SNOW-CSA Reporting, SLA and Imports — 20 Questions

Question 1

A high-priority incident is created on Monday at 16:30 (within schedule). The incident is assigned to an agent at 17:00. The state changes to 'In Progress' at 17:30. What is the SLA breach time?

Accepted Answer

17:30. The SLA breach time is calculated as the start time plus the resolution duration, minus any paused time. The start time is 16:30 (creation within schedule). No pauses are specified. However, the resolution duration is not provided in the question. Without this duration, a specific breach time cannot be determined from the given information. Therefore, none of the options (17:00, 16:30, 17:30, 18:00) can be confirmed as the correct breach time.

Answer

17:00

Answer

16:30

Answer

18:00

Question 2

An SLA is defined with a condition 'Active = true' but some incidents that are active are not triggering the SLA. What is the most likely cause?

Accepted Answer

The SLA definition is not set to active. The most likely cause is that the SLA definition itself is not set to active. In ServiceNow, an SLA definition must be active for it to be evaluated and triggered. Even if the condition 'Active = true' is met, if the SLA definition is inactive, it will not start for any incident. Option A is incorrect because the stem explicitly states that the incidents are active, so their state cannot be closed. Option C is incorrect because the condition already checks for active state. Option D is irrelevant because group assignment does not affect whether the SLA starts if the definition is inactive.

Answer

The incidents have a state of 'Closed' and are no longer active

Answer

The SLA condition needs to also check that the incident state is not 'Closed'

Answer

The incidents are assigned to a group that does not have the SLA

Question 3

An import set fails with error 'Import set row processing error'. The transform map uses a script that references a table that does not exist. What is the first step to resolve this?

Accepted Answer

Update the transform script to reference a valid table. The import set row processing error specifically states that the referenced table does not exist. The appropriate first step is to update the transform script to reference a valid table that exists in the instance. Changing the scope (Option C) would not resolve the issue if the table truly does not exist—it only changes which tables are accessible, but if the table is missing entirely, no scope change will make it appear. Therefore, the correct action is to fix the script.

Answer

Re-create the import set definition

Answer

Change the data source type

Answer

Run the import set in a different scope

Question 4

An import set transform map includes field maps with script actions. The import fails with 'Script execution error'. Where should the administrator look first?

Accepted Answer

System log. When a script action in a transform map field map throws an error, the system log (syslog) is the primary source for detailed JavaScript error messages, stack traces, and line numbers. Import set row errors only capture row-level failures like missing mandatory fields, not script execution details. The data source configuration and field map log do not store runtime script errors.

Answer

Import set row errors

Answer

Data source configuration

Answer

Transform map's field map log

Question 5

The error log entry above appears when processing an SLA for an incident. What does this indicate?

Accepted Answer

The SLA schedule is incorrectly configured. The error log entry indicates that the SLA schedule is incorrectly configured. In ServiceNow, SLAs rely on a defined schedule (e.g., 8x5 or 24x7) to calculate response and resolution times. If the schedule is missing, misconfigured, or has overlapping entries, the SLA engine cannot compute timers, resulting in an error during processing.

Answer

The SLA has breached its response time

Answer

The SLA definition's condition is not satisfied

Answer

The SLA response time has exceeded the target

Question 6

A company needs to import user records from a CSV file into the User [sys_user] table. The file contains a 'department' column that should map to the 'department' field in ServiceNow. However, the department values in the CSV are full names (e.g., 'Human Resources'), but the department field in ServiceNow uses a reference to the Department [cmn_department] table. What is the best practice for handling this import?

Accepted Answer

Create a transform map that maps the source field to the target field, and use a field mapping script to convert the department name to the correct sys_id.. Import Set Rows are processed through transform maps, which allow field mapping scripts to convert source values (like 'Human Resources') into the corresponding sys_id in the Department [cmn_department] table. This is the standard, supported approach for handling reference field lookups during imports, ensuring data integrity without manual intervention or post-insert processing.

Answer

Use a before business rule on the User table to convert the department name after the record is inserted.

Answer

Use the Import Set Row API to programmatically map the values during import.

Answer

Manually edit the CSV file to replace department names with the corresponding sys_id values.

Question 7

An administrator has configured a report on the Incident table showing the count of incidents by assignment group. The report shows data for the current week, but the numbers seem too low. The administrator suspects that incidents resolved before the current week are not being included. What should the administrator check first?

Accepted Answer

Check the condition (prompt) filter of the report to see if there is a time-based filter that limits to the current week.. The report's condition filter (often called a 'prompt' or 'filter condition') directly controls which records are included. If a time-based condition like 'Opened > Current week' or 'Resolved > Current week' is applied, it would exclude incidents resolved before the current week, causing the low count. The administrator should first inspect the filter conditions to see if such a restriction exists.

Answer

Check the 'Time scale' setting and ensure it is set to 'All' instead of 'Current week'.

Answer

Check the type of the report (e.g., bar chart vs pie chart) as some types only show aggregated data.

Answer

Check the 'Group by' field to ensure it is set to 'Assigned to' instead of 'Assignment group'.

Question 8

An organization has a Service Level Agreement (SLA) defined on the Incident table with a condition of 'Category is Network' and a duration of 4 hours. The SLA is triggered when the incident state changes from 'New' to 'In Progress'. A network incident is created and assigned to the Network Support group. The incident state is changed to 'In Progress' immediately. After 3 hours, the incident is resolved. However, the SLA shows a breach despite the resolution being within 4 hours. What is the most likely cause?

Accepted Answer

The SLA stop condition is set to 'State is Resolved', but the SLA was paused due to a schedule (e.g., after-hours pause) and the pause time was not counted, causing the actual working time to exceed 4 hours.. The most likely cause is that the SLA stop condition is set to 'State is Resolved', but the SLA timer was paused due to a schedule (e.g., after-hours) at the time the incident was resolved. Because the timer was paused, the stop condition was not evaluated immediately. When the schedule resumed, the working timer continued to run, and by the time the stop condition was evaluated, the accumulated working time had already exceeded the 4-hour duration, resulting in a breach. In ServiceNow, SLA timers that are paused do not trigger stop conditions until they resume, which can cause breaches even when the incident is resolved within the expected real-time window.

Answer

The SLA is assigned to the Network Support group, but the assignment group was changed during the incident.

Answer

The SLA duration is defined in business hours, and the incident was created after business hours, so the elapsed time counted only business hours, making the 4-hour window longer in real time.

Answer

The SLA condition 'Category is Network' was not evaluated correctly because the category field was updated after the SLA was triggered.

Question 9

A company frequently imports data from an external HR system into the Employee [hr_employee] table using an import set. The import set runs nightly and maps fields correctly. Recently, the import started failing with the error 'Field 'manager' not found in table 'hr_employee''. The manager field exists in the import set rows but not in the target table. What is the most likely cause?

Accepted Answer

The transform map has a field mapping that references 'manager' as a target field, but the hr_employee table does not have a 'manager' column.. The error 'Field 'manager' not found in table 'hr_employee'' indicates that the transform map is attempting to map a source field to a target column that does not exist in the hr_employee table. Since the import set rows contain the 'manager' field, the mapping in the transform map must be referencing 'manager' as a target field, but the target table lacks that column. This is the most likely cause because the transform map defines the field-to-field mapping between the import set row and the target table, and if the target field name is incorrect or missing from the table, the import will fail.

Answer

The import set row table (sys_import_set_row) does not have a 'manager' column.

Answer

The source CSV file contains a column named 'manager' that is misspelled.

Answer

The manager field in the target table is of a different data type (e.g., string vs reference).

Question 10

An administrator is creating a new report to show the average time to resolve incidents for the last quarter. They want the report to automatically update as new incidents are resolved. Which report type should they use?

Accepted Answer

List report with a 'Average' aggregation on the 'Resolved' field.. A List report with an 'Average' aggregation on the 'Resolved' field is the correct choice because it automatically recalculates the average as new records are added or updated, ensuring the report reflects the most current data without manual intervention. List reports in ServiceNow support real-time aggregation on specific fields, making them ideal for dynamic metrics like average resolution time.

Answer

Bar chart report with a condition for resolved incidents.

Answer

Pivot table report with a 'Average' aggregation.

Answer

Scorecard report with a metric for average resolution time.

Question 11

An admin has set up an SLA on the Incident table with a condition 'Priority = 1' and a duration of 1 hour. The SLA is triggered when the incident state becomes 'In Progress'. The SLA definition includes a business schedule that only counts business hours (9 AM to 5 PM, Monday-Friday). An incident with Priority 1 is created at 4:30 PM on Friday and state is changed to 'In Progress' at 4:45 PM. At what time will the SLA breach if it is not resolved?

Accepted Answer

9:45 AM Monday.. The SLA has a duration of 1 hour but uses a business schedule that only counts hours between 9 AM and 5 PM, Monday through Friday. The incident entered 'In Progress' at 4:45 PM on Friday, so only 15 minutes of business time remain that day (4:45 PM to 5:00 PM). The remaining 45 minutes of SLA duration must be fulfilled starting Monday at 9:00 AM, pushing the breach time to 9:45 AM Monday.

Answer

5:45 PM Friday.

Answer

4:45 PM Saturday.

Answer

4:45 PM Monday.

Question 12

A manager wants a report that shows the number of incidents opened each day for the past 30 days, broken down by category. They want to see the data as a line chart with multiple lines (one per category). What report type and options should the admin select?

Accepted Answer

Line chart with 'Group by' set to 'Category' and 'Stacked' set to 'No'.. A line chart with 'Group by' set to 'Category' and 'Stacked' set to 'No' produces a multi-line chart where each line represents a distinct category, showing the number of incidents opened each day over the past 30 days. This directly meets the manager's requirement for a line chart with multiple lines, one per category, without stacking the values.

Answer

Pie chart with a filter for the last 30 days and a breakdown by category.

Answer

List report with a 'Count' aggregation grouped by 'Opened' and 'Category'.

Answer

Bar chart with 'Group by' set to 'Category' and 'Stacked' set to 'Yes'.

Question 13

An administrator is setting up an import set to load data from a CSV file into the Incident table. Which TWO of the following are required steps in the import process?

Accepted Answer

Create an import set table to store the imported data.. An import set table must be created to temporarily store the raw data from the CSV file before any transformation occurs. This table acts as a staging area, allowing the system to hold the imported records and then apply a transform map to map and move the data into the target Incident table. Without an import set table, there is no structure to receive the incoming CSV data.

Answer

Schedule the import to run automatically.

Answer

Use the Import Set Row API to create a transform map.

Answer

Create a data lookup table to standardize values.

Question 14

A company uses SLAs on Incident records. They want to notify the assignment group when an SLA is about to breach (within 10 minutes). Which THREE actions can be used to achieve this?

Accepted Answer

Create a notification that triggers on the 'SLA Warning' event.. The 'SLA Warning' event is a predefined event that fires when an SLA is within its warning threshold. By creating a notification that triggers on this event, you can send an alert to the assignment group when the SLA is about to breach within 10 minutes, as the warning threshold can be configured on the SLA definition.

Answer

Create a business rule on the Incident table that checks the SLA percentage.

Answer

Create a scheduled job that runs every minute to check SLA percentages.

Question 15

An administrator is troubleshooting an import that is failing silently. The import set rows show 'Processed' with no errors, but no records are created or updated in the target table. Which THREE areas should the admin investigate?

Accepted Answer

Check if the coalescing field is set correctly in the transform map.. The coalescing field in the transform map determines how ServiceNow matches incoming records to existing records in the target table. If the coalescing field is misconfigured or missing, the import may appear to process successfully (rows show 'Processed') but no records are created or updated because the system cannot identify which records to insert or update, leading to a silent failure.

Answer

Check if the target table has a 'sys_id' field.

Answer

Check if the import set table is set as the target table.

Question 16

A large enterprise uses ServiceNow for IT Service Management. They have a complex SLA structure with multiple SLA definitions on the Incident table. Each SLA definition has conditions based on category, priority, and assignment group. The company recently merged with another organization, and the new combined company has doubled the number of incidents. The SLA performance has degraded significantly: SLA breaches have increased by 40%, and the SLA engine is taking longer to process. The system administrator has checked the instance health and found that the SLA job is running but taking an average of 5 minutes per execution, and there are often multiple instances of the SLA job queued. The administrator needs to improve SLA performance without changing the business requirements. Which course of action is most effective?

Accepted Answer

Consolidate similar SLA definitions by using conditions with OR operators and simplify the SLA structure to reduce the number of active SLA definitions.. Consolidating SLA definitions reduces the number of active SLA records that the SLA job must evaluate per incident. The SLA job iterates through all active SLA definitions for each incident; fewer definitions mean fewer evaluations per incident, directly reducing processing time and the likelihood of queued job instances. This approach preserves all business requirements by using OR conditions to combine similar rules rather than removing them.

Answer

Schedule the SLA job to run only during business hours to reduce off-hours processing.

Answer

Disable SLA evaluation for incidents with low priority (4 and 5) to reduce volume.

Answer

Increase the SLA job interval from 1 minute to 5 minutes to reduce the frequency of execution.

Question 17

A company uses SLA definitions with a time zone of 'US/Eastern'. A task is created at 10:00 PM Eastern on a Sunday. The SLA definition has a start condition that triggers on creation, a 4-hour duration, and a schedule that includes only weekdays 9 AM to 5 PM. What is the expected SLA state at 2:00 PM Eastern on Monday?

Accepted Answer

Breached (at 1 PM). The SLA starts at 10:00 PM Eastern on Sunday, but the schedule only counts weekdays 9 AM–5 PM. The first eligible time is Monday 9 AM, so the 4-hour duration runs from 9 AM to 1 PM Eastern on Monday. At 2:00 PM Eastern on Monday, the SLA has already exceeded its 4-hour window, meaning it breached at 1 PM. Option C correctly identifies the breach time.

Answer

In Progress (still running)

Answer

In Progress (not breached)

Answer

Breached (at 2 PM)

Question 18

An administrator imports data from a CSV file into the 'cmdb_ci' table using a transform map. The import set row contains fields 'name', 'serial_number', and 'manufacturer'. The transform map has a field mapping for 'name' with a co-paste of 'name' and 'serial_number'. Another mapping for 'serial_number' uses a script to concatenate 'SN-' prefix. The 'manufacturer' field is not mapped. After the import, the resulting 'name' field contains 'Laptop123, SN-12345' and 'serial_number' contains 'SN-12345'. Which statement best describes the outcome?

Accepted Answer

The 'name' field contains 'Laptop123, SN-12345' and 'serial_number' contains 'SN-12345'. The transform map's field mapping for 'name' uses a co-paste of 'name' and 'serial_number', which concatenates the source values with a comma and space, resulting in 'Laptop123, SN-12345'. The mapping for 'serial_number' uses a script that adds the 'SN-' prefix to the source 'serial_number' value, producing 'SN-12345'. The unmapped 'manufacturer' field is simply ignored during import, causing no failure. Therefore, the outcome matches option B exactly.

Answer

The import fails because the 'manufacturer' field is not mapped

Answer

The 'name' field contains 'Laptop123, 12345' because the script for 'serial_number' overrides the co-paste for 'name'

Answer

The 'serial_number' field remains '12345' because the co-paste mapping for 'name' consumed the source field

Question 19

A ServiceNow administrator needs to create a report that shows the number of incidents opened each month for the last 12 months. The report should display a bar chart with months on the x-axis and count on the y-axis. Which report type and grouping should the administrator use?

Accepted Answer

Bar chart, group by Month on the Opened field. A bar chart is ideal for comparing discrete categories (months) over time, and grouping by Month on the Opened field aggregates incident counts per month. This meets the requirement of showing the number of incidents opened each month for the last 12 months with months on the x-axis and count on the y-axis.

Answer

List report, sort by Opened

Answer

Pie chart, group by Month on the Opened field

Answer

Line chart, group by Day on the Opened field

Question 20

Which TWO of the following are valid ways to trigger an SLA in ServiceNow? (Choose exactly 2.)

Accepted Answer

When a new incident is created with a specific category. ServiceNow SLAs can be triggered by a condition defined in an SLA definition, such as when a new incident is created with a specific category. This is achieved by configuring the 'Start Condition' on the SLA definition to evaluate field values like 'Category' upon record creation.

Answer

When a task is not updated for 24 hours

Answer

When a scheduled job runs at a specific time each day

Answer

Automatically for every record in the incident table