ServiceNow Certified Application Developer CAD (SNOW-CAD) — Questions 226–300

Using the Global CSS and Theme system allows customizations in a dedicated module that survives upgrades, unlike direct modifications of system CSS.

A record-level ACL with a condition that checks group membership is the correct approach because it controls read access to the entire record based on the user's group membership. In ServiceNow, record-level ACLs evaluate conditions against the user's session and the record's data, and if the condition (e.g., 'member of ITIL group') is false, the record is hidden from the user entirely. This directly meets the requirement to restrict read access to a specific incident record for only the 'ITIL' group.

Business rules in ServiceNow can be triggered by database operations such as Insert and Update. These are the core 'when to run' conditions that fire the rule before or after a record is created or modified in the database. Options B and D are correct because they directly correspond to these fundamental database operations.

Option A is correct because client-callable script includes must have at least one function that returns a value. This is required because the GlideAjax API processes the response asynchronously and expects a return value to be sent back to the client via the callback function. Without a return value, the client-side callback would receive undefined or null, breaking the intended data flow.

The synchronous HTTP request blocks the script until the response is received. With high concurrency, this leads to thread starvation and timeouts. The best solution is to use asynchronous HTTP requests and handle the response via a queue or event mechanism, freeing the script to process other requests.

The script uses getValue('urgent') but the actual field name is 'u_urgent' as per the condition (UI Policy condition uses 'Urgent' which maps to 'u_urgent' in the database). The mismatch causes the script to not trigger properly.

Setting the Order field on a business rule controls the sequence in which multiple business rules execute on the same table and event. This is critical when rules have dependencies, ensuring that prerequisite logic (e.g., data validation) runs before subsequent logic (e.g., field updates). Without explicit ordering, execution order is undefined and may vary between instances.

Option B is correct because the 'HTTP Headers' tab in a REST message definition allows you to define custom headers that are automatically included in every request sent to that endpoint. This is the standard location for headers like 'X-API-Key' that must accompany all calls, as they are part of the HTTP request metadata, not query parameters or authentication credentials.

The client script attempts to call a Script Include named 'TaskTypeAjax' from the client side. By default, Script Includes are not accessible from client scripts unless the 'Client callable' checkbox is enabled in the Script Include record. Since the script is failing to update the assigned-to field, the most likely cause is that 'TaskTypeAjax' is not marked as client-callable, preventing the GlideAjax request from executing successfully.

Option B is correct because it uses `addEncodedQuery` with an encoded query string that combines both conditions (`priority=1^active=true`) into a single query, which is the standard approach for filtering records in a scheduled job. The `GlideRecord` object is properly instantiated and the query is executed with `gr.query()`, ensuring only incidents matching both criteria are retrieved for update.

The sequence: navigate to Local Update Sets, create new, provide details, set state to In Progress, and submit.

The error occurs because the sysparm_query parameter in a REST API call to the /api/now/table/sys_user endpoint does not support scripts; it only accepts encoded query strings using operators like '=', '^', 'STARTSWITH', etc. Using a script in sysparm_query violates the REST API specification, which expects a simple query string, not executable code, leading to a bad request error.

These are core Glide APIs used in ServiceNow scripting.

Option A is correct because `current.setAbortAction(true)` must be called in a Business Rule that runs before the database operation (e.g., 'before' or 'before query' order). If the Business Rule runs 'after' the database operation, the record has already been committed to the database, so aborting the action has no effect on the save. The abort flag only prevents the pending database write; once the write is complete, the flag is irrelevant.

Option C is correct because changesTo('Work in Progress') triggers when the field changes to that specific value. Option A triggers on any change, B triggers when changing from a value, and D checks current and previous values incorrectly.

Option B is correct because a Reference field is designed to create a link from one table to another, storing the sys_id of the target record. Since 'u_approval' needs to point to a specific record in the 'sysapproval_approver' table, a Reference field with the reference table set to 'sysapproval_approver' is the appropriate method. This ensures referential integrity and allows the platform to resolve display values and enforce relationships.

Option D is correct because UI policies have a 'Run on desktop' and 'Run on mobile' checkbox. By default, a new UI policy is set to run on desktop only. If the developer did not explicitly check the 'Run on mobile' option, the policy will not execute on the mobile app, causing the mandatory behavior to be absent on mobile while working on desktop.

Option B is correct because in Flow Designer, the dot-walking syntax `trigger.caller.manager.email` navigates from the incident record's caller field to the user record, then to the manager reference field (which is a sys_user record), and finally retrieves the email attribute of that manager's user record. This directly accesses the caller's manager's email address without needing an intermediate lookup.

Option A is correct because a business rule runs server-side when a record is updated and can enforce the validation before the update occurs. Client scripts and UI policies are client-side and can be bypassed. ACLs are for access control, not validation.

The Data Table widget with inline editing allows users to edit records in a grid format, which is the intended solution for bulk editing in the portal.

Option B is correct because a UI Policy with the condition 'Priority changes' triggers an action script when the priority field is modified, allowing the use of `g_form.showFieldMsg()` to display an inline warning message on the field. Option E is correct because an onChange client script fires when the 'priority' field changes, and within it you can check `newValue` against '1 - Critical' and call `g_form.showFieldMsg()` to show the warning. Both are client-side implementations that respond to field changes without a server round-trip.

B is correct because `GlideRecord.addEncodedQuery()` allows you to pass an encoded query string that can include OR conditions using the `^OR` operator. This method is a direct way to construct complex queries with OR logic without chaining multiple method calls. D is correct because `GlideRecord.addOrCondition()` explicitly adds an OR condition to the current query, typically used after an initial `addQuery()` call.

In ServiceNow, when a GlideRecord query is used in an 'after' business rule to update records on another table, the changes are not automatically committed. The developer must explicitly call gr.updateMultiple() to persist updates to multiple records, or gr.update() for a single record. Option B correctly identifies this requirement, as the update is not being committed without an explicit method call.

Option C is correct because the Business Rule debug tool allows stepping through execution and inspecting variables. Option A logging is less efficient. Options B and D require development environment setup.

Option C is correct because the 'Ref qual' (Reference qualifier) property on a reference variable allows you to specify a condition to filter the records displayed in the lookup. Setting it to 'active=true' restricts the reference field to show only active users from the sys_user table, ensuring the developer meets the requirement.

The condition should check if the update did not originate from a web service. The method 'gs.getUser().isWebService()' returns true if the current user is a web service user.

Option A is correct because setting a default value on the 'state' field to 'Open' ensures that whenever a new record is created in the 'u_project_risk' table, the field automatically populates with 'Open' without requiring any script or business rule. This is a declarative, low-code approach that leverages the platform's built-in default value functionality at the field level, guaranteeing the requirement is met even if the record is created via web services or import sets.

Database Views in ServiceNow are virtual tables that combine data from one or more tables without storing the data physically. They are primarily used for reporting and data analysis, allowing you to join multiple tables and present a unified dataset. Option D is correct because Database Views are specifically designed to join multiple tables for reporting, enabling complex queries across related records.

Option C is correct because a Business Rule that runs on the 'update' operation of the 'u_asset' table can directly query and update all related 'u_asset_software' records using GlideRecord. This server-side logic ensures the location change is propagated reliably, regardless of how the asset record is updated (UI, web service, import set, etc.), and it executes within the same database transaction for data consistency.

Option B is correct because the client credentials grant flow requires a direct token request endpoint URL where the client sends its credentials (client ID and secret) to obtain an access token. IntegrationHub must be configured with this specific endpoint to complete the OAuth 2.0 handshake, as the grant type does not involve user interaction or discovery endpoints.

Option D is correct because in a 'before' business rule, calling `current.setAbortAction(true)` prevents the database operation from completing and displays the error message specified in `gs.addErrorMessage()`. When the state changes from '2' to '1', the script checks for this condition and aborts the save, showing 'State change is not allowed'. This is a standard pattern for enforcing state transition restrictions in ServiceNow.

The performance bottleneck is the database query that joins the large 'u_project_task' table (2M records) with the 'u_project' table on the reference field. Without an index on the 'u_project' field in 'u_project_task', the database must perform a full table scan for each related list query. Creating a database index on that foreign key column allows the database to use an index seek, dramatically reducing query time.

In ServiceNow widget server scripts, the function signature must include the parameters (options, data) to access the data object that is passed to the client script. Without these parameters, the data variable is undefined, causing data.count to display 'undefined'. The script likely defines the function without parameters or with incorrect ones, so the data object is not available.

Option B is correct because extending a new table directly from sys_db_object creates a base table that automatically inherits the core system fields (sys_id, sys_created_by, etc.) and supports extensibility for future sub-tables. This is the standard approach in ServiceNow for creating custom tables that are not tied to any specific application or business logic, ensuring maximum flexibility and adherence to platform best practices.

The changesFrom() and changesTo() methods are the recommended approach for checking field transitions. Options A and D use direct comparison but are less efficient. Option C only checks that state changed, not the specific transition.

When a Script Include is invoked from a Service Portal widget via a processor, the processor's constructor runs automatically. If no 'sysparm_name' parameter is passed, the processor does not know which method to call, so only the constructor executes. The constructor typically initializes properties but does not return data, resulting in no output.

Basic Auth is a valid authentication option for Scripted REST APIs in ServiceNow because it allows the API to authenticate requests using a username and password pair encoded in the Authorization header. ServiceNow natively supports Basic Auth for inbound REST calls, making it a straightforward choice for legacy or simple integrations.

A Business Rule that runs on 'insert' and 'update' on the parent table will not fire when a child record is deleted, because the delete event occurs on the child table, not the parent. To correctly update an aggregate field on the parent when child records are deleted, the Business Rule must be defined on the child table's 'delete' event. This ensures the rule executes when the child record is removed, allowing the aggregate to be recalculated.

ServiceNow provides two dedicated data types for storing date and time values: 'Date' for calendar dates without time, and 'Date/Time' for combined date and time values. These are the correct choices because they directly map to the platform's field types used in tables like Task and Incident for tracking creation and due dates.

Option C is correct because the business rule in the global scope cannot access a script include restricted to 'This application only'. Changing 'Accessible from' to 'All application scopes' allows the global-scope business rule to invoke the script include, as cross-scope access is controlled by this property. The 'Client callable' setting is irrelevant for server-side business rules.

The 'On Load' catalog client script triggers when the form loads, but GlideAjax makes an asynchronous call to the server. The script continues executing without waiting for the response, so the cost center variable remains empty until the callback fires. Since the callback updates the field asynchronously, the field appears empty on load because the response hasn't arrived yet.

Import Sets are the correct ServiceNow module for importing data from a CSV file into a custom table. They provide a structured pipeline that maps CSV columns to table fields, with staging tables for validation before final insertion. This is the standard approach for one-time or recurring data imports in ServiceNow.

Modifying Bootstrap CSS directly is not upgrade-safe. Overwriting widget CSS via instance options is not a global theming approach. The correct methods are using the Theme and Branding module and applying custom LESS files.

An HTML template is required because it defines the structure and layout of the widget's user interface. In Service Portal, the HTML template uses AngularJS directives to bind data from the server script and client controller, enabling dynamic rendering of table records.

The most likely cause is that the SOAP message is missing a mandatory field, causing the insert to fail validation. The SOAP web service processes the request and if a required field is omitted, the insert is rejected.

Before query business rules in ServiceNow are executed during the retrieval of records from the database, and they are strictly read-only. They cannot perform updates, inserts, or deletes because the database operation is not yet complete. Attempting to call current.update() within a before query business rule will be ignored or cause an error, which is why the reassignment never occurs.

Option D is correct because a Script Include used as a REST API endpoint must either extend the appropriate class (such as 'RESTAPI' or 'RESTAPIV2') or be explicitly marked as a REST API endpoint in its definition. Without this, the platform does not recognize it as a valid endpoint, resulting in an empty response when the API is called.

Option C is correct because ServiceNow does not have a built-in auto-increment field type, so a business rule must be used to generate a sequential asset tag. The script typically queries the table for the maximum existing number, increments it, and prepends the prefix (e.g., 'AST-0001'). This ensures uniqueness and proper sequencing without relying on sys_id, which is not sequential.

Notifications can be delivered through various channels.

Option A is correct because in ServiceNow Studio, the proper workflow to add a new table to an existing scoped application is to open Studio, select the application, click 'Create Application File', choose 'Table', and then define the table. This ensures the table is created within the application scope, maintaining proper application isolation and metadata association.

Option D is correct because ServiceNow Studio provides a native 'Scheduled Jobs' module that allows developers to create and manage recurring server-side scripts directly within the IDE. This approach leverages the platform's job scheduler, which runs on the node's clock and integrates with the glide system, ensuring reliable hourly execution without external dependencies or performance overhead from transactional triggers.

Option B is correct because the Service Portal login page can be customized by overriding the 'Login' page in the portal record. This is done by creating a new page (e.g., a copy of the default login page) and setting it as the login page in the portal's configuration, which allows full control over the layout and widgets used. Option D is correct because CSS variables defined in the portal's theme (SCSS) can be used to style login page elements, as the theme's SCSS is compiled and applied globally to all portal pages, including the login page.