ServiceNow CAD Practice Test 12
Question 110
A scoped application must send approved purchase-order status to a supplier HTTPS endpoint. After the recommended Outbound REST Message configuration change is implemented, which observation MOST directly verifies that it works?
- Target fields contain correct normalized values and invalid inputs are flagged.
- A controlled test shows the expected HTTP request and provider response.
- Repeated tests do not create duplicate external records for the same business operation.
- Logs show an actual HTTP status and parsed permitted content from the response.
Explanation
Correct Answer
B:A controlled test shows the expected HTTP request and provider response. This directly tests whether the Outbound REST Message configuration goal was met. ServiceNow REST messages describe external HTTP operations used by app integrations.
Incorrect Answers
A:Target fields contain correct normalized values and invalid inputs are flagged. This is evidence about Transform scripts for calculated mappings, not direct proof of the required Outbound REST Message configuration behavior. The relevant check is that a controlled test shows the expected HTTP request and provider response.
C:Repeated tests do not create duplicate external records for the same business operation. This is evidence about REST timeout and retry safety, not direct proof of the required Outbound REST Message configuration behavior. The relevant check is that a controlled test shows the expected HTTP request and provider response.
D:Logs show an actual HTTP status and parsed permitted content from the response. This is evidence about RESTMessageV2 execution and response, not direct proof of the required Outbound REST Message configuration behavior. The relevant check is that a controlled test shows the expected HTTP request and provider response.
Question 111
A developer needs code to retrieve an HTTP status and response body for a vendor API. Which practical correction or implementation decision is MOST directly appropriate?
- Configure approved authentication and test expiry or rotation behavior.
- Correlate requests and check the external transaction before retrying.
- Print a success message without executing or inspecting the REST request.
- Check status, handle errors and parse expected response fields.
Explanation
Correct Answer
D:Check status, handle errors and parse expected response fields. The intended behavior can be checked because logs show an actual HTTP status and parsed permitted content from the response.
Incorrect Answers
A:Configure approved authentication and test expiry or rotation behavior. This could help REST authentication with stored credentials, but it does not resolve the RESTMessageV2 execution and response case. RESTMessageV2 performs server-side outbound requests and returns a response object.
B:Correlate requests and check the external transaction before retrying. This could help REST timeout and retry safety, but it does not resolve the RESTMessageV2 execution and response case. RESTMessageV2 performs server-side outbound requests and returns a response object.
C:Print a success message without executing or inspecting the REST request. This would not correct the RESTMessageV2 execution and response workflow. Assuming every network call succeeds can silently lose changes.
Question 112
A scoped application must send approved purchase-order status to a supplier HTTPS endpoint. Which approach BEST meets the requirement while respecting the system constraints?
- Treat an HTML form action as a fully configured authenticated outbound REST integration.
- Use supported credential or connection alias mechanisms with least privilege.
- Configure an outbound REST Message with the intended method, endpoint and parameters.
- Use supported sn_ws.RESTMessageV2 server-side APIs and validate response status and payload.
Explanation
Correct Answer
C:Configure an outbound REST Message with the intended method, endpoint and parameters. ServiceNow REST messages describe external HTTP operations used by app integrations. Verification should demonstrate that a controlled test shows the expected HTTP request and provider response.
Incorrect Answers
A:Treat an HTML form action as a fully configured authenticated outbound REST integration. This is an unsafe or ineffective shortcut for Outbound REST Message configuration. Unchecked URLs and method choices can send confidential data to unintended destinations.
B:Use supported credential or connection alias mechanisms with least privilege. This primarily addresses REST authentication with stored credentials, not the specific Outbound REST Message configuration decision. Here, serviceNow REST messages describe external HTTP operations used by app integrations.
D:Use supported sn_ws.RESTMessageV2 server-side APIs and validate response status and payload. This primarily addresses RESTMessageV2 execution and response, not the specific Outbound REST Message configuration decision. Here, serviceNow REST messages describe external HTTP operations used by app integrations.
Question 113
A required external identifier must be present even when records arrive through import. After the recommended Mandatory field storage versus form rendering change is implemented, which observation MOST directly verifies that it works?
- Submitting the producer creates a correctly populated target record.
- The form offers valid choices and stored values match automation checks.
- API and import attempts missing the identifier are handled according to policy.
- Historical values remain retrievable to authorized users outside the simplified view.
Explanation
Correct Answer
C:API and import attempts missing the identifier are handled according to policy. This directly tests whether the Mandatory field storage versus form rendering goal was met. A visual required flag alone does not necessarily enforce all non-form writes.
Incorrect Answers
A:Submitting the producer creates a correctly populated target record. This is evidence about Record Producer creates app record, not direct proof of the required Mandatory field storage versus form rendering behavior. The relevant check is that aPI and import attempts missing the identifier are handled according to policy.
B:The form offers valid choices and stored values match automation checks. This is evidence about Choice definitions and dependent choices, not direct proof of the required Mandatory field storage versus form rendering behavior. The relevant check is that aPI and import attempts missing the identifier are handled according to policy.
D:Historical values remain retrievable to authorized users outside the simplified view. This is evidence about Remove fields from view without deleting data, not direct proof of the required Mandatory field storage versus form rendering behavior. The relevant check is that aPI and import attempts missing the identifier are handled according to policy.
Question 114
A developer needs to expose a utility safely to authorized caller scopes. An engineer must explain the recommendation for Restricted cross-scope scripting. Which underlying principle is the MOST accurate?
- Reusing platform capabilities reduces duplicate schemas and unnecessary maintenance.
- The active application determines ownership of many new configuration files.
- Script includes and API access can be constrained across application scopes.
- Application access settings limit what other scopes may do with application tables.
Explanation
Correct Answer
C:Script includes and API access can be constrained across application scopes. Therefore the implementation decision is to configure script include accessibility and applicable caller restrictions with scoped interfaces.
Incorrect Answers
A:Private script utilities cannot simply be called from any unrelated scope. Reusing platform capabilities reduces duplicate schemas and unnecessary maintenance.
B:Private script utilities cannot simply be called from any unrelated scope. The active application determines ownership of many new configuration files.
D:Private script utilities cannot simply be called from any unrelated scope. This describes the separate Cross-scope table application access mechanism; the present case instead requires Restricted cross-scope scripting.
Question 115
An employee needs an explicit Create entry for the application table. Which practical correction or implementation decision is MOST directly appropriate?
- Set the appropriate module destination and validate new record creation.
- Treat a module for an existing record as a guaranteed new record insertion action.
- Test the intended filter along with server-enforced record access.
- Pair role-limited navigation with table and field ACL checks.
Explanation
Correct Answer
A:Set the appropriate module destination and validate new record creation. The intended behavior can be checked because the eligible user reaches a new record form of the correct table.
Incorrect Answers
B:Treat a module for an existing record as a guaranteed new record insertion action. This would not correct the New-record module entry point workflow. A list-only link may not meet a required direct creation path.
C:Test the intended filter along with server-enforced record access. This could help Filtered module navigation, but it does not resolve the New-record module entry point case. Modules can provide distinct navigation actions for creating versus listing records.
D:Pair role-limited navigation with table and field ACL checks. This could help Module and menu role visibility, but it does not resolve the New-record module entry point case. Modules can provide distinct navigation actions for creating versus listing records.
Question 116
A team needs to distinguish visual mandatory indicators from authoritative data rules. Select TWO statements that correctly combine the Mandatory field storage versus form rendering method with evidence or its governing principle.
- API and import attempts missing the identifier are handled according to policy.
- Configure a suitable reference qualifier for the target reference field.
- Define stable choice values and applicable dependent-choice configuration.
- Define the appropriate dictionary or server validation requirement and test all write paths.
- Set a field mandatory only in one desktop view and assume no API can omit it.
Explanation
Correct Answers
A:API and import attempts missing the identifier are handled according to policy. This is directly observable validation of the Mandatory field storage versus form rendering result.
D:Define the appropriate dictionary or server validation requirement and test all write paths. This is the intended action for Mandatory field storage versus form rendering.
Incorrect Answers
B:Configure a suitable reference qualifier for the target reference field. This serves the different Reference qualifier for valid selections objective, not the selected Mandatory field storage versus form rendering plan. A visual required flag alone does not necessarily enforce all non-form writes.
C:Define stable choice values and applicable dependent-choice configuration. This serves the different Choice definitions and dependent choices objective, not the selected Mandatory field storage versus form rendering plan. A visual required flag alone does not necessarily enforce all non-form writes.
E:Set a field mandatory only in one desktop view and assume no API can omit it. This is not part of a safe or effective Mandatory field storage versus form rendering design. Integrations can bypass client-only mandatory checks and introduce incomplete records.
Question 117
A reviewer needs an auditable record of approved application dependencies. Which practical correction or implementation decision is MOST directly appropriate?
- Authorize only documented target and operation combinations.
- Expose the minimum supported interface and verify caller policy.
- Define application distribution protection after testing update behavior.
- Disable scope enforcement for the entire instance to solve one caller error.
Explanation
Correct Answer
A:Authorize only documented target and operation combinations. The intended behavior can be checked because the approved operation succeeds and unapproved calls remain restricted.
Incorrect Answers
B:Expose the minimum supported interface and verify caller policy. This could help Script Include accessible from scope setting, but it does not resolve the Runtime cross-scope access tracking case. Cross-scope privilege records track and govern permitted interactions.
C:Define application distribution protection after testing update behavior. This could help Protected application files and distribution, but it does not resolve the Runtime cross-scope access tracking case. Cross-scope privilege records track and govern permitted interactions.
D:Disable scope enforcement for the entire instance to solve one caller error. This would not correct the Runtime cross-scope access tracking workflow. Approving every denied operation creates unsafe transitive privileges.
Question 118
A developer needs to discover which internally created application is installed and its version. If the relevant My Company Applications lifecycle safeguard is omitted, which outcome is the MOST directly associated failure?
- Copying only one script file is not equivalent to installing the packaged application.
- Installing without a dependency plan can leave missing tables or APIs.
- Global admin privileges would grant broader access than the development task requires.
- Unknown installed versions can create drift between test and production.
Explanation
Correct Answer
D:Unknown installed versions can create drift between test and production. Installed application management identifies versioned app artifacts rather than only source folders. The corrective approach is to compare installed version and update history before changing the app.
Incorrect Answers
A:Copying only one script file is not equivalent to installing the packaged application. This failure pattern belongs chiefly to Application repository release distribution; it is not the failure most directly tested in the My Company Applications lifecycle situation. Unknown installed versions can create drift between test and production.
B:Installing without a dependency plan can leave missing tables or APIs. This failure pattern belongs chiefly to App installation dependencies; it is not the failure most directly tested in the My Company Applications lifecycle situation. Unknown installed versions can create drift between test and production.
C:Global admin privileges would grant broader access than the development task requires. This failure pattern belongs chiefly to Delegated Development for privately scoped apps; it is not the failure most directly tested in the My Company Applications lifecycle situation. Unknown installed versions can create drift between test and production.
Question 119
An app integration unexpectedly receives a denied cross-scope script access response. Which approach BEST meets the requirement while respecting the system constraints?
- Review cross-scope access tracking and approve the specific required privilege if justified.
- Disable scope enforcement for the entire instance to solve one caller error.
- Configure the Script Include's accessible-from setting and relevant caller restrictions.
- Keep internal application files within private scope and expose only approved APIs.
Explanation
Correct Answer
A:Review cross-scope access tracking and approve the specific required privilege if justified. Cross-scope privilege records track and govern permitted interactions. Verification should demonstrate that the approved operation succeeds and unapproved calls remain restricted.
Incorrect Answers
B:Disable scope enforcement for the entire instance to solve one caller error. This is an unsafe or ineffective shortcut for Runtime cross-scope access tracking. Approving every denied operation creates unsafe transitive privileges.
C:Configure the Script Include's accessible-from setting and relevant caller restrictions. This primarily addresses Script Include accessible from scope setting, not the specific Runtime cross-scope access tracking decision. Here, cross-scope privilege records track and govern permitted interactions.
D:Keep internal application files within private scope and expose only approved APIs. This primarily addresses Private scope protects internal application files, not the specific Runtime cross-scope access tracking decision. Here, cross-scope privilege records track and govern permitted interactions.
Question 120
A team rotates integration credentials without editing application scripts. Testing exposes this failure: Hard-coded keys in shared scripts expose secrets and complicate rotation. Which remediation should be applied FIRST?
- Apply bounded timeout and retry handling with an idempotency strategy for writes.
- Configure approved authentication and test expiry or rotation behavior.
- Put an API secret in a client script because the browser will not display its JavaScript.
- Configure an outbound REST Message with the intended method, endpoint and parameters.
Explanation
Correct Answer
B:Configure approved authentication and test expiry or rotation behavior. Confirmation requires seeing that authorized calls succeed and credentials are absent from source code and public logs.
Incorrect Answers
A:Apply bounded timeout and retry handling with an idempotency strategy for writes. It addresses REST timeout and retry safety, not the diagnosed REST authentication with stored credentials failure. Hard-coded keys in shared scripts expose secrets and complicate rotation.
C:Put an API secret in a client script because the browser will not display its JavaScript. This retains the REST authentication with stored credentials problem. Integration authentication should be managed separately from code configuration.
D:Configure an outbound REST Message with the intended method, endpoint and parameters. It addresses Outbound REST Message configuration, not the diagnosed REST authentication with stored credentials failure. Hard-coded keys in shared scripts expose secrets and complicate rotation.