SNOW-CSA Reporting, SLA and Imports — Timed 15 Questions

Question 1

A company needs to import user records from a CSV file into the User [sys_user] table. The file contains a 'department' column that should map to the 'department' field in ServiceNow. However, the department values in the CSV are full names (e.g., 'Human Resources'), but the department field in ServiceNow uses a reference to the Department [cmn_department] table. What is the best practice for handling this import?

Accepted Answer

Create a transform map that maps the source field to the target field, and use a field mapping script to convert the department name to the correct sys_id.. Option B is correct because Import Set Rows are processed through transform maps, which allow field mapping scripts to convert source values (like 'Human Resources') into the corresponding sys_id in the Department [cmn_department] table. This is the standard, supported approach for handling reference field lookups during imports, ensuring data integrity without manual intervention or post-insert processing.

Answer

Use a before business rule on the User table to convert the department name after the record is inserted.

Answer

Use the Import Set Row API to programmatically map the values during import.

Answer

Manually edit the CSV file to replace department names with the corresponding sys_id values.

Question 2

An administrator has configured a report on the Incident table showing the count of incidents by assignment group. The report shows data for the current week, but the numbers seem too low. The administrator suspects that incidents resolved before the current week are not being included. What should the administrator check first?

Accepted Answer

Check the condition (prompt) filter of the report to see if there is a time-based filter that limits to the current week.. Option C is correct because the report's condition filter (often called a 'prompt' or 'filter condition') directly controls which records are included. If a time-based condition like 'Opened > Current week' or 'Resolved > Current week' is applied, it would exclude incidents resolved before the current week, causing the low count. The administrator should first inspect the filter conditions to see if such a restriction exists.

Answer

Check the 'Time scale' setting and ensure it is set to 'All' instead of 'Current week'.

Answer

Check the type of the report (e.g., bar chart vs pie chart) as some types only show aggregated data.

Answer

Check the 'Group by' field to ensure it is set to 'Assigned to' instead of 'Assignment group'.

Question 3

An organization has a Service Level Agreement (SLA) defined on the Incident table with a condition of 'Category is Network' and a duration of 4 hours. The SLA is triggered when the incident state changes from 'New' to 'In Progress'. A network incident is created and assigned to the Network Support group. The incident state is changed to 'In Progress' immediately. After 3 hours, the incident is resolved. However, the SLA shows a breach despite the resolution being within 4 hours. What is the most likely cause?

Accepted Answer

The SLA stop condition is set to 'State is Resolved', but the SLA was paused due to a schedule (e.g., after-hours pause) and the pause time was not counted, causing the actual working time to exceed 4 hours.. Option A is correct because the SLA breach occurred despite the incident being resolved within 4 hours of moving to 'In Progress'. The most likely cause is that the SLA stop condition is set to 'State is Resolved', but the SLA was paused due to a schedule (e.g., after-hours pause) and the pause time was not counted, causing the actual working time to exceed 4 hours. In ServiceNow, SLA schedules define when the clock is running; if the incident was resolved during a pause period, the SLA timer would have stopped only when the schedule resumed, and the elapsed working time could exceed the 4-hour duration.

Answer

The SLA is assigned to the Network Support group, but the assignment group was changed during the incident.

Answer

The SLA duration is defined in business hours, and the incident was created after business hours, so the elapsed time counted only business hours, making the 4-hour window longer in real time.

Answer

The SLA condition 'Category is Network' was not evaluated correctly because the category field was updated after the SLA was triggered.

Question 4

A company frequently imports data from an external HR system into the Employee [hr_employee] table using an import set. The import set runs nightly and maps fields correctly. Recently, the import started failing with the error 'Field 'manager' not found in table 'hr_employee''. The manager field exists in the import set rows but not in the target table. What is the most likely cause?

Accepted Answer

The transform map has a field mapping that references 'manager' as a target field, but the hr_employee table does not have a 'manager' column.. The error 'Field 'manager' not found in table 'hr_employee'' indicates that the transform map is attempting to map a source field to a target column that does not exist in the hr_employee table. Since the import set rows contain the 'manager' field, the mapping in the transform map must be referencing 'manager' as a target field, but the target table lacks that column. This is the most likely cause because the transform map defines the field-to-field mapping between the import set row and the target table, and if the target field name is incorrect or missing from the table, the import will fail.

Answer

The import set row table (sys_import_set_row) does not have a 'manager' column.

Answer

The source CSV file contains a column named 'manager' that is misspelled.

Answer

The manager field in the target table is of a different data type (e.g., string vs reference).

Question 5

An administrator is creating a new report to show the average time to resolve incidents for the last quarter. They want the report to automatically update as new incidents are resolved. Which report type should they use?

Accepted Answer

List report with a 'Average' aggregation on the 'Resolved' field.. A List report with an 'Average' aggregation on the 'Resolved' field is the correct choice because it automatically recalculates the average as new records are added or updated, ensuring the report reflects the most current data without manual intervention. List reports in ServiceNow support real-time aggregation on specific fields, making them ideal for dynamic metrics like average resolution time.

Answer

Bar chart report with a condition for resolved incidents.

Answer

Pivot table report with a 'Average' aggregation.

Answer

Scorecard report with a metric for average resolution time.

Question 6

An admin has set up an SLA on the Incident table with a condition 'Priority = 1' and a duration of 1 hour. The SLA is triggered when the incident state becomes 'In Progress'. The SLA definition includes a business schedule that only counts business hours (9 AM to 5 PM, Monday-Friday). An incident with Priority 1 is created at 4:30 PM on Friday and state is changed to 'In Progress' at 4:45 PM. At what time will the SLA breach if it is not resolved?

Accepted Answer

9:45 AM Monday.. The SLA has a duration of 1 hour but uses a business schedule that only counts hours between 9 AM and 5 PM, Monday through Friday. The incident entered 'In Progress' at 4:45 PM on Friday, so only 15 minutes of business time remain that day (4:45 PM to 5:00 PM). The remaining 45 minutes of SLA duration must be fulfilled starting Monday at 9:00 AM, pushing the breach time to 9:45 AM Monday.

Answer

5:45 PM Friday.

Answer

4:45 PM Saturday.

Answer

4:45 PM Monday.

Question 7

A manager wants a report that shows the number of incidents opened each day for the past 30 days, broken down by category. They want to see the data as a line chart with multiple lines (one per category). What report type and options should the admin select?

Accepted Answer

Line chart with 'Group by' set to 'Category' and 'Stacked' set to 'No'.. Option C is correct because a line chart with 'Group by' set to 'Category' and 'Stacked' set to 'No' produces a multi-line chart where each line represents a distinct category, showing the number of incidents opened each day over the past 30 days. This directly meets the manager's requirement for a line chart with multiple lines, one per category, without stacking the values.

Answer

Pie chart with a filter for the last 30 days and a breakdown by category.

Answer

List report with a 'Count' aggregation grouped by 'Opened' and 'Category'.

Answer

Bar chart with 'Group by' set to 'Category' and 'Stacked' set to 'Yes'.

Question 8

An administrator is setting up an import set to load data from a CSV file into the Incident table. Which TWO of the following are required steps in the import process?

Accepted Answer

Create an import set table to store the imported data.. Option A is correct because an import set table must be created to temporarily store the raw data from the CSV file before any transformation occurs. This table acts as a staging area, allowing the system to hold the imported records and then apply a transform map to map and move the data into the target Incident table. Without an import set table, there is no structure to receive the incoming CSV data.

Answer

Schedule the import to run automatically.

Answer

Use the Import Set Row API to create a transform map.

Answer

Create a data lookup table to standardize values.

Question 9

A company uses SLAs on Incident records. They want to notify the assignment group when an SLA is about to breach (within 10 minutes). Which THREE actions can be used to achieve this?

Accepted Answer

Create a notification that triggers on the 'SLA Warning' event.. Option A is correct because the 'SLA Warning' event is a predefined event that fires when an SLA is within its warning threshold. By creating a notification that triggers on this event, you can send an alert to the assignment group when the SLA is about to breach within 10 minutes, as the warning threshold can be configured on the SLA definition.

Answer

Create a business rule on the Incident table that checks the SLA percentage.

Answer

Create a scheduled job that runs every minute to check SLA percentages.

Question 10

An administrator is troubleshooting an import that is failing silently. The import set rows show 'Processed' with no errors, but no records are created or updated in the target table. Which THREE areas should the admin investigate?

Accepted Answer

Check if the coalescing field is set correctly in the transform map.. Option A is correct because the coalescing field in the transform map determines how ServiceNow matches incoming records to existing records in the target table. If the coalescing field is misconfigured or missing, the import may appear to process successfully (rows show 'Processed') but no records are created or updated because the system cannot identify which records to insert or update, leading to a silent failure.

Answer

Check if the target table has a 'sys_id' field.

Answer

Check if the import set table is set as the target table.

Question 11

A large enterprise uses ServiceNow for IT Service Management. They have a complex SLA structure with multiple SLA definitions on the Incident table. Each SLA definition has conditions based on category, priority, and assignment group. The company recently merged with another organization, and the new combined company has doubled the number of incidents. The SLA performance has degraded significantly: SLA breaches have increased by 40%, and the SLA engine is taking longer to process. The system administrator has checked the instance health and found that the SLA job is running but taking an average of 5 minutes per execution, and there are often multiple instances of the SLA job queued. The administrator needs to improve SLA performance without changing the business requirements. Which course of action is most effective?

Accepted Answer

Consolidate similar SLA definitions by using conditions with OR operators and simplify the SLA structure to reduce the number of active SLA definitions.. Option A is correct because consolidating SLA definitions reduces the number of active SLA records that the SLA job must evaluate per incident. The SLA job iterates through all active SLA definitions for each incident; fewer definitions mean fewer evaluations per incident, directly reducing processing time and the likelihood of queued job instances. This approach preserves all business requirements by using OR conditions to combine similar rules rather than removing them.

Answer

Schedule the SLA job to run only during business hours to reduce off-hours processing.

Answer

Disable SLA evaluation for incidents with low priority (4 and 5) to reduce volume.

Answer

Increase the SLA job interval from 1 minute to 5 minutes to reduce the frequency of execution.

Question 12

A company uses SLA definitions with a time zone of 'US/Eastern'. A task is created at 10:00 PM Eastern on a Sunday. The SLA definition has a start condition that triggers on creation, a 4-hour duration, and a schedule that includes only weekdays 9 AM to 5 PM. What is the expected SLA state at 2:00 PM Eastern on Monday?

Accepted Answer

Breached (at 1 PM). The SLA starts at 10:00 PM Eastern on Sunday, but the schedule only counts weekdays 9 AM–5 PM. The first eligible time is Monday 9 AM, so the 4-hour duration runs from 9 AM to 1 PM Eastern on Monday. At 2:00 PM Eastern on Monday, the SLA has already exceeded its 4-hour window, meaning it breached at 1 PM. Option C correctly identifies the breach time.

Answer

In Progress (still running)

Answer

In Progress (not breached)

Answer

Breached (at 2 PM)

Question 13

An administrator imports data from a CSV file into the 'cmdb_ci' table using a transform map. The import set row contains fields 'name', 'serial_number', and 'manufacturer'. The transform map has a field mapping for 'name' with a co-paste of 'name' and 'serial_number'. Another mapping for 'serial_number' uses a script to concatenate 'SN-' prefix. The 'manufacturer' field is not mapped. After the import, the resulting 'name' field contains 'Laptop123, SN-12345' and 'serial_number' contains 'SN-12345'. Which statement best describes the outcome?

Accepted Answer

The 'name' field contains 'Laptop123, SN-12345' and 'serial_number' contains 'SN-12345'. The transform map's field mapping for 'name' uses a co-paste of 'name' and 'serial_number', which concatenates the source values with a comma and space, resulting in 'Laptop123, SN-12345'. The mapping for 'serial_number' uses a script that adds the 'SN-' prefix to the source 'serial_number' value, producing 'SN-12345'. The unmapped 'manufacturer' field is simply ignored during import, causing no failure. Therefore, the outcome matches option B exactly.

Answer

The import fails because the 'manufacturer' field is not mapped

Answer

The 'name' field contains 'Laptop123, 12345' because the script for 'serial_number' overrides the co-paste for 'name'

Answer

The 'serial_number' field remains '12345' because the co-paste mapping for 'name' consumed the source field

Question 14

A ServiceNow administrator needs to create a report that shows the number of incidents opened each month for the last 12 months. The report should display a bar chart with months on the x-axis and count on the y-axis. Which report type and grouping should the administrator use?

Accepted Answer

Bar chart, group by Month on the Opened field. Option A is correct because a bar chart is ideal for comparing discrete categories (months) over time, and grouping by Month on the Opened field aggregates incident counts per month. This meets the requirement of showing the number of incidents opened each month for the last 12 months with months on the x-axis and count on the y-axis.

Answer

List report, sort by Opened

Answer

Pie chart, group by Month on the Opened field

Answer

Line chart, group by Day on the Opened field

Question 15

Which TWO of the following are valid ways to trigger an SLA in ServiceNow? (Choose exactly 2.)

Accepted Answer

When a new incident is created with a specific category. Option B is correct because ServiceNow SLAs can be triggered by a condition defined in an SLA definition, such as when a new incident is created with a specific category. This is achieved by configuring the 'Start Condition' on the SLA definition to evaluate field values like 'Category' upon record creation.

Answer

When a task is not updated for 24 hours

Answer

When a scheduled job runs at a specific time each day

Answer

Automatically for every record in the incident table