all users with that role receive the email when the notification triggers. Option D is correct because the 'When to send' tab defines the condition that must be met for the notification to fire; setting it to 'State changes to scheduled' ensures the notification is sent precisely when the change request state transitions to 'scheduled'.

Answer

"Advanced" tab: register an event to trigger the notification

Answer

"Email template" tab: select an existing template

Question 4

A junior administrator configures the above business rule and ACL. When a user without any role opens an incident with category 'database' and state 1, the priority is set to 1 correctly. However, the user cannot view the incident record. What is the most likely reason?

Accepted Answer

The ACL requires a role (empty role list means no role requirement? Actually requires role checked, but no roles listed means any authenticated user, but unauthenticated? The user has no role, and condition fails because assignment group mismatch.. Option C is correct because the ACL condition checks if the assignment group's sys_id matches a value, but the user has no role and the assignment group field likely stores the display value (group name) rather than the sys_id. This mismatch causes the ACL to deny read access, even though the business rule sets the priority correctly. The empty role list in the ACL means no roles are required, but the condition still fails due to the sys_id vs. display value mismatch.

Answer

The ACL condition uses sys_id of assignment group, but the field stores display value.

Answer

The business rule runs before insert, but the ACL check occurs after insert.

Answer

The business rule order (100) is too low and another rule overrides the priority.

Question 5

Which TWO conditions must be met for a business rule to execute on a table? (Choose TWO.)

Accepted Answer

The business rule must be associated with a table.. Option A is correct because a business rule in ServiceNow is always scoped to a specific table; it cannot execute without being associated with one. The rule's 'Table' field defines the database table on which the rule triggers, and the platform checks this association before any execution logic runs.

Answer

The business rule must have at least one role specified in the 'Condition' tab.

Answer

The business rule must have an 'Advanced' script defined.

Answer

The business rule must have an order less than 100.

Question 6

Which THREE statements about Access Control Lists (ACLs) are true? (Choose THREE.)

Accepted Answer

ACLs can be defined for tables, records, fields, and scripts.. Option A is correct because in ServiceNow, Access Control Lists (ACLs) can be defined to control access at multiple granularity levels: tables (entire table operations), records (specific rows), fields (individual columns), and scripts (execution of business rules or script includes). This allows administrators to enforce security policies precisely where needed.

Answer

An ACL can only have one role specified.

Answer

An ACL must have a script to evaluate conditions.

Question 7

An administrator creates a notification for the 'incident' table to send an email when the state changes to 'resolved'. The notification works for most users, but some users report not receiving the email. What is the most likely cause?

Accepted Answer

The users have set their 'Notification' preference to 'Do not send' for that type.. The most likely cause is that the users have configured their personal Notification preference to 'Do not send' for that notification type. In ServiceNow, users can override system-level notification settings by setting their preference to suppress specific notification types, which would prevent the email from being sent even though the notification is active and properly configured.

Answer

The notification weight is set too high.

Answer

The notification is not set to 'Active'.

Answer

The notification does not have an email template selected.

Question 8

A company wants to block all update operations on the 'problem' table for users with only the 'itil' role, except for the user who created the record. Which ACL configuration should be used?

Accepted Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by != gs.getUserID()', and set 'Requires role' true.. Option C is correct because it uses a condition script that denies write access to users with the 'itil' role when the current record's creator is not the logged-in user. The ACL type 'record' with operation 'write' and 'Requires role' checked ensures that only users with the 'itil' role are evaluated, and the condition script 'current.created_by != gs.getUserID()' returns true for users who did not create the record, thus blocking their update operations. This matches the requirement to block all updates except for the record creator.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.assignment_group == gs.getUser().getMyGroups()', and set 'Requires role' true.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script empty, and uncheck 'Requires role'.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by == gs.getUserID()', and set 'Requires role' true.

Question 9

A business rule is set to run on 'before update' on the 'incident' table. The script updates 'current.description' and then calls 'current.update()'. What is the likely outcome?

Accepted Answer

The script causes a recursion error or multiple updates.. In ServiceNow, calling `current.update()` inside a 'before update' business rule triggers a recursive loop because the update operation re-invokes the same business rule. The platform detects this recursion and typically throws an error or causes multiple updates, leading to the described outcome. Option B is correct because the script explicitly calls `current.update()`, which is prohibited in before business rules to prevent infinite loops.

Answer

The description is updated and no error occurs.

Answer

The script fails silently because current.update() is not allowed in before business rules.

Answer

The script runs but the description is not updated.

Question 10

Based on the exhibit, who will receive the email notification?

Accepted Answer

The caller only.. Option B is correct because the exhibit shows that the 'Caller' checkbox is selected in the notification's 'Who will receive' configuration, while the 'Assigned user' checkbox is not selected. In ServiceNow, when only the 'Caller' option is checked, the notification is sent exclusively to the user listed as the caller on the record, regardless of who the record is assigned to.

Answer

No one receives the email.

Answer

The assigned user only.

Answer

Both assigned user and caller.