How to Calculate SLA Breach Time with a Business Schedule in ServiceNow
An admin has set up an SLA on the Incident table with a condition 'Priority = 1' and a duration of 1 hour. The SLA is triggered when the incident state becomes 'In Progress'. The SLA definition includes a business schedule that only counts business hours (9 AM to 5 PM, Monday-Friday). An incident with Priority 1 is created at 4:30 PM on Friday and state is changed to 'In Progress' at 4:45 PM. At what time will the SLA breach if it is not resolved?
Quick Answer
The answer is 9:45 AM Monday. This is correct because the SLA breach time calculation with a business schedule in ServiceNow only counts time within the defined schedule—9 AM to 5 PM, Monday through Friday. The incident entered 'In Progress' at 4:45 PM on Friday, leaving only 15 minutes of the 1-hour SLA duration before the schedule closes at 5 PM; the remaining 45 minutes must be fulfilled starting Monday at 9 AM, pushing the breach to 9:45 AM. On the ServiceNow Certified System Administrator CSA exam, this tests your understanding of how business schedules pause and resume SLA timers, a common trap where candidates forget to subtract the elapsed business time from the total duration. A helpful memory tip: think of the business schedule as a “time bank” that only opens during working hours—always calculate the remaining minutes after the schedule closes, then add them to the next opening time.
⚠ Common exam trap
The trap here is that candidates forget to account for the partial business hour consumed on Friday and instead assume the entire SLA duration starts fresh on Monday, leading them to pick 4:45 PM Monday.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
9:45 AM Monday.
The SLA has a duration of 1 hour but uses a business schedule that only counts hours between 9 AM and 5 PM, Monday through Friday. The incident entered 'In Progress' at 4:45 PM on Friday, so only 15 minutes of business time remain that day (4:45 PM to 5:00 PM). The remaining 45 minutes of SLA duration must be fulfilled starting Monday at 9:00 AM, pushing the breach time to 9:45 AM Monday.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
9:45 AM Monday.
Why this is correct
Correct calculation based on business hours.
- ✗
5:45 PM Friday.
Why it's wrong here
This ignores the business schedule and assumes 24/7 counting.
- ✗
4:45 PM Saturday.
Why it's wrong here
The schedule does not include weekends.
- ✗
4:45 PM Monday.
Why it's wrong here
This would be if the full hour was counted from Monday start, but only 45 minutes remain.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SNOW-CSA question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SNOW-CSA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization has a Service Level Agreement (SLA) defined on the Incident table with a condition of 'Category is Network' and a duration of 4 hours. The SLA is triggered when the incident state changes from 'New' to 'In Progress'. A network incident is created and assigned to the Network Support group. The incident state is changed to 'In Progress' immediately. After 3 hours, the incident is resolved. However, the SLA shows a breach despite the resolution being within 4 hours. What is the most likely cause?
hard- ✓ A.The SLA stop condition is set to 'State is Resolved', but the SLA was paused due to a schedule (e.g., after-hours pause) and the pause time was not counted, causing the actual working time to exceed 4 hours.
- B.The SLA is assigned to the Network Support group, but the assignment group was changed during the incident.
- C.The SLA duration is defined in business hours, and the incident was created after business hours, so the elapsed time counted only business hours, making the 4-hour window longer in real time.
- D.The SLA condition 'Category is Network' was not evaluated correctly because the category field was updated after the SLA was triggered.
Why A: The most likely cause is that the SLA stop condition is set to 'State is Resolved', but the SLA timer was paused due to a schedule (e.g., after-hours) at the time the incident was resolved. Because the timer was paused, the stop condition was not evaluated immediately. When the schedule resumed, the working timer continued to run, and by the time the stop condition was evaluated, the accumulated working time had already exceeded the 4-hour duration, resulting in a breach. In ServiceNow, SLA timers that are paused do not trigger stop conditions until they resume, which can cause breaches even when the incident is resolved within the expected real-time window.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.