SNOW-CAD Platform Features and Integration Practice Question
A developer is implementing a custom integration using the ServiceNow REST API Explorer. The endpoint requires an API key in the header. Which approach should be used to secure the API key?
⚠ Common exam trap
A common mix-up: candidates think storing the API key in an encrypted system property (Option C) is sufficient, but they overlook that the key still needs to be retrieved and injected into the header via script, which is less secure and not the recommended ServiceNow pattern for REST message integrations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an authentication profile of type 'API Key' and reference it in the REST message.
The ServiceNow REST API Explorer and REST messages support authentication profiles, which securely store and manage API keys. By creating an 'API Key' authentication profile and referencing it in the REST message, the API key is automatically injected into the request header without exposing it in scripts or system properties. This approach follows ServiceNow best practices for credential management and ensures the key is encrypted and centrally managed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an authentication profile of type 'API Key' and reference it in the REST message.
Why this is correct
Auth profiles securely store credentials and can be referenced without exposing the key.
- ✗
Hardcode the API key in the script.
Why it's wrong here
Hardcoding secrets is a security risk and not maintainable.
- ✗
Store the API key in a system property encrypted.
Why it's wrong here
While encrypted, system properties are not designed for credential management; secrets may be exposed in logs.
- ✗
Use a REST message variable and set the header directly.
Why it's wrong here
This still requires storing the key in script or prompt, not secure.
Go deeper
Related to this question
About these practice questions
One of 481 original SNOW-CAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CAD practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CAD exam.