SNOW-CSA Reporting, SLA and Imports Practice Question
A manager requests a report showing the average time to resolve incidents, grouped by assignment group, for the last month. The administrator creates a report on the Incident table using a bar chart with a 'Group By' on Assignment group and a 'Aggregate' on Resolved time (duration). The report displays an average that seems too low. Upon investigation, the administrator notices that incidents with very long resolution times (e.g., over 30 days) are not included in the report. The report filter is set to 'Active = false' and 'Resolved time is not empty'. The administrator suspects the time filter is incorrect. What is the most likely cause of the missing long-duration incidents?
⚠ Common exam trap
Many exam-takers assume the time filter automatically applies to the resolution date when the report is about resolved incidents, but ServiceNow defaults to the 'Created' date unless explicitly changed, causing older resolved incidents to be missed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The report uses a relative time filter that filters on the 'Created' date instead of the 'Resolved' date, excluding older incidents that were resolved in the last month.
The report uses a relative time filter that defaults to filtering on the 'Created' date rather than the 'Resolved' date. This means only incidents created within the last month are considered, even if they were resolved later. Incidents with very long resolution times (e.g., over 30 days) that were created before the filter window but resolved in the last month are excluded, causing the average to appear too low.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The average calculation is using median instead of mean.
Why it's wrong here
Using median would affect the average value but would not exclude records.
- ✗
The report is based on a saved search that excludes incidents with 'Closed' state.
Why it's wrong here
Incidents that are resolved but not yet closed are included; the filter already captures resolved incidents.
- ✗
The report filter excludes incidents with state 'Resolved'.
Why it's wrong here
The filter already includes resolved incidents via 'Resolved time is not empty'.
- ✓
The report uses a relative time filter that filters on the 'Created' date instead of the 'Resolved' date, excluding older incidents that were resolved in the last month.
Why this is correct
Relative time filters default to the current date; if set to 'Created' in last month, it misses incidents created earlier but resolved recently.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SNOW-CSA question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.