SNOW-CSA Reporting, SLA and Imports — 30 Questions

Question 1

A company needs to import user records from a CSV file into the User [sys_user] table. The file contains a 'department' column that should map to the 'department' field in ServiceNow. However, the department values in the CSV are full names (e.g., 'Human Resources'), but the department field in ServiceNow uses a reference to the Department [cmn_department] table. What is the best practice for handling this import?

Accepted Answer

Create a transform map that maps the source field to the target field, and use a field mapping script to convert the department name to the correct sys_id.. Option B is correct because Import Set Rows are processed through transform maps, which allow field mapping scripts to convert source values (like 'Human Resources') into the corresponding sys_id in the Department [cmn_department] table. This is the standard, supported approach for handling reference field lookups during imports, ensuring data integrity without manual intervention or post-insert processing.

Answer

Use a before business rule on the User table to convert the department name after the record is inserted.

Answer

Use the Import Set Row API to programmatically map the values during import.

Answer

Manually edit the CSV file to replace department names with the corresponding sys_id values.

Question 2

An administrator has configured a report on the Incident table showing the count of incidents by assignment group. The report shows data for the current week, but the numbers seem too low. The administrator suspects that incidents resolved before the current week are not being included. What should the administrator check first?

Accepted Answer

Check the condition (prompt) filter of the report to see if there is a time-based filter that limits to the current week.. Option C is correct because the report's condition filter (often called a 'prompt' or 'filter condition') directly controls which records are included. If a time-based condition like 'Opened > Current week' or 'Resolved > Current week' is applied, it would exclude incidents resolved before the current week, causing the low count. The administrator should first inspect the filter conditions to see if such a restriction exists.

Answer

Check the 'Time scale' setting and ensure it is set to 'All' instead of 'Current week'.

Answer

Check the type of the report (e.g., bar chart vs pie chart) as some types only show aggregated data.

Answer

Check the 'Group by' field to ensure it is set to 'Assigned to' instead of 'Assignment group'.

Question 3

An organization has a Service Level Agreement (SLA) defined on the Incident table with a condition of 'Category is Network' and a duration of 4 hours. The SLA is triggered when the incident state changes from 'New' to 'In Progress'. A network incident is created and assigned to the Network Support group. The incident state is changed to 'In Progress' immediately. After 3 hours, the incident is resolved. However, the SLA shows a breach despite the resolution being within 4 hours. What is the most likely cause?

Accepted Answer

The SLA stop condition is set to 'State is Resolved', but the SLA was paused due to a schedule (e.g., after-hours pause) and the pause time was not counted, causing the actual working time to exceed 4 hours.. Option A is correct because the SLA breach occurred despite the incident being resolved within 4 hours of moving to 'In Progress'. The most likely cause is that the SLA stop condition is set to 'State is Resolved', but the SLA was paused due to a schedule (e.g., after-hours pause) and the pause time was not counted, causing the actual working time to exceed 4 hours. In ServiceNow, SLA schedules define when the clock is running; if the incident was resolved during a pause period, the SLA timer would have stopped only when the schedule resumed, and the elapsed working time could exceed the 4-hour duration.

Answer

The SLA is assigned to the Network Support group, but the assignment group was changed during the incident.

Answer

The SLA duration is defined in business hours, and the incident was created after business hours, so the elapsed time counted only business hours, making the 4-hour window longer in real time.

Answer

The SLA condition 'Category is Network' was not evaluated correctly because the category field was updated after the SLA was triggered.

Question 4

A company frequently imports data from an external HR system into the Employee [hr_employee] table using an import set. The import set runs nightly and maps fields correctly. Recently, the import started failing with the error 'Field 'manager' not found in table 'hr_employee''. The manager field exists in the import set rows but not in the target table. What is the most likely cause?

Accepted Answer

The transform map has a field mapping that references 'manager' as a target field, but the hr_employee table does not have a 'manager' column.. The error 'Field 'manager' not found in table 'hr_employee'' indicates that the transform map is attempting to map a source field to a target column that does not exist in the hr_employee table. Since the import set rows contain the 'manager' field, the mapping in the transform map must be referencing 'manager' as a target field, but the target table lacks that column. This is the most likely cause because the transform map defines the field-to-field mapping between the import set row and the target table, and if the target field name is incorrect or missing from the table, the import will fail.

Answer

The import set row table (sys_import_set_row) does not have a 'manager' column.

Answer

The source CSV file contains a column named 'manager' that is misspelled.

Answer

The manager field in the target table is of a different data type (e.g., string vs reference).

Question 5

An administrator is creating a new report to show the average time to resolve incidents for the last quarter. They want the report to automatically update as new incidents are resolved. Which report type should they use?

Accepted Answer

List report with a 'Average' aggregation on the 'Resolved' field.. A List report with an 'Average' aggregation on the 'Resolved' field is the correct choice because it automatically recalculates the average as new records are added or updated, ensuring the report reflects the most current data without manual intervention. List reports in ServiceNow support real-time aggregation on specific fields, making them ideal for dynamic metrics like average resolution time.

Answer

Bar chart report with a condition for resolved incidents.

Answer

Pivot table report with a 'Average' aggregation.

Answer

Scorecard report with a metric for average resolution time.

Question 6

An admin has set up an SLA on the Incident table with a condition 'Priority = 1' and a duration of 1 hour. The SLA is triggered when the incident state becomes 'In Progress'. The SLA definition includes a business schedule that only counts business hours (9 AM to 5 PM, Monday-Friday). An incident with Priority 1 is created at 4:30 PM on Friday and state is changed to 'In Progress' at 4:45 PM. At what time will the SLA breach if it is not resolved?

Accepted Answer

9:45 AM Monday.. The SLA has a duration of 1 hour but uses a business schedule that only counts hours between 9 AM and 5 PM, Monday through Friday. The incident entered 'In Progress' at 4:45 PM on Friday, so only 15 minutes of business time remain that day (4:45 PM to 5:00 PM). The remaining 45 minutes of SLA duration must be fulfilled starting Monday at 9:00 AM, pushing the breach time to 9:45 AM Monday.

Answer

5:45 PM Friday.

Answer

4:45 PM Saturday.

Answer

4:45 PM Monday.

Question 7

A manager wants a report that shows the number of incidents opened each day for the past 30 days, broken down by category. They want to see the data as a line chart with multiple lines (one per category). What report type and options should the admin select?

Accepted Answer

Line chart with 'Group by' set to 'Category' and 'Stacked' set to 'No'.. Option C is correct because a line chart with 'Group by' set to 'Category' and 'Stacked' set to 'No' produces a multi-line chart where each line represents a distinct category, showing the number of incidents opened each day over the past 30 days. This directly meets the manager's requirement for a line chart with multiple lines, one per category, without stacking the values.

Answer

Pie chart with a filter for the last 30 days and a breakdown by category.

Answer

List report with a 'Count' aggregation grouped by 'Opened' and 'Category'.

Answer

Bar chart with 'Group by' set to 'Category' and 'Stacked' set to 'Yes'.

Question 8

An administrator is setting up an import set to load data from a CSV file into the Incident table. Which TWO of the following are required steps in the import process?

Accepted Answer

Create an import set table to store the imported data.. Option A is correct because an import set table must be created to temporarily store the raw data from the CSV file before any transformation occurs. This table acts as a staging area, allowing the system to hold the imported records and then apply a transform map to map and move the data into the target Incident table. Without an import set table, there is no structure to receive the incoming CSV data.

Answer

Schedule the import to run automatically.

Answer

Use the Import Set Row API to create a transform map.

Answer

Create a data lookup table to standardize values.

Question 9

A company uses SLAs on Incident records. They want to notify the assignment group when an SLA is about to breach (within 10 minutes). Which THREE actions can be used to achieve this?

Accepted Answer

Create a notification that triggers on the 'SLA Warning' event.. Option A is correct because the 'SLA Warning' event is a predefined event that fires when an SLA is within its warning threshold. By creating a notification that triggers on this event, you can send an alert to the assignment group when the SLA is about to breach within 10 minutes, as the warning threshold can be configured on the SLA definition.

Answer

Create a business rule on the Incident table that checks the SLA percentage.

Answer

Create a scheduled job that runs every minute to check SLA percentages.

Question 10

An administrator is troubleshooting an import that is failing silently. The import set rows show 'Processed' with no errors, but no records are created or updated in the target table. Which THREE areas should the admin investigate?

Accepted Answer

Check if the coalescing field is set correctly in the transform map.. Option A is correct because the coalescing field in the transform map determines how ServiceNow matches incoming records to existing records in the target table. If the coalescing field is misconfigured or missing, the import may appear to process successfully (rows show 'Processed') but no records are created or updated because the system cannot identify which records to insert or update, leading to a silent failure.

Answer

Check if the target table has a 'sys_id' field.

Answer

Check if the import set table is set as the target table.

Question 11

A large enterprise uses ServiceNow for IT Service Management. They have a complex SLA structure with multiple SLA definitions on the Incident table. Each SLA definition has conditions based on category, priority, and assignment group. The company recently merged with another organization, and the new combined company has doubled the number of incidents. The SLA performance has degraded significantly: SLA breaches have increased by 40%, and the SLA engine is taking longer to process. The system administrator has checked the instance health and found that the SLA job is running but taking an average of 5 minutes per execution, and there are often multiple instances of the SLA job queued. The administrator needs to improve SLA performance without changing the business requirements. Which course of action is most effective?

Accepted Answer

Consolidate similar SLA definitions by using conditions with OR operators and simplify the SLA structure to reduce the number of active SLA definitions.. Option A is correct because consolidating SLA definitions reduces the number of active SLA records that the SLA job must evaluate per incident. The SLA job iterates through all active SLA definitions for each incident; fewer definitions mean fewer evaluations per incident, directly reducing processing time and the likelihood of queued job instances. This approach preserves all business requirements by using OR conditions to combine similar rules rather than removing them.

Answer

Schedule the SLA job to run only during business hours to reduce off-hours processing.

Answer

Disable SLA evaluation for incidents with low priority (4 and 5) to reduce volume.

Answer

Increase the SLA job interval from 1 minute to 5 minutes to reduce the frequency of execution.

Question 12

A company uses SLA definitions with a time zone of 'US/Eastern'. A task is created at 10:00 PM Eastern on a Sunday. The SLA definition has a start condition that triggers on creation, a 4-hour duration, and a schedule that includes only weekdays 9 AM to 5 PM. What is the expected SLA state at 2:00 PM Eastern on Monday?

Accepted Answer

Breached (at 1 PM). The SLA starts at 10:00 PM Eastern on Sunday, but the schedule only counts weekdays 9 AM–5 PM. The first eligible time is Monday 9 AM, so the 4-hour duration runs from 9 AM to 1 PM Eastern on Monday. At 2:00 PM Eastern on Monday, the SLA has already exceeded its 4-hour window, meaning it breached at 1 PM. Option C correctly identifies the breach time.

Answer

In Progress (still running)

Answer

In Progress (not breached)

Answer

Breached (at 2 PM)

Question 13

An administrator imports data from a CSV file into the 'cmdb_ci' table using a transform map. The import set row contains fields 'name', 'serial_number', and 'manufacturer'. The transform map has a field mapping for 'name' with a co-paste of 'name' and 'serial_number'. Another mapping for 'serial_number' uses a script to concatenate 'SN-' prefix. The 'manufacturer' field is not mapped. After the import, the resulting 'name' field contains 'Laptop123, SN-12345' and 'serial_number' contains 'SN-12345'. Which statement best describes the outcome?

Accepted Answer

The 'name' field contains 'Laptop123, SN-12345' and 'serial_number' contains 'SN-12345'. The transform map's field mapping for 'name' uses a co-paste of 'name' and 'serial_number', which concatenates the source values with a comma and space, resulting in 'Laptop123, SN-12345'. The mapping for 'serial_number' uses a script that adds the 'SN-' prefix to the source 'serial_number' value, producing 'SN-12345'. The unmapped 'manufacturer' field is simply ignored during import, causing no failure. Therefore, the outcome matches option B exactly.

Answer

The import fails because the 'manufacturer' field is not mapped

Answer

The 'name' field contains 'Laptop123, 12345' because the script for 'serial_number' overrides the co-paste for 'name'

Answer

The 'serial_number' field remains '12345' because the co-paste mapping for 'name' consumed the source field

Question 14

A ServiceNow administrator needs to create a report that shows the number of incidents opened each month for the last 12 months. The report should display a bar chart with months on the x-axis and count on the y-axis. Which report type and grouping should the administrator use?

Accepted Answer

Bar chart, group by Month on the Opened field. Option A is correct because a bar chart is ideal for comparing discrete categories (months) over time, and grouping by Month on the Opened field aggregates incident counts per month. This meets the requirement of showing the number of incidents opened each month for the last 12 months with months on the x-axis and count on the y-axis.

Answer

List report, sort by Opened

Answer

Pie chart, group by Month on the Opened field

Answer

Line chart, group by Day on the Opened field

Question 15

Which TWO of the following are valid ways to trigger an SLA in ServiceNow? (Choose exactly 2.)

Accepted Answer

When a new incident is created with a specific category. Option B is correct because ServiceNow SLAs can be triggered by a condition defined in an SLA definition, such as when a new incident is created with a specific category. This is achieved by configuring the 'Start Condition' on the SLA definition to evaluate field values like 'Category' upon record creation.

Answer

When a task is not updated for 24 hours

Answer

When a scheduled job runs at a specific time each day

Answer

Automatically for every record in the incident table

Question 16

A transform map for importing incidents uses a co-paste field mapping for 'short_description' that references the source field 'caller_id'. The import fails with the error shown. What is the most likely cause?

Accepted Answer

The import set does not contain a column named 'caller_id'. The error indicates that the transform map is trying to reference a source field named 'caller_id' via a co-paste field mapping, but the import set table does not contain a column with that name. Co-paste mappings combine source fields from the import set row, so if 'caller_id' is missing from the import set columns, the transform engine cannot find the data and fails. Option B correctly identifies that the import set lacks the required column.

Answer

The 'caller_id' field in the target table is read-only

Answer

The target table 'incident' does not have a 'caller_id' field

Answer

The co-paste function cannot combine more than two fields

Question 17

A large enterprise uses ServiceNow for IT Service Management. They have recently configured SLA definitions for incident management with a 4-hour resolution time during business hours (Monday-Friday, 8 AM to 6 PM, excluding holidays). The SLA is triggered when an incident is created with priority=2 and assigned to the 'Hardware Support' group. After one week, the IT manager notices that some priority=2 incidents assigned to 'Hardware Support' are not showing any SLA timer. Upon investigation, you find that the incidents were created on weekends and the SLA condition includes 'Assigned to group is Hardware Support'. The SLA definition has 'Start condition' set to 'State changes to In Progress' and 'Pause condition' set to 'State changes to On Hold'. The incidents were created with state 'New' and then assigned to the group, but they remain in 'New' state. How should you fix the issue so that the SLA starts correctly?

Accepted Answer

Change the start condition to trigger on incident creation or when assigned to group. Option B is correct because the SLA start condition is currently set to 'State changes to In Progress', but the incidents remain in 'New' state after being assigned to the group. Since the SLA is not starting, you need to change the start condition to trigger on incident creation or when assigned to the group, ensuring the SLA timer begins even if the state does not change to In Progress.

Answer

Remove the pause condition so the SLA continues even when on hold

Answer

Update the condition to include 'Assigned to group is Hardware Support AND Priority is 2'

Answer

Modify the SLA schedule to include weekends

Question 18

A company needs to import data from a CSV file into the User table. The CSV includes fields for first name, last name, email, and department. However, the import fails because some email addresses are invalid. Which feature in ServiceNow can be used to prevent invalid emails from being imported?

Accepted Answer

Transform Map with condition scripts. Option C is correct because a Transform Map with condition scripts allows you to validate incoming data before it is written to the target table. In this scenario, you can add a script to the transform map that checks each email address against a regular expression pattern (e.g., RFC 5322) and skips or rejects rows with invalid emails, preventing them from being imported into the User table.

Answer

Data Source configuration

Answer

Import Set Row

Answer

Import Set Table API

Question 19

Which TWO are true about Service Level Agreements (SLAs) in ServiceNow?

Accepted Answer

A Business Rule can be used to pause or cancel an SLA.. Option A is correct because Business Rules in ServiceNow can be configured to pause or cancel an SLA based on specific conditions, such as changes in state or assignment. This is achieved by writing a Business Rule that triggers on the appropriate table (e.g., task) and uses the `stopSLA()` or `pauseSLA()` methods on the SLA record. This allows administrators to automate SLA lifecycle management without manual intervention.

Answer

SLAs are defined per user to track individual performance.

Answer

SLAs can only be created for the Incident table.

Answer

Once an SLA is breached, it is automatically deleted from the system.

Question 20

Drag and drop the steps to configure an outbound email account in ServiceNow into the correct order.