ServiceNow CAD Practice Test 1
Question 1
A team wants easier maintenance for standard event-driven notifications. Testing exposes this failure: Handcoded email in every rule can produce duplicate sends and poor auditability. Which remediation should be applied FIRST?
- Copy SMTP credentials into a Business Rule to send mail independently of platform notifications.
- Configure inbound action matching to distinguish new and reply cases and test reference correlation.
- Configure an inbound email action or supported inbound processing with identity and record matching.
- Refactor eligible email behavior into a registered event and notification.
Explanation
Correct Answer
D:Refactor eligible email behavior into a registered event and notification. Confirmation requires seeing that email generation follows the configured notification with separately testable triggers.
Incorrect Answers
A:Copy SMTP credentials into a Business Rule to send mail independently of platform notifications. This retains the Event-driven email versus synchronous code problem. Event and notification configuration separates business events from message formatting.
B:Configure inbound action matching to distinguish new and reply cases and test reference correlation. It addresses Inbound email creation versus reply, not the diagnosed Event-driven email versus synchronous code failure. Handcoded email in every rule can produce duplicate sends and poor auditability.
C:Configure an inbound email action or supported inbound processing with identity and record matching. It addresses Inbound email action parsing, not the diagnosed Event-driven email versus synchronous code failure. Handcoded email in every rule can produce duplicate sends and poor auditability.
Question 2
A team wants a separate menu module for urgent active requests. Select TWO statements that correctly combine the Filtered module navigation method with evidence or its governing principle.
- Assume a module filter grants permission to records otherwise blocked by ACLs.
- Adjust module active state and order settings in an approved application menu.
- Configure a list module with a tested filter appropriate to the user scenario.
- Configure a module of the correct list type targeting the table.
- Navigation opens a list restricted by the expected filter and ACLs.
Explanation
Correct Answers
C:Configure a list module with a tested filter appropriate to the user scenario. This is the intended action for Filtered module navigation.
E:Navigation opens a list restricted by the expected filter and ACLs. This is directly observable validation of the Filtered module navigation result.
Incorrect Answers
A:Assume a module filter grants permission to records otherwise blocked by ACLs. This is not part of a safe or effective Filtered module navigation design. A shared unfiltered list can confuse task routing and expose excessive metadata.
B:Adjust module active state and order settings in an approved application menu. This serves the different Active state and module ordering objective, not the selected Filtered module navigation plan. Module filters select record subsets but do not replace authorization.
D:Configure a module of the correct list type targeting the table. This serves the different List module target table objective, not the selected Filtered module navigation plan. Module filters select record subsets but do not replace authorization.
Question 3
A developer accidentally creates a script include outside the target application. Which approach BEST meets the requirement while respecting the system constraints?
- Configure permitted cross-scope table access and ACLs for the actual consumers.
- Assume the active browser tab always switches the ServiceNow application context automatically.
- Select the correct application context before saving artifacts.
- Configure script include accessibility and applicable caller restrictions with scoped interfaces.
Explanation
Correct Answer
C:Select the correct application context before saving artifacts. The active application determines ownership of many new configuration files. Verification should demonstrate that the resulting application file belongs to the intended app scope.
Incorrect Answers
A:Configure permitted cross-scope table access and ACLs for the actual consumers. This primarily addresses Cross-scope table application access, not the specific Application picker and context decision. Here, the active application determines ownership of many new configuration files.
B:Assume the active browser tab always switches the ServiceNow application context automatically. This is an unsafe or ineffective shortcut for Application picker and context. Making changes in the wrong scope complicates packaging and protection.
D:Configure script include accessibility and applicable caller restrictions with scoped interfaces. This primarily addresses Restricted cross-scope scripting, not the specific Application picker and context decision. Here, the active application determines ownership of many new configuration files.
Question 4
A sensitive configuration change needs an approval trail and rollback plan. Select TWO statements that correctly combine the Property change governance method with evidence or its governing principle.
- Allow anonymous form users to modify application properties directly.
- Put property changes under authorized change management and test expected effects.
- Store sensitive credentials in a supported secure credential mechanism and use properties for nonsecret settings.
- Reviewed before-and-after values and execution evidence match an approved change.
- Define a well-named application property with documented type, default and governance.
Explanation
Correct Answers
B:Put property changes under authorized change management and test expected effects. This is the intended action for Property change governance.
D:Reviewed before-and-after values and execution evidence match an approved change. This is directly observable validation of the Property change governance result.
Incorrect Answers
A:Allow anonymous form users to modify application properties directly. This is not part of a safe or effective Property change governance design. Uncontrolled edits can quietly reroute users or increase processing cost.
C:Store sensitive credentials in a supported secure credential mechanism and use properties for nonsecret settings. This serves the different Properties are not a secret vault objective, not the selected Property change governance plan. Configuration data can affect production behavior as seriously as code changes.
E:Define a well-named application property with documented type, default and governance. This serves the different Application properties for behavior toggles objective, not the selected Property change governance plan. Configuration data can affect production behavior as seriously as code changes.
Question 5
A developer must first stage data from an Excel worksheet before applying mappings. Select TWO statements that correctly combine the CSV file data source and import set method with evidence or its governing principle.
- Assume uploading CSV automatically creates perfectly validated final application records.
- Staged rows are visible and have not bypassed validation on the target table.
- Apply controlled transform validation such as an onBefore script and audit skipped rows.
- Mark a suitable unique field map as Coalesce and validate key uniqueness.
- Create an appropriate file data source and load rows to an import set staging table.
Explanation
Correct Answers
B:Staged rows are visible and have not bypassed validation on the target table. This is directly observable validation of the CSV file data source and import set result.
E:Create an appropriate file data source and load rows to an import set staging table. This is the intended action for CSV file data source and import set.
Incorrect Answers
A:Assume uploading CSV automatically creates perfectly validated final application records. This is not part of a safe or effective CSV file data source and import set design. Writing unvalidated file rows directly into business tables risks corruption.
C:Apply controlled transform validation such as an onBefore script and audit skipped rows. This serves the different Import reconciliation and onBefore rejection objective, not the selected CSV file data source and import set plan. Import sets separate incoming source data from application target records.
D:Mark a suitable unique field map as Coalesce and validate key uniqueness. This serves the different Coalesce for update versus insert objective, not the selected CSV file data source and import set plan. Import sets separate incoming source data from application target records.
Question 6
A saved loan needs a related audit record created after insert. A reviewer proposes this shortcut: Call current.update repeatedly inside an after rule without controlling recursion. Which principle BEST explains why a different solution is needed?
- After rules run after database operations and can react to persisted changes.
- Form views offer alternative presentations of the same table record.
- Display Business Rules can provide server-derived data to client form loading.
- Script Includes support reusable server-side JavaScript rather than copying logic across rules.
Explanation
Correct Answer
A:After rules run after database operations and can react to persisted changes. The appropriate approach is to use an after Business Rule for post-save related actions, avoiding recursion.
Incorrect Answers
B:Form views offer alternative presentations of the same table record. This is about Multiple form views by persona, not why the proposed After Business Rule related records shortcut should be rejected. Using an inappropriate before-rule dependency on a not-yet-saved sys_id can fail.
C:Display Business Rules can provide server-derived data to client form loading. This is about Display Business Rule and g_scratchpad, not why the proposed After Business Rule related records shortcut should be rejected. Using an inappropriate before-rule dependency on a not-yet-saved sys_id can fail.
D:Script Includes support reusable server-side JavaScript rather than copying logic across rules. This is about Script Include utility reuse, not why the proposed After Business Rule related records shortcut should be rejected. Using an inappropriate before-rule dependency on a not-yet-saved sys_id can fail.
Question 7
A form must calculate a permitted derived value before creating a target record. Testing exposes this failure: Using arbitrary client-side logic alone cannot guarantee target record invariants. Which remediation should be applied FIRST?
- Configure a Record Producer targeting the required app table and map its variables appropriately.
- Set and validate initial values in the supported producer creation context.
- Configure producer availability and enforce target table create/read ACLs.
- Edit a random unrelated table in the producer script instead of populating its target record.
Explanation
Correct Answer
B:Set and validate initial values in the supported producer creation context. Confirmation requires seeing that the new record has the intended initial values after submission.
Incorrect Answers
A:Configure a Record Producer targeting the required app table and map its variables appropriately. It addresses Record Producer creates app record, not the diagnosed Producer script for controlled assignment failure. Using arbitrary client-side logic alone cannot guarantee target record invariants.
C:Configure producer availability and enforce target table create/read ACLs. It addresses Record producer access and audience, not the diagnosed Producer script for controlled assignment failure. Using arbitrary client-side logic alone cannot guarantee target record invariants.
D:Edit a random unrelated table in the producer script instead of populating its target record. This retains the Producer script for controlled assignment problem. Producer scripting can set target record fields during record creation.
Question 8
An app should email the assigned approver using the record's identity rather than a fixed address. If the relevant Email recipients and templates safeguard is omitted, which outcome is the MOST directly associated failure?
- Too-broad triggers can spam users with messages on every update.
- Hardcoding an operational threshold in many scripts complicates controlled changes.
- Trusting any sender and subject can let outsiders alter unrelated records.
- Hardcoded recipient strings can route sensitive records to the wrong person.
Explanation
Correct Answer
D:Hardcoded recipient strings can route sensitive records to the wrong person. Notification rendering supports record-derived context and configured recipients. The corrective approach is to use approved recipient resolution and validate rendered email content.
Incorrect Answers
A:Too-broad triggers can spam users with messages on every update. This failure pattern belongs chiefly to Email notification trigger and condition; it is not the failure most directly tested in the Email recipients and templates situation. Hardcoded recipient strings can route sensitive records to the wrong person.
B:Hardcoding an operational threshold in many scripts complicates controlled changes. This failure pattern belongs chiefly to Application properties for behavior toggles; it is not the failure most directly tested in the Email recipients and templates situation. Hardcoded recipient strings can route sensitive records to the wrong person.
C:Trusting any sender and subject can let outsiders alter unrelated records. This failure pattern belongs chiefly to Inbound email action parsing; it is not the failure most directly tested in the Email recipients and templates situation. Hardcoded recipient strings can route sensitive records to the wrong person.
Question 9
A partner sends a CSV of asset records that should enter a scoped table. A reviewer proposes this shortcut: Assume uploading CSV automatically creates perfectly validated final application records. Which principle BEST explains why a different solution is needed?
- Transform Maps determine how import set fields populate target table fields.
- Transform scripts allow custom mapping logic where declarative mapping is insufficient.
- Import sets separate incoming source data from application target records.
- Network failure does not prove a remote write was never committed.
Explanation
Correct Answer
C:Import sets separate incoming source data from application target records. The appropriate approach is to create an appropriate file data source and load rows to an import set staging table.
Incorrect Answers
A:Transform Maps determine how import set fields populate target table fields. This is about Transform map source-to-target mapping, not why the proposed CSV file data source and import set shortcut should be rejected. Writing unvalidated file rows directly into business tables risks corruption.
B:Transform scripts allow custom mapping logic where declarative mapping is insufficient. This is about Transform scripts for calculated mappings, not why the proposed CSV file data source and import set shortcut should be rejected. Writing unvalidated file rows directly into business tables risks corruption.
D:Network failure does not prove a remote write was never committed. This is about REST timeout and retry safety, not why the proposed CSV file data source and import set shortcut should be rejected. Writing unvalidated file rows directly into business tables risks corruption.
Question 10
An application logs which user initiated a permitted operation. Which practical correction or implementation decision is MOST directly appropriate?
- Populate trusted record ownership from a user-supplied arbitrary text field.
- Evaluate group membership against authenticated identity and use ACLs.
- Scope and document the property and preserve real ACL enforcement.
- Use the effective server identity and validate access permissions.
Explanation
Correct Answer
D:Use the effective server identity and validate access permissions. The intended behavior can be checked because the stored owner or audit reference matches the authenticated user's sys_id.
Incorrect Answers
A:Populate trusted record ownership from a user-supplied arbitrary text field. This would not correct the gs.getUserID for current identity workflow. A client-provided name can be forged or ambiguous.
B:Evaluate group membership against authenticated identity and use ACLs. This could help gs.getUser().isMemberOf group membership, but it does not resolve the gs.getUserID for current identity case. Server-side user identity references are more robust than trusting submitted display names.
C:Scope and document the property and preserve real ACL enforcement. This could help gs.getProperty server configuration, but it does not resolve the gs.getUserID for current identity case. Server-side user identity references are more robust than trusting submitted display names.
