Courseiva

ServiceNow Certified Application Developer CAD (SNOW-CAD) — Questions 1–75

481 questions total · 7pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 7

Page 2
1
MCQeasy

A company uses IntegrationHub to connect to an external CRM. The OAuth provider record and REST message are configured. When testing, authentication fails. What is the most likely cause?

A.The client secret is not base64 encoded.
B.The OAuth provider profile is not linked to the REST message.
C.The token URL is missing the grant_type parameter.
D.The REST message is set to POST instead of GET.
AnswerB

The OAuth profile must be associated with the REST message for authentication to work.

Why this answer

The most likely cause of authentication failure is that the OAuth provider profile is not linked to the REST message. Without this linkage, the authentication configuration is not applied. Option A is incorrect because base64 encoding of the client secret is not a requirement for OAuth.

Option C is incorrect because the grant_type parameter is sent in the request body, not in the URL. Option D is incorrect because although POST is the correct HTTP method for token requests, the method itself is not the likely cause of authentication failure.

Full explanation →
2
Multi-Selecthard

Which TWO statements are true about using GlideAggregate in business rules?

Select 2 answers
A.GlideAggregate allows adding non-aggregated fields to the result set using addField().
B.GlideAggregate can be used to perform SQL-like GROUP BY operations.
C.GlideAggregate can be used inside a business rule to compute values.
D.GlideAggregate automatically orders the results by the aggregated field.
E.GlideAggregate can only be used in client scripts.
AnswersB, C

GlideAggregate is designed to perform grouping and aggregate functions like count, sum, min, max.

Why this answer

GlideAggregate extends GlideRecord and allows performing SQL-like GROUP BY operations on database queries, enabling aggregation of data such as sums, counts, averages, etc. Option C is correct because GlideAggregate can be instantiated and used within a business rule to compute aggregated values from the database, which is a common pattern for server-side calculations.

Exam trap

The trap here is that candidates often confuse GlideAggregate's addField() with GlideRecord's addField() for retrieving field values, not realizing that in GlideAggregate, addField() is used for grouping and does not return raw non-aggregated data.

Full explanation →
3
MCQmedium

The ACL above is on the 'incident' table. A user with role 'itil' tries to update an incident record. What will happen?

A.The user will be prompted for credentials.
B.The user will be allowed because the condition is ignored for write operations.
C.The user will be allowed because the script sets answer = true.
D.The user will be denied because the condition fails.
AnswerD

The condition requires incident_manager role, which the user does not have.

Why this answer

The ACL (Access Control Rule) on the 'incident' table has a condition that must evaluate to true for the user to be granted access. In this case, the condition fails for a user with role 'itil' attempting to update the record, so the script does not set answer = true, resulting in a denial of the operation. Option D is correct because the condition failing means the ACL denies the write operation.

Exam trap

The trap here is that candidates often assume that having a role like 'itil' automatically grants update access, but ACLs require both the role and the condition to be satisfied, and a failing condition overrides the role-based permission.

How to eliminate wrong answers

Option A is wrong because ACLs do not prompt for credentials; they either allow or deny access based on conditions and roles, and credential prompts are handled by authentication mechanisms, not ACLs. Option B is wrong because conditions are not ignored for write operations; ACLs evaluate conditions for all operations (read, write, create, delete) unless specifically configured otherwise. Option C is wrong because the script only sets answer = true if the condition passes; since the condition fails, the script does not execute the line that sets answer = true, so the user is denied.

Full explanation →
4
MCQeasy

A company needs to automatically update the 'Assignment group' field on the Change Request table to 'Change Management' when the 'Category' field is set to 'Network'. Which type of business rule should be used?

A.Display business rule
B.Async business rule
C.After business rule
D.Before business rule
AnswerD

Before rules run before the database write and can set field values that will be saved.

Why this answer

A Before business rule (Option D) is correct because it runs before the record is saved to the database, allowing you to set the 'Assignment group' field value based on the 'Category' field before the insert or update operation completes. This ensures the assignment group is correctly populated in the same database transaction, avoiding the need for a separate update.

Exam trap

ServiceNow often tests the distinction between Before and After business rules, and the trap here is that candidates may choose 'After business rule' thinking it can still update the record, but they overlook that an After rule requires an additional update operation, which is not the most efficient or correct approach for setting a field value at the time of save.

How to eliminate wrong answers

Option A is wrong because a Display business rule runs on the client side when a form is loaded or refreshed, and cannot modify field values that are persisted to the database. Option B is wrong because an Async business rule runs asynchronously after the record is committed, which would cause a delay and require a second database operation to update the assignment group, not meeting the requirement for an automatic update at the time of save. Option C is wrong because an After business rule runs after the record has been saved, so any changes made to the 'Assignment group' field would require an additional database write (update), which is less efficient and could lead to race conditions or extra audit records.

Full explanation →
5
Multi-Selectmedium

Which TWO are required for a reference field to automatically filter its choices based on the value of another field on the form (cascading)?

Select 2 answers
A.The dependent field (parent) must be a reference field
B.The reference qualifier must be a script that uses the parent field's value
C.Both fields must be on the same form
D.The reference table must have a field with the same name as the parent field
E.The form must include the parent field and the reference field
AnswersB, E

This script dynamically filters the choices based on the parent field.

Why this answer

Options B and E are correct. For a reference field to filter its choices based on the value of another field (cascading), the reference qualifier must be a script that uses the parent field's value (B). Additionally, the parent field must be present on the form containing the reference field (E).

Option A is incorrect because the parent field does not need to be a reference field; it can be any field type. Option C is incorrect because, although the fields are on the same form, this condition is already covered by E. Option D is incorrect because there is no requirement for matching field names on the reference table.

Full explanation →
6
Multi-Selectmedium

Which THREE best practices should be followed when designing a custom widget in Service Portal? (Choose three.)

Select 3 answers
A.Implement client-side validation
B.Avoid hard-coded strings
C.Use synchronous AJAX calls
D.Use the spUtil service for server calls
E.Use global variables to share data between widgets
AnswersA, B, D

Correct: Client-side validation provides immediate feedback.

Why this answer

Implementing client-side validation improves user experience. Using spUtil for server calls ensures proper integration. Avoiding hard-coded strings supports internationalization.

Global variables are discouraged, and synchronous AJAX calls block the UI.

Full explanation →
7
Matchingmedium

Match each ServiceNow table naming convention to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

User-created custom table

System table (platform core)

Scoped application table

Performance Analytics tables

CMDB tables

Why these pairings

In ServiceNow, table naming conventions use prefixes to indicate their origin or module. sys_ denotes core system tables, u_ denotes user-created custom tables, and m2m_ denotes many-to-many relationship tables. Common confusions involve swapping these prefixes.

Full explanation →
8
MCQmedium

A flow designer wants to send an email notification with a custom logo. They need to ensure the email template references the correct image. What is the best practice?

A.Reference the image from an external CDN using a URL.
B.Attach the image to the sys_attachment table and use the sys_id in the template.
C.Upload the image directly into the email template using base64 encoding.
D.Store the image in the 'images' table and use the image name.
AnswerB

This ensures the image is stored in ServiceNow and referenced reliably.

Why this answer

Attaching the image to a sys_attachment and using the sys_id reference ensures it persists across upgrades and is the recommended approach.

Full explanation →
9
MCQeasy

A company wants to allow their customers to submit requests via email. The email should create a new record in the 'Request' table. Which component should be used to define the mapping of email fields to the ServiceNow table fields?

A.Inbound Email Action
B.Email Account
C.Inbound Email Script
D.Email Notification
AnswerA

Inbound email actions define conditions and scripts to map email fields to table fields.

Why this answer

An Inbound Email Action is the correct component because it defines the mapping of email fields (e.g., subject, body, sender) to ServiceNow table fields (e.g., 'Short description', 'Description', 'Caller'). It uses a script or condition to parse the incoming email and create or update records in a specified table, such as the 'Request' table. This is the standard mechanism for turning an email into a ServiceNow record.

Exam trap

The trap here is that candidates confuse 'Inbound Email Action' with 'Inbound Email Script' because both involve scripting, but the Action is the correct component for declarative field mapping and record creation, while the Script is a more manual, lower-level option that is not the standard approach for this use case.

How to eliminate wrong answers

Option B (Email Account) is wrong because an Email Account only configures the connection to an email server (e.g., POP3, IMAP, SMTP) and defines the mailbox to monitor; it does not define field mappings or record creation logic. Option C (Inbound Email Script) is wrong because while it can process incoming emails, it is a lower-level scripting tool that requires manual parsing and record creation, whereas an Inbound Email Action provides a structured, declarative way to map email fields to table fields without custom scripting. Option D (Email Notification) is wrong because it is used to send outbound emails (e.g., alerts, updates) and has no role in processing incoming email or creating records.

Full explanation →
10
Multi-Selecthard

Which TWO of the following are valid ways to retrieve a single record from a GlideRecord query on the task table?

Select 2 answers
A.gr.next()
B.gr.getRow()
C.gr.getUniqueValue()
D.gr.get()
E.gr.getByID()
AnswersA, D

Correct: Used to iterate through results; when called once, it retrieves the first record.

Why this answer

`gr.next()` is the standard method to advance the cursor to the next record in a GlideRecord query result set. When called after a `query()`, it retrieves the first record (or subsequent records) and returns true if a record exists, making it a valid way to access a single record. Option D is correct because `gr.get(sys_id)` retrieves a single record by its sys_id directly, without needing a prior query, and returns true if the record is found.

Exam trap

The trap here is that candidates often confuse `getUniqueValue()` with retrieving the record itself, or mistakenly think `getByID()` is a valid method because of its similarity to `get()` or `getByID()` in other platforms, while ServiceNow strictly uses `get(sys_id)`.

Full explanation →
11
Multi-Selecthard

A developer is creating an application in ServiceNow Studio and needs to ensure that all new records created in a custom table are automatically assigned a number. Which THREE methods can be used to achieve this? (Choose three.)

Select 3 answers
A.Use a default value on the number field.
B.Use a flow with a create record action that sets the number.
C.Use a database view to generate numbers.
D.Use a client script to set the number on load.
E.Use a business rule with a script.
AnswersA, B, E

A default value, such as a function, can generate a number automatically.

Why this answer

Options A, B, and E are correct. A default value on the number field will automatically assign a number to new records. A flow with a create record action can set the number during record creation.

A business rule with a script can also assign a number on insert. Option C (database view) is incorrect because database views do not generate numbers; they are virtual tables that display data. Option D (client script) is unreliable as it runs client-side and can be bypassed, so it is not suitable for ensuring automatic numbering.

Full explanation →
12
MCQmedium

A company has a Business Rule that runs after a record is updated. The rule needs to update a related record on a different table. However, the related record update is not being saved. What is the most likely cause?

A.There is a script error that is being ignored because the Business Rule is set to 'true' for 'Run asynchronously'.
B.The script is missing the .update() method on the GlideRecord object after setting field values.
C.The Business Rule runs in a separate transaction and the update is rolled back.
D.The user running the script does not have write access to the related table.
AnswerB

Without calling update(), the changes are not persisted to the database.

Why this answer

In ServiceNow, when a Business Rule modifies a GlideRecord object (e.g., setting field values on a related record), the changes are not persisted to the database until the `.update()` method is explicitly called. Without `.update()`, the script runs without error but the modifications are lost, which is the most common cause of an update not being saved.

Exam trap

ServiceNow often tests the misconception that setting field values on a GlideRecord object automatically saves the record, when in fact the `.update()` method is mandatory to persist changes.

How to eliminate wrong answers

Option A is wrong because setting 'Run asynchronously' to true does not cause script errors to be ignored; asynchronous execution still logs errors, and a script error would typically prevent the update from occurring at all, not silently discard it. Option C is wrong because Business Rules run in the same transaction as the triggering record update by default; they are not separate transactions, so there is no rollback unless explicitly coded. Option D is wrong because while insufficient write access can prevent an update, the question states the update is 'not being saved' rather than failing with an error, and the most likely cause in a typical development scenario is a missing `.update()` call, not a permissions issue.

Full explanation →
13
Multi-Selecthard

A developer is creating a REST API integration that retrieves data from an external system and updates ServiceNow records. Which THREE considerations are critical for handling authentication securely? (Choose three.)

Select 3 answers
A.Enable credential monitoring in the Security Operations Center
B.Configure the external system to authenticate ServiceNow requests
C.Store credentials in the ServiceNow Credential Store instead of scripts
D.Use OAuth2.0 with refresh tokens for long-lived access
E.Ensure the REST endpoint uses HTTPS
AnswersC, D, E

The Credential Store encrypts and manages secrets, reducing exposure.

Why this answer

Storing credentials directly in scripts exposes them to unauthorized access and makes rotation difficult. The ServiceNow Credential Store securely encrypts and manages credentials, allowing scripts to reference them by alias without hardcoding sensitive data, which is a fundamental security best practice for REST API integrations.

Exam trap

The trap here is confusing operational monitoring (Option A) with proactive authentication security controls, and reversing the authentication direction in Option B, leading candidates to select measures that are either reactive or misdirected.

Full explanation →
14
MCQmedium

A developer wants to create a responsive portal page that displays data in a two-column layout on desktop and a single column on mobile. Which approach should be used?

A.Use a single-column layout with media queries
B.Use the Column widget in UI Builder
C.Use fixed-width tables
D.Use the Bootstrap grid with col-lg-6 and col-md-12 classes
AnswerD

Correct: This will stack columns on small screens.

Why this answer

Bootstrap's grid system with col-lg-6 and col-md-12 classes provides a responsive two-column to single-column transition. Column widgets are not for responsive layout.

Full explanation →
15
MCQhard

A developer is working with a custom table 'u_project_task' that has a reference field 'u_project' pointing to the 'project' table. The developer wants to create a new field 'u_category' that lists values from a choice list, but the list should be filtered based on the value of 'u_project.u_type'. Which field type should be used?

A.Choice field with a dependent choice list
B.Choice field with a static choice list
C.Calculated value using a script
D.Reference field to a table of categories
AnswerA

Dependent choice lists allow filtering based on a parent field.

Why this answer

A choice field with a dependent choice list allows the list of values in 'u_category' to be dynamically filtered based on the value of another field, in this case 'u_project.u_type'. This is the standard ServiceNow approach for creating cascading or conditional choice lists without custom scripting.

Exam trap

ServiceNow often tests the misconception that a calculated value or script can provide a dynamic choice list, but calculated values are for auto-populating fields, not for presenting filtered selection options to the user.

How to eliminate wrong answers

Option B is wrong because a static choice list provides a fixed set of values that cannot change based on the value of another field, so it cannot meet the requirement for filtering based on 'u_project.u_type'. Option C is wrong because a calculated value using a script is used to compute a field's value automatically, not to provide a filtered choice list for user selection. Option D is wrong because a reference field to a table of categories would require creating a separate table and records, which is overkill and does not leverage the built-in choice list filtering mechanism; it also does not inherently filter based on 'u_project.u_type'.

Full explanation →
16
Multi-Selecthard

A developer is designing a data architecture for a multi-tenant environment where each company's data must be isolated. Which TWO strategies can achieve this? (Choose two.)

Select 2 answers
A.Implement domain separation.
B.Use access control lists (ACLs) on each record.
C.Create database views that filter data by company.
D.Add a condition to every GlideRecord query to filter by company.
E.Use separate tables for each company.
AnswersA, E

Domain separation natively partitions data by domain.

Why this answer

Options A and E are correct. Domain separation (A) provides built-in data isolation by partitioning data based on domains, ensuring each company sees only its own data. Separate tables for each company (E) physically isolate data at the database level.

Option B (ACLs) adds security but does not inherently isolate data in a multi-tenant architecture. Option C (database views) filters data but does not enforce isolation at the application layer. Option D (GlideRecord conditions) relies on developer discipline and is not a robust architectural solution.

Full explanation →
17
Multi-Selecthard

Which THREE of the following attributes can be set on a dictionary entry to affect how a field behaves?

Select 3 answers
A.Display
B.Mandatory
C.Default value
D.Calculated
E.Reference qualifier
AnswersB, C, D

Mandatory forces the field to be required, directly affecting field behavior.

Why this answer

Options B, C, and D are correct dictionary attributes that affect field behavior. 'Mandatory' (B) forces the field to be required. 'Default value' (C) sets an initial value for the field. 'Calculated' (D) enables a scripted calculated value, directly affecting how the field's value is determined. Option A ('Display') is a dictionary attribute that primarily controls which field to display in a reference field, not directly affecting field behavior. Option E ('Reference qualifier') is also a dictionary attribute, but it filters the records shown in a reference field, affecting record selection rather than the field's own behavior.

Full explanation →
18
MCQhard

A Service Portal widget is not rendering on the page, and the browser console shows: 'Uncaught ReferenceError: sp is not defined'. The widget's client script uses 'sp.get()'. What is the cause?

A.The widget is placed before the 'sp' provider widget on the page
B.The widget's client controller does not include 'sp' in the dependency list
C.The widget is missing a dependency on 'angular'
D.The server script runs after the client script, causing a race condition
AnswerB

In Service Portal, client controllers must list 'sp' as a dependency to use the sp API.

Why this answer

The user sees an error 'sp is not defined' because the client script uses 'sp.get()' but 'sp' is not available. In Service Portal, the 'sp' API must be explicitly injected into the widget's client controller. If it is not listed in the dependencies of the client controller function, the script will not have access to 'sp'.

Therefore, Option B is correct. Option A is incorrect because the order of widgets on the page does not affect dependency injection for individual widgets. Option C is incorrect because 'angular' is not required for 'sp'; it is the Service Portal API that needs to be injected.

Option D is incorrect because there is no race condition; the server script runs first and does not affect the client-side dependency injection.

Full explanation →
19
Multi-Selectmedium

A developer is writing a business rule that should run on after update of the Incident table to send an email notification when the state changes. The developer uses the method current.state.changes() to detect the change. However, the email is sent multiple times for the same incident update. What are two possible reasons? (Choose two.)

Select 2 answers
A.The business rule is set to run on every update, but the script does not check the previous state
B.The business rule's condition field is set to 'state changes'
C.The business rule runs on both insert and update
D.The email notification is triggered by a different business rule
E.The business rule is set to run on before update as well
AnswersD, E

Correct. Another business rule might also be sending an email on state change, leading to duplicate notifications.

Why this answer

Duplicate emails on the same incident update occur when multiple business rules send the notification or when the same rule runs multiple times. Option D is correct: another business rule may also be configured to send an email on state change, causing duplicates. Option E is correct: if the business rule runs on both before and after update, it will execute twice for the same update, sending two emails.

Option C is incorrect because running on insert causes an additional email on insert, not multiple emails during a single update operation. Option A is incorrect because current.state.changes() properly detects state changes; the issue is not about checking the previous state. Option B is incorrect because setting the condition field to 'state changes' would actually help filter, not cause duplicates.

Full explanation →
20
MCQmedium

A developer is writing a script to update a large number of records. To avoid hitting the execution time limit, what is the recommended approach?

A.Use a single GlideRecord update with setWorkflow(false).
B.Use GlideRecord with setLimit and a loop to process in batches.
C.Use a scheduled job to run the script asynchronously.
D.Use a business rule to trigger the update on save.
AnswerB

Correct: Batching prevents hitting the script timeout.

Why this answer

Processing records in batches using setLimit and a loop prevents long-running scripts and allows the system to handle the load efficiently.

Full explanation →
21
MCQmedium

An organization wants to store customer feedback data in a custom table. The feedback will have a large text field for comments, a reference to the customer, and a date field. Which data type should be used for the comments field to support rich text including HTML?

A.Report Text
B.String
C.HTML
D.Journal Entry
AnswerC

HTML data type stores and renders rich text with HTML tags.

Why this answer

The 'HTML' data type stores rich text with HTML formatting. Option A is wrong because 'String' does not support HTML rendering. Option B is wrong because 'Journal Entry' is for audit trail.

Option D is wrong because 'Report Text' is not a valid data type.

Full explanation →
22
MCQmedium

A developer is configuring an approval flow for a catalog item. When a user submits a request, an approval record is created with a single approver. The approver must be the user's manager. Which is the correct way to set the approver?

A.In the catalog item, set 'Approval type' to 'Single' and select a specific user
B.In the catalog item, write an 'Approval script' that sets the approver to the submitted by user's manager using current.approver = current.caller_id.manager
C.Use an Approval - User rule with condition that the approver is the manager
D.In the catalog item, set 'Approval type' to 'Group' and select the manager's group
AnswerB

Correct; catalog items allow a script in the Approval tab to dynamically set the approver.

Why this answer

It uses an approval script to dynamically set the approver to the manager of the request's caller. The script `current.approver = current.caller_id.manager` directly assigns the manager field from the user record of the caller, which is the standard way to implement a manager-based approval in ServiceNow. This approach is flexible and avoids hardcoding a specific user or group.

Exam trap

ServiceNow often tests the distinction between static assignment (Option A) and dynamic scripting (Option B), where candidates mistakenly think a simple 'Single' approval type can be configured to use the manager by selecting a field, but ServiceNow requires a script for dynamic resolution.

How to eliminate wrong answers

Option A is wrong because setting 'Approval type' to 'Single' and selecting a specific user would always assign that same user as the approver, regardless of who submits the request, which does not meet the requirement of using the submitter's manager. Option C is wrong because an 'Approval - User' rule defines conditions for when a user can be an approver, but it does not set the approver for a specific catalog item request; it is used for record-level approval rules, not for dynamically assigning the approver based on the caller's manager. Option D is wrong because setting 'Approval type' to 'Group' and selecting the manager's group would send the approval to the entire group, not to the individual manager, and it does not guarantee that the specific manager of the submitter is the one who approves.

Full explanation →
23
MCQeasy

A developer needs to create a custom application that tracks employee training completions. The application must allow managers to view a list of their direct reports' training records. Which ServiceNow Studio feature should be used to define the relationship between the Manager and Employee tables?

A.Create a Reference field on the Employee table pointing to the sys_user table.
B.Write a Business Rule to populate a manager field.
C.Configure an Access Control Rule (ACL) to filter records.
D.Use the GlideRecord API to join the tables in a script.
AnswerA

Correct: Reference fields define relationships between tables.

Why this answer

A Reference field on the Employee table pointing to the sys_user table establishes a direct database relationship between the employee record and their manager record. This allows the platform to automatically resolve the manager's user record and enables out-of-the-box features like dot-walking and related list displays in ServiceNow Studio.

Exam trap

The trap here is that candidates confuse runtime data manipulation (Business Rules, GlideRecord) with schema definition (Reference fields), or confuse security controls (ACLs) with data relationships, leading them to select options that address behavior rather than structure.

How to eliminate wrong answers

Option B is wrong because a Business Rule is procedural logic that runs on database operations (insert/update/delete) and does not define a persistent table relationship; it would only populate a field after the relationship structure already exists. Option C is wrong because an Access Control Rule (ACL) controls read/write permissions on records, not the structural relationship between tables. Option D is wrong because GlideRecord API is used for server-side scripting to query and manipulate data at runtime, not for defining static table relationships in the application schema.

Full explanation →
24
MCQeasy

A developer is working on an application in Studio and needs to create a new table that extends a base table. Which step is essential?

A.Import the table from an update set.
B.Use the 'Create Application File' wizard and select 'Table'.
C.Use the Database Views module.
D.Define the table schema manually via script.
AnswerB

This is the standard method in Studio for creating tables.

Why this answer

In Studio, the recommended way to create a new table is using the 'Create Application File' wizard and selecting 'Table'. Options A and D are not Studio-specific methods, and C is not a standard creation approach.

Full explanation →
25
MCQhard

During a data migration, a developer runs a GlideRecord query to load 100,000 records from an external source into the 'incident' table. The script times out after 60 seconds. Which optimization technique would be most effective to avoid the timeout?

A.Use setLimit(1000) to reduce the number of records per execution.
B.Use GlideAggregate to count records before insertion.
C.Increase the transaction timeout setting in the system properties.
D.Use GlideRecordBatch or a scheduled job to process records in smaller batches.
AnswerD

Using GlideRecordBatch or a scheduled job allows the developer to process records in smaller, manageable batches. This prevents the script from running for too long in a single transaction, thereby avoiding the timeout while still processing all records. This is the most effective optimization technique.

Why this answer

Using GlideRecordBatch or a scheduled job with incremental processing breaks the workload into manageable chunks, preventing the script from timing out. Option A is incorrect because setLimit(1000) only limits the number of records returned per query, but the migration requires all 100,000 records to be processed; it does not solve the timeout issue when processing large batches. Option B is incorrect because GlideAggregate is used for aggregation queries (e.g., counting records) and does not assist in batch insertion of records.

Option C is incorrect because increasing the transaction timeout is a temporary workaround; it does not address the underlying efficiency problem and may lead to other performance issues.

Full explanation →
26
Multi-Selectmedium

Which THREE of the following are valid components of the ServiceNow IntegrationHub?

Select 3 answers
A.Action steps
B.Spoke actions
C.REST Message
D.Data Source
E.Flow triggers
AnswersA, B, E

Action steps are individual steps within a spoke action.

Why this answer

Action steps are a core component of IntegrationHub, representing individual, reusable actions that can be composed into a flow to perform specific tasks, such as making API calls or transforming data. They are the building blocks that define the logic and operations within an IntegrationHub flow, enabling complex integrations without custom scripting.

Exam trap

The trap here is that candidates often confuse REST Message (a legacy tool for manual REST calls) with the modern IntegrationHub components, or mistake Data Source (a reporting element) as part of the integration framework, when in fact only Action steps, Spoke actions, and Flow triggers are valid IntegrationHub components.

Full explanation →
27
Multi-Selectmedium

Which TWO statements are true about using ServiceNow Studio for application development?

Select 2 answers
A.Studio provides a guided interface to create application files such as tables, business rules, and client scripts.
B.Studio requires a separate HI (High-Impact) instance to develop applications.
C.When creating a new application in Studio, a new scope is automatically generated without user input.
D.Studio can only be used by users with the admin role.
E.Studio allows integration with source control systems like Git for version management.
AnswersA, E

Studio is designed to streamline creation of application artifacts.

Why this answer

ServiceNow Studio provides a guided, low-code interface that simplifies the creation of application artifacts such as tables, business rules, client scripts, UI policies, and more. It offers wizards and templates to help developers build components without needing to manually write all the underlying XML or JavaScript from scratch, making it ideal for rapid application development within the Now Platform.

Exam trap

The trap here is that candidates often assume Studio requires admin privileges or a special instance type, but in reality, Studio is designed for all application developers and works on any standard instance, and the scope creation process always requires user confirmation.

Full explanation →
28
MCQeasy

A developer needs to create a UI Policy that hides a field when a checkbox is checked. The UI Policy has a condition: 'State is 2'. The field should be hidden when the checkbox is checked and state is 2. What is the correct approach?

A.Set condition to 'state=2' and add a script action that sets the field's visible attribute based on the checkbox value
B.Add both conditions in the condition builder: checkbox=true AND state=2
C.Set condition to 'state=2' and add a reverse if false action with a condition on the checkbox
D.Use a Client Script instead of UI Policy
AnswerA

Correct; the condition runs on server, and the script runs client-side to react to checkbox changes.

Why this answer

UI Policies have both a condition and actions. The script action can evaluate additional conditions. The best practice is to set the condition to the primary filter (state=2) and add a script action to set the field's visibility based on the checkbox.

Option A describes that correctly.

Full explanation →
29
MCQeasy

A developer needs to create a field on the Incident form that shows a red background when the priority is 'Critical'. Which feature should be used?

A.UI Policy
B.Business Rule
C.Access Control (ACL)
D.Client Script
AnswerA

UI Policies can change field attributes like style based on conditions.

Why this answer

UI Policy is the correct choice because it allows you to set a field's background color conditionally on the client side without a round trip to the server. In this case, you can create a UI Policy that triggers when the Priority field equals 'Critical' and use the 'Style' property to apply a red background to the Incident form field. This approach is efficient and directly meets the requirement for a visual indicator based on a field value.

Exam trap

The trap here is that candidates often confuse UI Policies with Client Scripts, assuming that any client-side visual change requires JavaScript, but UI Policies provide a declarative, no-code alternative that is both simpler and more maintainable for conditional styling.

How to eliminate wrong answers

Option B is wrong because Business Rules run server-side after a record is inserted, updated, or deleted, and they cannot directly modify the client-side CSS or background color of a field on the form. Option C is wrong because Access Controls (ACLs) control data access permissions (read, write, create, delete) and have no capability to alter field styling or background colors. Option D is wrong because Client Scripts can manipulate the DOM to change background colors, but they require custom JavaScript code and are less efficient than UI Policy, which provides a declarative, no-code solution specifically designed for such UI changes.

Full explanation →
30
Multi-Selecthard

Which two of the following are best practices when writing Script Includes in ServiceNow? (Choose two.)

Select 2 answers
A.Keep the script source code under 10 KB to improve performance.
B.Wrap all code in try-catch blocks to handle errors gracefully.
C.Use gs.addInfoMessage() to output debug information while developing.
D.Avoid using GlideRecord queries inside loops to prevent performance issues.
E.Use GlideAggregate instead of GlideRecord for aggregation calculations like count or sum.
AnswersD, E

Queries inside loops cause multiple database calls; use batch processing or GlideAggregate.

Why this answer

Running GlideRecord queries inside loops (e.g., for or while) causes multiple database round-trips, which severely degrades performance, especially with large datasets. Instead, you should use GlideRecord's query() once and iterate over the result set, or use GlideAggregate for aggregated calculations to minimize database calls.

Exam trap

ServiceNow often tests the misconception that all code should be wrapped in try-catch for error handling, but in ServiceNow, this is not a best practice because it can hide logic errors and is rarely needed due to the platform's built-in error logging and transactional rollback.

Full explanation →
31
Multi-Selectmedium

Which TWO of the following are valid ways to create a Business Rule? (Choose two.)

Select 2 answers
A.From the Business Rules list, right-click and select 'New'.
B.Navigate to 'System Definition > Business Rules' and click 'New'.
C.Use the 'New' button on the Business Rules module.
D.Type 'business_rule.do' in the navigator filter.
E.Create a Client Script and convert it to a Business Rule.
AnswersB, C

This is the standard way.

Why this answer

Navigating to 'System Definition > Business Rules' and clicking 'New' is the standard module-based method for creating a Business Rule in ServiceNow. This path directly accesses the Business Rule table (sys_script) and opens a new record form, which is a valid and documented approach.

Exam trap

ServiceNow often tests the distinction between valid navigation paths and invalid shortcuts, such as assuming a right-click menu or a direct URL suffix works, when in fact only the module link or the 'New' button on the list view are correct.

Full explanation →
32
MCQmedium

A developer has created a Business Rule that runs on the 'After' order of the incident table. The Business Rule modifies several fields on the incident record. After testing, the developer notices that the changes are not being saved to the database. What is the most likely cause?

A.The Business Rule is disabled for the current user's role.
B.The Business Rule does not include a call to current.update() after making field changes.
C.The fields being modified are read-only due to a data policy.
D.The Business Rule is set to run on 'Before' instead of 'After'.
AnswerB

Correct: After Business Rules require explicit current.update() to save changes.

Why this answer

In ServiceNow, a Business Rule set to run 'After' the database operation does not automatically save field changes to the database. The developer must explicitly call `current.update()` to persist the modifications. Without this call, the changes exist only in memory during the script execution and are discarded after the rule completes.

Option D is incorrect because the rule is specifically set to run 'After' as stated in the stem; if it were 'Before', changes would be saved automatically without needing `current.update()`. Options A and C are possible but less likely; the most common cause is the missing `current.update()` call.

Exam trap

The trap here is that candidates often assume any field changes in a Business Rule are automatically saved, failing to distinguish between 'Before' (auto-save) and 'After' (requires explicit `current.update()`) execution order.

How to eliminate wrong answers

Option A is wrong because if the Business Rule were disabled for the current user's role, it would not execute at all, but the developer observed that the rule runs (changes are made but not saved). Option C is wrong because a data policy making fields read-only would prevent the user from modifying them in the UI, but the Business Rule runs server-side and can still set field values regardless of data policies; the issue is specifically about persistence. Option D is wrong because a 'Before' Business Rule automatically saves changes to the database without requiring `current.update()`, so the described symptom (changes not saved) would not occur if the rule were on 'Before'.

Full explanation →
33
Multi-Selecthard

Which THREE factors contribute to poor UI performance in ServiceNow forms and portals? (Choose three.)

Select 3 answers
A.Using simple conditions in UI Policies
B.Large number of catalog client scripts in a variable set
C.Multiple client scripts firing on 'load' event
D.Use of CSS custom properties
E.Unindexed GlideRecord queries in UI Macro server scripts
AnswersB, C, E

Variable sets can have many client scripts that execute on load.

Why this answer

Correct options B, C, and E. In ServiceNow, poor UI performance can be caused by excessive client scripts (B), multiple client scripts firing on the 'load' event (C), and unindexed GlideRecord queries in UI Macro server scripts (E). Option A is incorrect because simple conditions in UI Policies are lightweight and do not significantly impact performance.

Option D is incorrect because CSS custom properties are a modern feature that can actually improve performance by reducing repeated styles.

Full explanation →
34
MCQmedium

Refer to the exhibit. A developer creates this UI Builder component but the header does not display the custom title. What is the most likely cause?

A.The field default is not applied unless the state is set
B.The states array is empty of conditions
C.The component name is not correctly registered
D.The section id is missing from the template
AnswerD

Correct: The template must use the section ID to reference the field.

Why this answer

The header fails to display the custom title because the template lacks the section ID that binds the field to the UI. In UI Builder, a component's template must include the section and field IDs to render dynamic content. Without the section ID, the field cannot be displayed, causing the title to be missing.

Option D correctly identifies this. Options A, B, and C are incorrect: A is wrong because default values apply when no state is set, not the reverse; B is irrelevant as empty conditions do not cause this issue; C would prevent the entire component from rendering, not just the header.

Full explanation →
35
MCQhard

A developer creates a script include named 'Utils' with a function that uses gs.log('message'). When called from a business rule on the incident table, the log is written. However, when called from a scheduled job in the same scope, no log appears. What could be the reason?

A.The scheduled job's log level is set to 'errors only'.
B.The business rule runs in the same scope but the scheduled job runs in a different scope.
C.The script include is not global.
D.The scheduled job runs with a different user context.
AnswerC

Correct. If the script include is not global, it may not be accessible from scheduled jobs even if in the same scope, because scheduled jobs can run in a different context.

Why this answer

If the script include is not global (i.e., it is scoped to a specific application), it may not be accessible from all execution contexts. Even though the scheduled job is defined in the same scope, scheduled jobs can run under a different context (such as the global scope) or have additional restrictions that prevent access to non-global script includes. This explains why the business rule works (as it runs in the application scope) but the scheduled job does not.

Option A is incorrect because log level settings do not affect script include accessibility—they control whether log messages are displayed. Option B is incorrect because the scenario states the scheduled job is in the same scope. Option D is incorrect because user context does not affect script include visibility; it affects record access.

Full explanation →
36
MCQhard

A developer has created a custom application and wants to ensure that all changes are captured in an update set for migration. Which practice should be followed?

A.Set the application to 'Published' to automatically create update sets.
B.Use the 'Update Sets' module to capture all changes from the application.
C.Use the 'Export to Update Set' feature in Studio.
D.Manually copy changes to another instance.
AnswerC

This creates a complete update set for the application.

Why this answer

In ServiceNow Studio, the 'Export to Update Set' feature allows developers to capture all changes made to an application and package them into an update set XML for migration. Option A is incorrect because setting an application to 'Published' does not automatically create update sets. Option B is incorrect because the 'Update Sets' module manages existing update sets, not capturing application changes.

Option D is incorrect because manually copying changes is error-prone and not a practice for migration.

Full explanation →
37
MCQhard

A company has a custom table 'u_training_course' with a reference field to 'sys_user' named 'u_instructor'. The requirement is that only users with the 'instructor' role can be selected in this field. Which approach should be used to enforce this?

A.Create a business rule on the table to check the role and reject invalid selections
B.Add a reference qualifier on the field to filter users with the 'instructor' role
C.Use a client script to validate the selection before form submission
D.Configure an ACL on the reference field to restrict write access
AnswerB

Reference qualifiers restrict the list dynamically.

Why this answer

A reference qualifier is the declarative way to filter the records available in a reference field on ServiceNow. By adding a condition like 'roles=instructor' to the reference qualifier of the 'u_instructor' field, only users with the 'instructor' role will appear in the lookup, enforcing the requirement at the database query level without custom scripting.

Exam trap

The trap here is confusing client-side validation (client scripts) or post-save checks (business rules) with the correct declarative filtering mechanism (reference qualifier), which is the intended and most efficient approach for restricting reference field choices in ServiceNow.

How to eliminate wrong answers

Option A is wrong because a business rule runs server-side after the record is saved, which would allow invalid selections to be temporarily stored and require a rollback, creating a poor user experience and unnecessary database writes. Option C is wrong because a client script runs in the browser and can be bypassed by disabling JavaScript or sending direct API calls, so it is not a secure enforcement mechanism. Option D is wrong because an ACL on the reference field controls write access to the field itself (who can modify it), not the values that can be selected within the field.

Full explanation →
38
MCQhard

A form has a UI Policy that conditionally makes a field mandatory. The UI Policy works on the server side but the mandatory validation is not enforced on the client side before submission. What is the most likely reason?

A.The field's ACL does not allow the user to see it.
B.The UI Policy is set to run only on the server and not on the client.
C.The form is in a different ordering of UI Policies.
D.A client script is overriding the mandatory property.
AnswerB

UI Policies must have the 'Run on client' checkbox enabled to enforce mandatory client-side.

Why this answer

UI Policies that are set to run only on the server will not enforce mandatory validation on the client. For client-side mandatory enforcement, the UI Policy must have the 'Run on client' checkbox checked or the mandatory attribute must be set via a client script. Option A is wrong because ACLs control visibility and access rights, not mandatory field validation.

Option C is wrong because the ordering of UI Policies affects execution order, not whether they run on the client. Option D is wrong because while a client script could override the mandatory property, the issue here is that the UI Policy itself is not set to run on the client, not that it is being overridden.

Full explanation →
39
MCQhard

An import set loads data from a CSV file into the staging table successfully, but the transform map does not run. The import set rows show status 'loaded'. What is the most likely cause?

A.The import set table is empty
B.The transform map is set to inactive
C.The field mapping between source and target fields is incomplete
D.The transform map's target table name is misspelled
AnswerB

An inactive transform map does not execute even if data is loaded.

Why this answer

The transform map is set to inactive, which prevents it from running. Option A is incorrect because the import set table is not empty; rows have been loaded. Option C is incorrect because incomplete field mapping would cause transform errors but not prevent the map from running.

Option D is incorrect because a misspelled target table name would likely cause a different issue, such as rows not being created, but the map would still attempt to run.

Full explanation →
40
MCQhard

A developer is tasked with creating a reference field on a custom table that shows only 'Windows' servers from the 'cmdb_ci_server' table. What is the proper way to implement this?

A.Use a choice list instead of a reference field.
B.Create a business rule that filters the reference field.
C.Create a dynamic filter on the form.
D.Define a reference qualifier on the field with the condition 'os_type=Windows'.
AnswerD

Correct: Reference qualifiers filter the picker list.

Why this answer

In ServiceNow, a reference qualifier is used to filter the records that appear in a reference field's lookup. By defining a reference qualifier with the condition 'os_type=Windows', only Windows servers from the cmdb_ci_server table will be available for selection. Option A is incorrect because a choice list is not a reference field and cannot dynamically filter a reference based on a table.

Option B is incorrect because a business rule can modify data but is not the standard mechanism to filter a reference field's picker. Option C is incorrect because a dynamic filter on a form typically applies to related lists or reports, not to the lookup of a reference field.

Full explanation →
41
Multi-Selectmedium

Which THREE factors should be considered when deciding between using a REST API integration and an Import Set for data ingestion?

Select 3 answers
A.Real-time vs batch processing requirement
B.Volume of data to be imported
C.Need for authentication and authorization
D.Complexity of data transformation needed
E.Support for OAuth 2.0
AnswersA, B, D

REST is real-time; import sets are batch.

Why this answer

Options A, B, and D are correct. Real-time vs batch processing (A) is a key difference between REST API and Import Sets. Volume of data (B) affects performance and feasibility of each method.

Complexity of data transformation (D) determines which method is more suitable, as Import Sets handle transformations well while REST APIs may require custom scripting. Authentication and authorization (C) is needed for both, so it's not a deciding factor. Support for OAuth 2.0 (E) is a specific authentication method, not a general consideration.

Full explanation →
42
MCQhard

A global company is using ServiceNow for IT Service Management. They have an external asset management system that needs to update asset records in ServiceNow in real-time. The integration is implemented using REST API calls from the external system to ServiceNow. Recently, the integration started failing intermittently with HTTP 429 (Too Many Requests) errors. The external system is sending a high volume of update requests (up to 1000 per minute) to the /api/now/table/alm_asset endpoint. The administrator noticed that the instance performance is degraded during peak times. The company wants to resolve the 429 errors while ensuring data is updated as quickly as possible, but without overloading the instance. Which course of action should the administrator take?

A.Increase the API rate limit in the instance's system properties.
B.Reduce the number of requests from the external system to 500 per minute.
C.Implement a queue-based integration using Flow Designer to process updates asynchronously with a controlled rate.
D.Switch the authentication method from basic to OAuth to reduce overhead.
AnswerC

Queuing allows decoupling and rate control, preventing 429 errors.

Why this answer

It addresses the root cause of the 429 errors—overwhelming the REST API endpoint with synchronous requests—by decoupling the external system from direct writes. Using Flow Designer with a queue (e.g., via the ServiceNow Queue or a custom table) allows the external system to submit requests asynchronously, and then a scheduled flow or script processes them at a controlled rate (e.g., using a rate limiter or batch size). This ensures data is updated as quickly as possible without exceeding the instance's API rate limits or degrading performance, as the processing is throttled server-side.

Exam trap

The trap here is that candidates often assume increasing rate limits (Option A) or reducing external request volume (Option B) are sufficient fixes, but they overlook the need for a controlled, asynchronous processing pattern to prevent instance degradation while maintaining near-real-time updates.

How to eliminate wrong answers

Option A is wrong because increasing the API rate limit in system properties does not solve the underlying performance degradation; it only raises the threshold for 429 errors, potentially allowing even more requests to hit the instance and worsen the overload. Option B is wrong because simply reducing the external system's request rate to 500 per minute is a manual, inflexible workaround that does not guarantee the instance can handle that volume without degradation, and it may still cause 429 errors if the instance's capacity is lower; it also fails to address the need for real-time updates. Option D is wrong because switching from basic to OAuth authentication reduces authentication overhead per request (e.g., no password hashing), but it does not reduce the number of requests or the load on the /api/now/table/alm_asset endpoint; the 429 errors are due to request volume, not authentication method.

Full explanation →
43
MCQhard

A developer is building a flow in Flow Designer as part of a scoped application. The flow needs to trigger when a record is created in a specific table. Which trigger should be used?

A.'Record Created' trigger with a condition
B.'Event' trigger
C.'Application Record Created' trigger
D.'Scheduled' trigger
AnswerA

Correct trigger.

Why this answer

The 'Record Created' trigger fires when a new record is created in a specified table, which matches the requirement. Option B is incorrect because an 'Event' trigger requires a custom event to be published, not a record creation. Option C is incorrect because 'Application Record Created' is not a standard trigger in Flow Designer; the correct trigger for record creation is 'Record Created'.

Option D is incorrect because 'Scheduled' triggers are time-based and are not triggered by record creation.

Full explanation →
44
MCQmedium

The business rule above does not set the urgency on new incidents created via web service when the caller's department is IT. What is the most likely reason?

A.The condition uses current.urgency == '' but the field may have a default value of 3
B.The table is not 'Incident' but 'Incident Task'
C.The business rule is set to 'before' but web service calls trigger after rules
D.The gs.log statement is preventing the script from completing
AnswerA

Correct; default values are applied before the business rule runs, so urgency is not empty.

Why this answer

The business rule condition checks if `current.urgency` is an empty string, but the Incident table has a default value of 3 for the urgency field. When a new record is created via web service, the system populates the urgency field with the default value before the business rule runs, so the condition `current.urgency == ''` evaluates to false, and the script never executes to set the urgency.

Exam trap

The trap here is that candidates assume a field will be empty on new record creation, forgetting that dictionary defaults are applied before business rules execute, causing the condition to fail silently.

How to eliminate wrong answers

Option B is wrong because the question explicitly states the rule is for new incidents, and the business rule would be scoped to the Incident table; if the table were 'Incident Task', the rule would not fire at all for incidents, but the issue is about the condition failing, not the table. Option C is wrong because web service calls trigger both 'before' and 'after' business rules; the 'before' rule runs before the record is saved, so timing is not the issue. Option D is wrong because a `gs.log` statement does not prevent script completion; it only writes a log message and does not stop execution.

Full explanation →
45
MCQhard

A script include is defined as a public static function and is called from multiple business rules. After an upgrade, some business rules start failing with 'undefined' errors. What is the most likely cause?

A.The script include was made private.
B.The script include's ACLs changed.
C.The script include's function signature changed.
D.The script include's scope changed.
AnswerC

Function parameter count or name change leads to undefined errors on call.

Why this answer

If the function signature changed (e.g., parameters or return type), existing calls to the script include would fail with 'undefined' errors. Option A would cause 'not found' errors, not undefined. Option B: ACLs do not affect server-side execution.

Option D: scope change could cause access errors or 'not found', not typically 'undefined'.

Full explanation →
46
Multi-Selecthard

A ServiceNow instance needs to expose a REST API endpoint for external applications to query incident data. The developer creates a Scripted REST API and needs to ensure that only authorized applications can access it. Which THREE methods can be used to secure the Scripted REST API?

Select 3 answers
A.Require the request to include a valid ServiceNow username and password (Basic Authentication)
B.Require a valid SAML 2.0 assertion in the request body
C.Require a valid OAuth 2.0 access token in the Authorization header
D.Require a specific API key in the request header that is validated against an API Keys application
E.Require that the request originates from an IP address within a specified LDAP directory
AnswersA, C, D

Basic Auth is a built-in option for REST API security.

Why this answer

ServiceNow supports HTTP Basic Authentication, which requires the request to include a valid ServiceNow username and password in the Authorization header. This is a standard method for securing Scripted REST APIs, as the platform validates credentials against its user table before processing the request.

Exam trap

The trap here is that candidates may confuse SAML 2.0 assertions (used for SSO) with API authentication mechanisms, or assume IP-based restrictions are a valid API security method in ServiceNow, when in fact only Basic Auth, OAuth 2.0, and API keys are supported for Scripted REST APIs.

Full explanation →
47
MCQmedium

In a large enterprise environment, the ServiceNow instance is heavily customized. A business rule on the Change Request [change_request] table runs on after update to initiate a complex workflow involving multiple approvals and updates to Configuration Items (CIs). Recently, the IT operations team noticed that the workflow fails to start for many change requests. The system logs show the error: "Business rule script error: Cannot read property 'sys_id' of null". The developer inspects the business rule script and sees the following code snippet: var task = new GlideRecord('task'); task.get(current.sys_id); var relatedCI = task.cmdb_ci; // The rest of the script uses relatedCI to update the CI's status. The developer knows that change requests are not stored in the task table; they are in change_request. However, the script was written by a previous developer and has been working for months. The developer must fix the script to ensure the workflow starts correctly. Which action should the developer take?

A.Wrap the script in a try-catch block and log the error then return
B.Change GlideRecord('task') to GlideRecord('change_request')
C.Use current.cmdb_ci directly
D.Add a check if (task.isValidRecord()) before accessing cmdb_ci
AnswerC

The current record is a change request, so current.cmdb_ci contains the CI.

Why this answer

Best because current is already the change request record, so current.cmdb_ci is directly available. Option A would work but adds unnecessary database query. Option B would prevent the error but not fix the root cause; the script would still fail to get the CI if the record is not in task.

Option D would hide the error but not fix the logic.

Full explanation →
48
MCQhard

The ACL is meant to allow users to read an incident only if they are the manager of the assigned user. However, users who are not managers can also read the incident. What is the flaw?

A.The operation should be 'write' not 'read'
B.The table should be 'sys_user'
C.The condition in the ACL condition field should be removed and replaced with the script
D.The script should include an else statement that sets answer = false
AnswerD

Correct; the script currently always sets answer = true, so it grants access unconditionally.

Why this answer

When an ACL condition script runs, it must explicitly set the answer variable to true or false. If the script lacks an else statement that sets answer = false, the script returns undefined (or the last evaluated expression) for non-matching conditions, which ServiceNow treats as true, inadvertently granting read access to unauthorized users. Adding an else statement that sets answer = false ensures that only users who satisfy the manager condition are granted read access.

Exam trap

The trap here is that candidates assume a script that returns true for the intended condition automatically denies access for others, but ServiceNow requires an explicit else statement to set answer = false; otherwise, the script's return value is undefined, which is often treated as true.

How to eliminate wrong answers

Option A is wrong because the operation 'read' is correct for controlling who can view an incident; changing it to 'write' would control update access, not read access, and would not fix the flaw. Option B is wrong because the table 'incident' is the correct table for incident records; changing the table to 'sys_user' would apply the ACL to user records, not incidents, which is irrelevant to the requirement. Option C is wrong because the condition in the ACL condition field is not inherently flawed; the issue is that the script does not explicitly return false for non-managers, and removing the condition would not address the missing else statement.

Full explanation →
49
Multi-Selecthard

Which THREE conditions must be met for a user to successfully see a record in a ServiceNow list view?

Select 3 answers
A.The user has write permission on the table.
B.The user has read permission on the table via an ACL.
C.The user has configured a personalized list view for the table.
D.The user has a role that grants access to the table, if role-based access is configured.
E.The record is not excluded by a condition in the application's default filter.
AnswersB, D, E

Read ACL is necessary to view records.

Why this answer

ServiceNow uses Access Control Lists (ACLs) to enforce read permissions on tables. Without a read ACL that evaluates to true for the user, the system will not display any records from that table in a list view, regardless of other conditions.

Exam trap

The trap here is that candidates often confuse the requirement for a personalized list view (a display preference) with the mandatory security and filtering conditions (ACL read access and default filter) that actually control record visibility.

Full explanation →
50
MCQmedium

An organization has a ServiceNow instance that integrates with a third-party monitoring tool using a webhook. The monitoring tool sends HTTP POST requests to a Scripted REST API in ServiceNow to create incidents automatically. Recently, the monitoring tool started sending duplicate requests due to a retry mechanism. The developer wants to ensure that duplicate incidents are not created. The Scripted REST API currently creates a new incident record for every request without checking for duplicates. The request payload includes a unique 'alert_id' field. The developer decides to implement idempotency logic. Which approach should the developer use to prevent duplicate incident creation?

A.In the Scripted REST API, use a GlideRecord to query the incident table with a condition on the 'alert_id' field before inserting a new record; if a record exists, skip creation and return the existing record's sys_id
B.Create a GlideAggregate script that counts incidents with the same 'alert_id'; proceed only if count is zero
C.Add a before-insert business rule on the incident table that checks for duplicates using the 'alert_id' field
D.Use a flow in Flow Designer triggered by the REST API that creates an incident only if the 'alert_id' is not already present in a custom table
AnswerA

This is the simplest and most effective idempotency check within the same API script.

Why this answer

It implements idempotency directly within the Scripted REST API by querying the incident table using GlideRecord with a condition on the unique 'alert_id' field before inserting. If a record with that 'alert_id' already exists, the API skips creation and returns the existing sys_id, ensuring no duplicate incidents are created despite duplicate webhook requests.

Exam trap

The trap here is that candidates may choose Option C (business rule) thinking it centralizes duplicate logic, but they overlook that the business rule runs after the insert attempt, not before the API call, so it cannot prevent the duplicate request from being processed or the API from returning a success response for the duplicate.

How to eliminate wrong answers

Option B is wrong because GlideAggregate is designed for aggregation (e.g., SUM, COUNT) and is unnecessarily heavy for a simple existence check; a standard GlideRecord query with getRowCount() is more efficient and idiomatic. Option C is wrong because a before-insert business rule runs after the REST API has already initiated the insert operation, meaning the duplicate record may still be partially processed or cause a rollback, and it does not prevent the initial API call from consuming resources or returning an error. Option D is wrong because using a Flow Designer flow triggered by the REST API adds unnecessary complexity and latency; the idempotency check should be performed synchronously within the Scripted REST API script itself to maintain atomicity and avoid race conditions.

Full explanation →
51
MCQhard

A developer is building a custom application in ServiceNow Studio for IT asset management. The application includes a table 'Asset' with fields: asset_tag (string), serial_number (string), purchase_date (date), cost (currency), and status (choice: In Use, In Stock, Retired). The developer needs to create a business rule that automatically sets the status to 'Retired' when the cost is zero and the purchase_date is older than 5 years. The business rule should run before the record is saved to the database and should not prevent the save if conditions are not met. The developer writes the following business rule in Studio: Table: Asset, When: Before, Order: 100, Condition: current.cost == 0 && current.purchase_date < gs.yearsAgoStart(5). The script is: current.status = 'Retired'; However, the status is not being updated as expected. What is the most likely issue?

A.Replace gs.yearsAgoStart(5) with gs.yearsAgoEnd(5) to get the end of the year 5 years ago.
B.Change the table from 'Asset' to 'Asset [new]' as the business rule may be on the wrong table.
C.Increase the order of the business rule to 200 to ensure it runs after other rules.
D.Replace gs.yearsAgoStart(5) with gs.yearsAgo(5) to get the exact date 5 years ago.
AnswerD

gs.yearsAgo(5) returns the date exactly 5 years before the current date, which correctly implements 'older than 5 years'.

Why this answer

The issue is that `gs.yearsAgoStart(5)` returns the start of the year (January 1st) five years ago, not the exact date five years ago. This means a record with a purchase_date that is, for example, 5 years and 1 month old might still be after that start-of-year date and thus not match the condition. The correct method is `gs.yearsAgo(5)`, which returns the exact date and time five years ago, ensuring the comparison works as intended for any purchase_date older than 5 years.

Exam trap

The trap here is that candidates confuse `gs.yearsAgoStart()` and `gs.yearsAgoEnd()` with `gs.yearsAgo()`, not realizing that the 'Start' and 'End' variants are for fiscal or calendar year boundaries, not for exact date arithmetic.

How to eliminate wrong answers

Option A is wrong because `gs.yearsAgoEnd(5)` returns the end of the year (December 31st) five years ago, which would be even less restrictive than `gs.yearsAgoStart`, making the condition even less likely to match records that are exactly 5+ years old. Option B is wrong because the table name 'Asset' is correct; the business rule is defined on the 'Asset' table, and there is no indication the table is misnamed or that a '[new]' suffix is needed—Studio uses the actual table name. Option C is wrong because increasing the order does not fix the logic error; order only affects the sequence of execution among multiple business rules, but the condition itself is incorrect due to the wrong date function.

Full explanation →
52
MCQmedium

A developer is building a custom application in ServiceNow Studio. The application requires a table that stores incident-like records but with additional custom fields. The developer wants to leverage existing functionality such as assignment rules, escalation, and SLA tracking. Which approach should the developer take?

A.Extend the Incident table and add custom fields to the extended table.
B.Clone the Incident table and rename it, then modify the clone.
C.Create a new table from scratch and manually add all necessary fields and business rules.
D.Use the Configuration Management Database (CMDB) to store the records.
AnswerA

Extending the Incident table inherits all existing features like assignment rules, escalation, and SLA tracking.

Why this answer

Extending the Incident table (Option A) is correct because it allows the developer to inherit all existing Incident functionality—such as assignment rules, escalation, and SLA tracking—while adding custom fields. In ServiceNow, table extension creates a child table that inherits all business rules, ACLs, and workflows from the parent, ensuring the custom application leverages the full Incident lifecycle without reimplementation.

Exam trap

The trap here is that candidates may think cloning or creating from scratch gives more control, but ServiceNow's extension model is the only way to inherit core functionality without manual rework, and the exam tests understanding that extension preserves parent-child relationships and system updates.

How to eliminate wrong answers

Option B is wrong because cloning the Incident table creates a separate, independent table that does not inherit future updates or patches to the Incident table, leading to maintenance overhead and potential divergence from core functionality. Option C is wrong because creating a table from scratch requires manually recreating all business rules, assignment rules, escalation logic, and SLA definitions, which is inefficient and error-prone, defeating the purpose of leveraging existing functionality. Option D is wrong because the CMDB is designed for configuration items (CIs) and their relationships, not for operational incident-like records; storing such records in the CMDB violates its data model and would not support assignment rules, escalation, or SLA tracking.

Full explanation →
53
Multi-Selecteasy

Which TWO application file types can be exported as XML from Studio?

Select 2 answers
A.Business Rules
B.Reports
C.System Properties
D.UI Policies
E.Homepages
AnswersA, D

Correct. Business Rules are exportable application files.

Why this answer

Options A and D are correct because Business Rules and UI Policies are standard application files that can be exported as XML from Studio. Option B (Reports) is wrong because Reports are not application files; they are stored separately. Option C (System Properties) is wrong as they are configuration items, not exported via Studio.

Option E (Homepages) is wrong because Homepages are not application files and cannot be exported as XML from Studio.

Full explanation →
54
Multi-Selecthard

Which TWO statements about update sets are correct? (Choose two.)

Select 2 answers
A.Update sets capture changes to ACLs, but each condition script is captured as a separate record.
B.Update sets must be explicitly exported and then imported into the target instance.
C.Update sets capture all changes made to an instance, including out-of-box records.
D.Update sets can contain changes to system properties.
E.Update sets are used to move data, such as user records, between instances.
AnswersB, D

Retrieved or exported from the source instance and committed in the target.

Why this answer

The correct answers are B and D. Update sets are used to move customizations between instances. They must be explicitly exported from a source instance and imported into a target instance (B).

They can capture changes to system properties (D). Option A is incorrect because update sets capture ACL records as a whole, not individual condition scripts separately. Option C is incorrect because update sets do not capture out-of-box records; they only capture changes made to customizations.

Option E is incorrect because update sets move changes (configurations), not data records like users.

Full explanation →
55
MCQmedium

A developer needs to find the number of open incidents assigned to each assignment group. Which GlideAggregate script correctly groups by assignment group and counts?

A.var ga = new GlideAggregate('incident'); ga.addQuery('active', true); ga.addAggregate('COUNT', 'assignment_group'); ga.query();
B.var ga = new GlideAggregate('incident'); ga.addQuery('active', true); ga.groupBy('assignment_group'); var count = ga.getRowCount();
C.var ga = new GlideAggregate('incident'); ga.get('active', true); ga.groupBy('assignment_group'); ga.addAggregate('COUNT');
D.var ga = new GlideAggregate('incident'); ga.addQuery('active', true); ga.addAggregate('COUNT'); ga.groupBy('assignment_group'); ga.query();
AnswerD

Correctly queries, groups, and aggregates.

Why this answer

The GlideAggregate API requires addQuery() to filter open incidents, then addAggregate('COUNT') to define the aggregation, then groupBy('assignment_group') to specify the grouping field, and finally query() to execute. Option A is wrong because it uses addAggregate('COUNT', 'assignment_group'), which incorrectly passes the grouping field as a second parameter; the correct method is separate groupBy() call. Option B is wrong because getRowCount() returns the number of rows after query(), not the count per group; also missing addAggregate().

Option C is wrong because it uses get() instead of query() and the order of methods is incorrect; get() is for fetching a single record, not aggregate queries.

Full explanation →
56
MCQhard

A developer is creating a business rule that runs before a query to modify the query condition. Which event should be specified?

A.'before insert'
B.'after query'
C.'display'
D.'before query'
AnswerD

Correct event for modifying query.

Why this answer

The correct event to modify query conditions before a query runs is 'before query'. This event fires before the database query is executed, allowing the developer to modify the query condition. Option A ('before insert') is for record insertion, not queries.

Option B ('after query') fires after the query, so it is too late to modify conditions. Option C ('display') is related to form rendering, not queries.

Full explanation →
57
MCQeasy

A service catalog item has a variable set that includes a reference field to the 'cmdb_ci' table. The requirement is to show only 'Server' type CI's in the reference field. Which approach should be used?

A.Create a UI Policy that sets the field as read-only and uses a condition to filter.
B.Set a Reference Qualifier on the variable definition that uses the condition 'sys_class_name=Server'.
C.Write a Client Script on load that sets the reference qualifier using setRefQual().
D.Use a Data Policy to enforce a condition on the field.
AnswerB

Reference Qualifiers directly filter the records shown in the lookup.

Why this answer

A Reference Qualifier on a variable definition allows you to filter the records displayed in a reference field using a condition string. By setting the condition 'sys_class_name=Server', only CI records with that specific sys_class_name will appear, which directly meets the requirement to show only 'Server' type CIs.

Exam trap

The trap here is that candidates may confuse UI Policies or Data Policies with reference qualifiers, thinking they can filter reference field data, when in fact only a Reference Qualifier (or a derived condition) directly controls which records are available for selection.

How to eliminate wrong answers

Option A is wrong because a UI Policy can set a field as read-only or visible, but it cannot filter the records shown in a reference field; it only controls UI behavior, not the underlying data query. Option C is wrong because while a Client Script can use setRefQual() to dynamically set a reference qualifier, this approach is typically used for client-side filtering and is less efficient and reliable than a server-side Reference Qualifier; the question asks for the approach that should be used, and the standard, best-practice method is a Reference Qualifier on the variable definition. Option D is wrong because a Data Policy enforces data integrity rules (such as mandatory or read-only conditions) on a field, but it does not filter the list of records available in a reference field.

Full explanation →
58
MCQeasy

A small IT department uses ServiceNow for incident management. They have a business rule that runs after insert on the Incident table. The rule is intended to send an email notification to the assignment group whenever a new incident is created. The rule uses a standard "send event" method, and the email notification is set up in the system mail properties. Recently, the group leader noticed that some incidents are not triggering emails. The developer investigates the business rule and confirms that the script executes without errors, but the email is not sent for those specific incidents. The developer checks the email notification configuration and finds that it is set to send to the "assigned user" rather than the "assigned group". After correcting this, the emails start working. However, the developer wants to understand why only some incidents were affected. Which of the following best explains the issue?

A.The email notification was incorrectly configured to send to the user, so only incidents assigned to a specific user triggered emails; incidents assigned to a group had no recipient
B.The assignment group did not have any members for those incidents
C.The business rule script had a condition that randomly skipped some incidents
D.The SMTP server was intermittently down
AnswerA

When an incident is assigned to a group, there is no 'assigned user' to send the email to.

Why this answer

The email notification was configured to send to the 'assigned user' field, which is populated only when an incident is assigned to a specific individual. Incidents assigned directly to a group (with no user assigned) would have an empty 'assigned user' field, causing the notification to have no recipient and thus not be sent. After correcting the configuration to send to the 'assigned group', emails were triggered for all incidents, confirming that the issue was the recipient field mismatch.

Exam trap

The trap here is that candidates might assume the business rule or SMTP server is at fault, rather than recognizing that an empty recipient field in the notification configuration causes selective delivery failures based on assignment state.

How to eliminate wrong answers

Option B is wrong because the assignment group having no members would not prevent the email from being sent; the notification would still attempt to send to the group, and if the group had no members, it might log a warning but not silently fail for some incidents. Option C is wrong because the developer confirmed the business rule script executes without errors and there is no evidence of a random condition; the issue is purely in the email notification configuration, not the business rule logic. Option D is wrong because an intermittent SMTP server outage would affect all outgoing emails, not selectively only those assigned to a group, and the developer found the root cause in the recipient configuration.

Full explanation →
59
MCQhard

Refer to the exhibit. A dashboard filter configuration contains the above JSON. When the dashboard runs, it shows an 'Invalid filter condition' error. What is the issue?

A.The condition string is missing a closing parenthesis.
B.The operator should be 'OR' instead of 'AND'.
C.The JSON has a trailing comma after the 'operator' line.
D.The assignment group name is misspelled.
AnswerC

Trailing commas are not allowed in JSON.

Why this answer

The JSON has a trailing comma after the 'operator' value, which is invalid JSON syntax. This causes the parser to fail.

Full explanation →
60
MCQhard

The above Jelly script is used to generate a UI Page. When rendered, the 'cmdb_ci' field does not appear. What is the most likely cause?

A.The Jelly namespace declaration for 'g2' is missing, causing the field to be ignored
B.The <g:ui_field> element must be inside a <g:ui_section> rather than <g:ui_element>
C.The <g:ui_element> containing 'cmdb_ci' is improperly nested inside another <g:ui_element>
D.The 'cmdb_ci' field has a mandatory attribute that conflicts with the UI policy
AnswerC

Invalid nesting causes the parser to drop the inner element.

Why this answer

When a <g:ui_element> is nested inside another <g:ui_element>, the inner element is ignored by the Jelly UI framework. The proper structure requires that <g:ui_element> be placed directly within a <g:ui_section> or <g:ui_form> , not inside another <g:ui_element>. This nesting issue causes the 'cmdb_ci' field not to render.

Option A is incorrect because the namespace is correctly declared if other fields render. Option B is incorrect because a <g:ui_element> does not need to be inside a <g:ui_section> ; it can be directly in a <g:ui_form> . Option D is incorrect because a mandatory attribute does not prevent a field from appearing; it only affects submission behavior.

Full explanation →
61
MCQeasy

Refer to the exhibit. The script runs as a business rule on the incident table. What will happen when this script executes?

A.The update will only occur if the business rule condition evaluates to true.
B.The update will trigger other business rules that run on update.
C.The record will be updated without triggering any other business rules.
D.The script will throw an error because setValue() requires a third parameter.
AnswerB

When update() is called, it triggers all business rules set to run on update for that table.

Why this answer

The script uses `setValue()` to update a field on the current record, which is an update operation. In ServiceNow, business rules that run on 'update' will fire when a record is updated, unless the business rule is specifically configured to run 'asynchronously' or with the 'Don't run other business rules' option. Since the exhibit does not show such configuration, the update will trigger other business rules that run on update.

Exam trap

ServiceNow often tests the misconception that `setValue()` in a business rule will not trigger other business rules, but the default behavior is that it does, unless the 'Don't run other business rules' checkbox is explicitly selected.

How to eliminate wrong answers

Option A is wrong because the script does not contain a condition; the business rule's condition is evaluated before the script runs, but the script itself will execute regardless of the condition if the condition is true. Option C is wrong because the default behavior in ServiceNow is that updates trigger other business rules unless the 'Don't run other business rules' checkbox is selected, which is not shown. Option D is wrong because `setValue()` in ServiceNow only requires two parameters (field name and value) and does not require a third parameter; the script will not throw an error for that reason.

Full explanation →
62
MCQmedium

A ServiceNow administrator is responsible for setting up a custom table called 'u_incident_change' to track incidents that require a change request. Each 'u_incident_change' record must be linked to exactly one incident and one change request. The administrator creates two reference fields: 'incident_ref' pointing to the 'Incident' table, and 'change_ref' pointing to the 'Change Request' table. However, after deployment, users report that when they create a new 'u_incident_change' record from an incident form (using a related list), the 'incident_ref' field is automatically populated, but the 'change_ref' field is empty. The users want to be able to create a change request directly from that same form and have the reference automatically filled. What configuration should the administrator use to achieve this?

A.Create a UI Action labeled 'Create Change Request' on the incident form that runs a script to create a new 'u_incident_change' record with both references populated and then opens the change request form
B.Configure the related list to automatically create the 'u_incident_change' record with both references when a change request is added
C.Use a business rule on the 'u_incident_change' table that auto-populates the 'change_ref' when the record is created from a related list
D.Add a reference field on the Incident table that points to the 'u_incident_change' table
AnswerA

This UI Action can script the creation of the change request and the junction record, setting both references, and provide a seamless user experience.

Why this answer

A UI Action with a script creates the change request and sets the reference fields accordingly. Option B is wrong because referenced records don't auto-populate. Option C is wrong because business rules run on records, not UI.

Option D is wrong because related lists don't create records with cross-reference.

Full explanation →
63
MCQhard

A widget's server script retrieves data from the 'incident' table using GlideRecord. A user with 'itil' role can see some incidents in the backend but the widget shows no data. What could be the reason?

A.The GlideRecord query does not include the user's assignment group filter
B.The portal page has a visibility condition that excludes the user
C.The widget is using client-side REST API instead of server-side
D.The widget's server script is not returning data because of a syntax error
AnswerB

Correct: The widget may be hidden due to user criteria.

Why this answer

Widget server scripts respect ACLs. If the widget is assigned to a portal that does not have the correct user criteria, or if the user's portal roles differ from backend roles, the data may not be visible.

Full explanation →
64
MCQmedium

A Business Rule is designed to send an email notification when a record is assigned to a specific group. The email is sent despite the condition not being met. What is the most likely cause?

A.The Business Rule runs on insert only.
B.The email notification is also triggered by a different Business Rule.
C.The condition is written incorrectly.
D.The condition is using a field that is not on the table.
AnswerC

Syntax error may cause condition to always be true.

Why this answer

A Business Rule condition that is syntactically or logically incorrect can cause the condition to always evaluate to true, triggering the email notification even when the intended condition is not met. For example, using an incorrect operator or referencing a field that always evaluates to true (e.g., `current.state == 1` when the field is a string) may cause the condition to be true unexpectedly. In ServiceNow, Business Rules evaluate conditions in JavaScript; if the condition is written incorrectly, it may always return true, causing the action to execute despite the intended condition not being satisfied.

Exam trap

ServiceNow often tests the misconception that a Business Rule will not execute if the condition is invalid, when in fact an incorrectly written condition can silently evaluate to true and trigger actions unexpectedly.

How to eliminate wrong answers

Option A is wrong because a Business Rule running on insert only would not affect the condition evaluation; if the condition is met on insert, the email would still be sent, but the issue is the email is sent when the condition is not met, so the trigger type is irrelevant. Option B is wrong because while another Business Rule could also send an email, the question specifies the email is sent 'despite the condition not being met' for this specific rule, implying the rule itself is faulty, not that a separate rule is responsible. Option D is wrong because using a field not on the table would cause a script error or null reference, typically preventing the Business Rule from running or sending the email, not causing it to send when the condition is false.

Full explanation →
65
MCQmedium

A developer wants to use a business rule to prevent a user from saving an incident if the short description is empty. Which script should be used?

A.current.setAbortAction(true); gs.addInfoMessage('Short description required');
B.gs.addInfoMessage('Short description required'); current.setAbortAction(true);
C.gs.addErrorMessage('Short description required'); current.setAbortAction(true);
D.current.setAbortAction(true); gs.addErrorMessage('Short description required');
AnswerD

Correct; setAbortAction stops the save and then the error message is displayed.

Why this answer

The proper order is to call `current.setAbortAction(true)` first to abort the save, then use `gs.addErrorMessage()` to display an error message. Option A is incorrect because it uses `gs.addInfoMessage()` for an informational message instead of an error, which does not properly indicate a validation failure. Option B is incorrect both because it reverses the order (the error message may not display after abort) and uses `addInfoMessage`.

Option C is incorrect because it reverses the order: the error message is added before the abort action, which may cause the message to be lost. Only D uses the correct order and the correct method for error messages.

Full explanation →
66
MCQmedium

Refer to the exhibit. The above JSON represents an application manifest generated by Studio. What does the dependency on 'global' with version '>=3.0.0' indicate?

A.The application requires an update set from global scope.
B.The application must be installed on an instance with ServiceNow version 3.0.0 or later.
C.The application depends on another application with scope 'global' that must be at least version 3.0.0.
D.The application's global update set must be at version 3.0.0.
AnswerB

'global' scope with a version constraint indicates the minimum platform version.

Why this answer

In ServiceNow application manifests, a dependency on 'global' refers to the platform version (ServiceNow release). It means the application requires the instance to be at least version 3.0.0. Option A confuses update sets, C misinterprets scope, and D is incorrect.

Full explanation →
67
Multi-Selectmedium

A developer is using ServiceNow Studio to deploy a custom application to a production instance. Which THREE actions are recommended best practices for deployment?

Select 3 answers
A.Use update sets to move the application to production.
B.Publish the application to the ServiceNow Store for deployment.
C.Test the application thoroughly in a sub-production instance before deployment.
D.Export the application as a scoped application archive (.snc) file.
E.Ensure all application dependencies are included in the export.
AnswersC, D, E

Testing in a non-production environment is critical.

Why this answer

Testing in a sub-production instance (e.g., development or test instance) is a fundamental best practice to validate application functionality, identify defects, and ensure stability before deploying to production. ServiceNow Studio integrates with update sets and scoped applications, but thorough testing in an isolated environment prevents disruptions to live services and data.

Exam trap

The trap here is that candidates may confuse update sets (which are suitable for platform customizations but not for scoped applications) with the recommended deployment method for Studio-created applications, or mistakenly think the ServiceNow Store is a valid internal deployment target.

Full explanation →
68
MCQeasy

What is the primary purpose of the 'Theme and Branding' module in Service Portal?

A.To create custom widgets
B.To define global visual styles like colors and fonts
C.To manage portal page layouts
D.To configure portal security settings
AnswerB

Correct: Theme and Branding controls the portal's look and feel.

Why this answer

The Theme and Branding module allows administrators to define global styles such as colors, fonts, and logos that apply across all portal pages.

Full explanation →
69
Multi-Selecthard

Which THREE factors can negatively impact the performance of a ServiceNow form?

Select 3 answers
A.Large client script files (e.g., 100KB+).
B.Synchronous Ajax calls in client scripts.
C.A large number of UI Policies on the form.
D.Many tabs (sections) on the form.
E.Use of AngularJS directives in the form.
AnswersA, B, C

Large scripts increase download time and parsing overhead.

Why this answer

Options A, B, and C are correct. Multiple UI Policies increase server load and client-side processing. Synchronous Ajax calls block the UI until they complete.

Large client script files increase download time and parsing. Option D is wrong because the number of tabs does not significantly impact performance. Option E is wrong because AngularJS directives, when used properly, are not a performance issue.

Full explanation →
70
MCQeasy

A company has a ServiceNow instance integrated with a third-party ticket management system. The integration runs every hour via a scheduled job that calls a REST API to fetch new tickets and create incidents in ServiceNow. The administrator notices that some incidents are being created as duplicates. Investigation reveals that the third-party system sometimes returns the same ticket in multiple API calls due to caching. The scheduled job does not check for existing incidents before creating new ones. The administrator needs to modify the integration to prevent duplicate incidents without relying on the third-party system to change its behavior. Which action should the administrator take?

A.Add a check in the integration script to query the incident table for an existing incident with the same external ticket ID before creating a new one.
B.Modify the integration to only create incidents if the ticket status is 'New'.
C.Increase the scheduled job interval to run every 2 hours.
D.Add a post-processing script that deletes duplicate incidents after each run.
AnswerA

This ensures that duplicates are prevented at creation time by checking a unique external ID field.

Why this answer

The most reliable way to prevent duplicates is to check the incident table for an existing record with the same external ticket ID before creating a new incident. This leverages the unique identifier from the third-party system and avoids relying on the third-party's caching behavior. By querying the incident table using a GlideRecord lookup on a field that stores the external ID, the script can conditionally skip creation if a match is found.

Exam trap

The trap here is that candidates might choose Option D (delete duplicates after creation) because it seems like a quick fix, but the SNOW-CAD exam emphasizes preventing errors at the point of data entry rather than relying on post-processing cleanup, which can lead to data inconsistency and performance issues.

How to eliminate wrong answers

Option B is wrong because filtering by ticket status 'New' does not address the root cause of duplicate incidents from repeated API responses; the same ticket could be returned with a 'New' status multiple times due to caching. Option C is wrong because increasing the interval to 2 hours only reduces the frequency of duplicate creation but does not eliminate it; the third-party system could still return the same ticket in consecutive runs. Option D is wrong because deleting duplicates after creation is inefficient, introduces a race condition where users might see duplicates temporarily, and violates the principle of preventing errors rather than cleaning them up.

Full explanation →
71
MCQhard

A ServiceNow instance integrates with an external HR system via REST. The integration retrieves employee records and updates the 'sys_user' table. Recently, the integration started failing with '403 Forbidden' errors. The REST API endpoint and authentication credentials have not changed. Which action should the administrator take first to resolve the issue?

A.Review the inbound REST message configuration for rate limiting settings.
B.Reset the password for the integration user in the external system.
C.Check the Access Control List (ACL) rules on the sys_user table for the integration user.
D.Verify the REST API endpoint URL in the integration record.
AnswerC

A 403 error indicates forbidden access; ACLs or user permissions are the most common cause.

Why this answer

A 403 Forbidden error indicates that the server understood the request but is refusing to authorize it. Since the REST endpoint and credentials haven't changed, the most likely cause is that the integration user's access rights within ServiceNow have been altered, specifically the Access Control List (ACL) rules on the 'sys_user' table. The administrator should first check these ACLs to ensure the integration user still has the necessary read/write permissions.

Exam trap

The trap here is confusing a 403 Forbidden with a 401 Unauthorized or a connectivity issue, leading candidates to focus on credentials or endpoint URLs instead of the authorization layer within ServiceNow's ACLs.

How to eliminate wrong answers

Option A is wrong because rate limiting typically returns a 429 (Too Many Requests) or 503 (Service Unavailable) status, not a 403 Forbidden. Option B is wrong because the authentication credentials have not changed, and resetting the password in the external system would not resolve a permission issue within ServiceNow's own ACLs. Option D is wrong because the REST API endpoint URL has not changed, and verifying it would not address a 403 error that indicates an authorization failure, not a routing or connectivity problem.

Full explanation →
72
MCQmedium

Refer to the exhibit. A developer is making a REST API call to create an incident. The call returns a 201 Created response, but the incident record is not visible in the instance. What is the most likely cause?

A.The 'caller_id' sys_id is invalid or points to a non-existent user.
B.The request method should be PUT instead of POST.
C.The field 'short_description' is misspelled.
D.The instance has an ACL that prevents creating incidents via REST.
AnswerA

An invalid sys_id can cause the record to be created without proper assignment, possibly hidden.

Why this answer

A 201 Created response indicates the REST API call was syntactically correct and the server accepted the payload, but the incident record is not visible. The most likely cause is an invalid caller_id sys_id, because ServiceNow validates the caller_id field against the sys_user table during record creation. If the sys_id does not exist or is malformed, the record is created but the caller_id reference fails silently, often causing the record to be hidden from standard views or filtered out by default queries.

Exam trap

The trap here is that candidates assume a 201 Created response guarantees the record is fully functional and visible, but ServiceNow's reference validation can silently fail, leaving the record orphaned and hidden from standard views.

How to eliminate wrong answers

Option B is wrong because PUT is used for updates or upserts, not for creating new records; POST is the correct HTTP method for creating a new incident via REST API. Option C is wrong because a misspelled field name like 'short_description' would cause a 400 Bad Request or a field validation error, not a 201 Created response. Option D is wrong because if an ACL prevented creating incidents via REST, the API call would return a 403 Forbidden or 401 Unauthorized error, not a 201 Created.

Full explanation →
73
MCQhard

In a multi-instance environment, an organization wants to integrate ServiceNow with an on-premise database using JDBC. Which feature is used to establish this connection?

A.REST API
B.Import Set
C.External Data Sources
D.SOAP Web Service
AnswerC

Correct: External Data Sources provide JDBC connectivity to external databases.

Why this answer

External Data Sources are specifically designed to connect ServiceNow to external databases via JDBC, enabling data synchronization.

Full explanation →
74
MCQmedium

An application scope includes a Business Rule that runs on the 'before' operation of the Incident table. It attempts to set the 'assignment_group' based on the caller's company. However, the assignment is not being applied. Which is the most likely cause?

A.The Business Rule is set to 'async' which delays execution
B.The script uses 'current.assignment_group = something' without calling setValue
C.The Business Rule is set to run on 'display' instead of 'update'
D.The field 'assignment_group' is not in the current scope's accessible table columns due to cross-scope privilege
AnswerD

Correct; if the Business Rule is in a scoped application and the Incident table belongs to the global scope, the scoped app may not have write access to the field unless an access grant is defined.

Why this answer

In ServiceNow, cross-scope privilege restrictions prevent a scoped application from accessing or modifying columns in the Incident table that are not explicitly granted via the application's scope. Even though the Business Rule runs on the 'before' operation, if the 'assignment_group' field is not in the application's accessible table columns, the assignment will silently fail. This is a common issue when a scoped application attempts to interact with global table fields without proper cross-scope access.

Exam trap

The trap here is that candidates often assume the issue is a scripting syntax error (like Option B) or a timing problem (like Option A), but ServiceNow's cross-scope security model silently blocks field writes without explicit privilege, making it the most likely cause when a scoped application's Business Rule fails to update a global field.

How to eliminate wrong answers

Option A is wrong because setting a Business Rule to 'async' delays execution to a background queue, but it does not prevent the assignment from being applied; the assignment would still occur asynchronously. Option B is wrong because using 'current.assignment_group = something' is a valid way to set a field value in a 'before' Business Rule, as it directly modifies the current record in memory without needing setValue. Option C is wrong because a Business Rule set to run on 'display' only triggers when the record is viewed, not on update, so it would not affect the assignment during an update operation; however, the question states the rule runs on 'before' operation, so this is not the issue.

Full explanation →
75
MCQhard

A developer is implementing a custom integration using the ServiceNow REST API Explorer. The endpoint requires an API key in the header. Which approach should be used to secure the API key?

A.Create an authentication profile of type 'API Key' and reference it in the REST message.
B.Hardcode the API key in the script.
C.Store the API key in a system property encrypted.
D.Use a REST message variable and set the header directly.
AnswerA

Auth profiles securely store credentials and can be referenced without exposing the key.

Why this answer

The ServiceNow REST API Explorer and REST messages support authentication profiles, which securely store and manage API keys. By creating an 'API Key' authentication profile and referencing it in the REST message, the API key is automatically injected into the request header without exposing it in scripts or system properties. This approach follows ServiceNow best practices for credential management and ensures the key is encrypted and centrally managed.

Exam trap

The trap here is that candidates may think storing the API key in an encrypted system property (Option C) is sufficient, but they overlook that the key still needs to be retrieved and injected into the header via script, which is less secure and not the recommended ServiceNow pattern for REST message integrations.

How to eliminate wrong answers

Option B is wrong because hardcoding the API key in a script exposes it in plain text within the application code, violating security best practices and making it difficult to rotate or audit. Option C is wrong because storing the API key in an encrypted system property still requires the script to retrieve and inject it into the header manually, which is less secure and more error-prone than using a dedicated authentication profile. Option D is wrong because using a REST message variable and setting the header directly in the script bypasses the built-in authentication profile framework, leading to potential exposure of the key in script logs or code reviews.

Full explanation →

Page 1 of 7

Page 2

All pages

1234567

Practice SNOW-CAD by domain

Target a specific domain to shore up weak areas.

Working with DataPlatform Features and IntegrationIntegrating and managing application dataAutomating application logic with business rules and scriptsApplication development using ServiceNow StudioCreating and customizing tables and dataDesigning interfaces and user experiencesCore Application DevelopmentUser Interface Development
See all domains with question counts →