Incident Management practice questions

Service Level Agreement Engine

Why it fails: The SLA engine tracks breach times, not multi-CI relational task generation.

Data Lookup Definitions

Why it fails: Data lookups map table field values, not child task creation.

Incident Templates

Why it fails: Templates populate static field values, not dynamic relational loops.

Outbound REST Message

Why it fails: REST messages handle third-party integrations, not internal record creation logic.

Audit Log History (sys_audit)

Why it fails: Sys_audit tracks all changes, but it is not a dedicated reporting field on the incident form.

Metric Definition (Metrics)

Why it fails: While metrics can track assignment group durations, the task table has a native field specifically for reassignments.

SLA Breach Counter

Why it fails: SLA breach counters track time targets, not assignment transfers.

Dictionary Overrides

Why it fails: Dictionary overrides adjust field attributes across tables, but UI policies handle dynamic form-level mandatory rules.

Access Control Lists (ACLs)

Why it fails: ACLs control security read/write/create/delete permissions, not field requirement states.

Assignment Rules

Why it fails: Assignment rules handle group routing, not form field validation.

Parent and child incidents must always have identical priority values.

Why it fails: Parent and child priorities are independent.

Child incidents automatically inherit the assignment group of the parent upon creation only.

Why it fails: Parent-child links do not automatically sync assignment groups unless custom logic or specific cascading rules are built.

Child incidents must be manually closed one by one before the parent can close.

Why it fails: Manual closure of every child is not required; parent-to-child cascading handles this.

It triggers an automatic change request to deploy the fix to production.

Why it fails: Creating a known error article does not generate a change request.

It removes the incident-to-problem relationship and creates a parent-child incident hierarchy.

Why it fails: It maintains the problem relationship and shares documentation via knowledge management.

It automatically closes all active incidents matching the problem category.

Why it fails: Known errors do not auto-close incidents; they provide workarounds.

Deleting the original incident and recreating it on the Major Incident table.

Why it fails: Deleting and recreating the record loses the original incident number, audit history and SLA attachments, and bypasses the escalation mechanism entirely. It is tempting because it appears to move the incident onto the Major Incident table, and would be correct only when a record was created in error and needs full replacement.

Modifying the Data Policy table definitions.

Why it fails: Data Policies enforce mandatory field values and read-only rules at the UI layer; they cannot invoke the escalation logic that sets the Major Incident state. It is tempting because Data Policies do govern field-level behaviour across forms, and would be correct when enforcing data consistency on incident fields rather than escalating an incident.

Modifying the dictionary override for the priority field.

Why it fails: A dictionary override merely changes how the priority field is labelled or defaulted; it cannot trigger the Major Incident escalation workflow that promotes an incident to the major_incident_state. It is tempting because dictionary entries do control field behaviour, and would be correct when customising a field's attributes rather than escalating records.

Configuration item

Why it fails: Configuration item (CI) is optional out of the box.

Work notes

Why it fails: Work notes are optional upon creation.

Assignment group

Why it fails: Assignment group is not mandatory upon creation out of the box.

System Definition > Dictionary > Incident > Priority

Why it fails: The dictionary entry for priority defines the choices, not the lookup matrix mapping impact and urgency to priority.

Incident > Administration > Priority Matrix

Why it fails: There is no Incident Administration module named Priority Matrix.

Service Level Management > SLA > Priority Calculation

Why it fails: SLAs calculate response and resolution times, not the incident priority matrix.

Data Lookup Definitions

Why it fails: Data lookup definitions are used primarily for matching fields like priority, not for assigning users based on assignment groups.

SLas definition conditions

Why it fails: SLA definitions control breach timers and stages, not user assignment logic.

Business Services Management

Why it fails: BSM is used to map relationships between CIs and services, not for group-level routing.

Access Control Lists (ACLs)

Why it fails: ACLs control read, write, create, and delete security permissions at the row and column level, not field-level mandatory validation.

Workflow Engine

Why it fails: Workflows drive overall process flow stages, but field mandatoriness on state changes is handled by UI Policies/Client Scripts.

Dictionary Overrides

Why it fails: Dictionary overrides change field attributes for extended tables, not conditional mandatory states upon closure.

Configure a Data Policy from Problem to Incident

Why it fails: Data policies enforce mandatory rules during web service and import set transactions, not for creating related task records.

Write a custom database trigger

Why it fails: Database triggers are not best practice or necessary for linking tasks in ServiceNow.

Manually populate the Parent incident field on the Problem form

Why it fails: Problems are peer tasks to incidents, not child tasks with a 'Parent incident' field relationship.

Global Incident Synchronizer

Why it fails: This is a distractor feature that does not exist in ServiceNow ITSM.

Push Updates Business Rule

Why it fails: This is a generic concept, not the specific UI feature used for problem-to-incident workaround communication.

Broadcast Incident Action

Why it fails: Broadcast is used for notifying via Workspace/Connect, not for pushing problem workarounds.

Assigned to user mandatory script

Why it fails: Assignee scripts are not components of an SLA definition record.

Workflow

Why it fails: Workflows are optional for SLAs; modern SLAs often use SLA Automations rather than legacy workflows.

The caller of the incident is automatically granted admin access.

Why it fails: Promoting a major incident does not alter the caller's system security roles.

All associated child incidents are automatically closed.

Why it fails: Child incidents are linked, but not automatically closed; they usually remain open until the major incident is resolved.

The priority of the incident is automatically downgraded to Low.

Why it fails: Major incidents typically retain or have their priority escalated to Critical/High, never downgraded.

Automatic assignment to the Service Desk manager.

Why it fails: Assignment is determined by assignment rules, not by the status change itself.

Automatic closure of all related incidents.

Why it fails: Related incidents are typically linked, not closed automatically.

The CI record lacks an 'Assigned To' field.

Why it fails: The CI record's 'Assigned To' field is unrelated to incident state transitions; assignment group population drives routing, not state. CI assignment is tempting because CI data feeds incident fields, but the state change depends on the incident's own business rules.

The 'Incident State' field does not have an 'In Progress' choice.

Why it fails: The Incident State field ships with 'In Progress' as a standard choice, so removing it is not the cause. A missing choice is tempting because invalid choice values do block state changes, but the actual cause is a business rule or workflow condition not firing.

The incident state is read-only for the system user.

Why it fails: State fields are not read-only for the system user; write access is governed by ACLs, and a system-created incident can still transition states. Read-only is tempting because ACL restrictions do block writes, but here the real cause is a missing state transition condition.

Create an Assignment Rule to update the state.

Why it fails: Assignment rules only handle routing and assigning, not state updates.

Configure a SLA Definition to trigger resolution.

Why it fails: SLAs measure time, they do not automate state transitions for incident workflows.

Set up a Flow Designer flow to execute a client-side script.

Why it fails: Flow Designer is server-side and cannot execute client-side scripts directly.

A scheduled job that checks for incident volume.

Why it fails: This is not a standard out-of-the-box trigger mechanism.

Via a direct integration with the CMDB.

Why it fails: CMDB interactions are not a direct trigger for the major incident workflow.

Business Rule on the Incident table

Why it fails: While possible, the provided UI action is the built-in standard method.

Flow Designer trigger on Incident table

Why it fails: This would require custom configuration instead of using standard ITSM features.

Scheduled Job

Why it fails: Scheduled jobs are not event-driven for incident resolution.

To hide fields from the end user

Why it fails: UI Policies or Catalog Client Scripts hide fields, not the Record Producer script.

To trigger an email notification

Why it fails: Notifications are handled by the Notification engine, not the producer script.

To define the Incident assignment group

Why it fails: Assignment groups are usually set via standard assignment rules.