ServiceNow CAD Practice Test 13
Question 120
A team rotates integration credentials without editing application scripts. Testing exposes this failure: Hard-coded keys in shared scripts expose secrets and complicate rotation. Which remediation should be applied FIRST?
- Apply bounded timeout and retry handling with an idempotency strategy for writes.
- Configure approved authentication and test expiry or rotation behavior.
- Put an API secret in a client script because the browser will not display its JavaScript.
- Configure an outbound REST Message with the intended method, endpoint and parameters.
Explanation
Correct Answer
B:Configure approved authentication and test expiry or rotation behavior. Confirmation requires seeing that authorized calls succeed and credentials are absent from source code and public logs.
Incorrect Answers
A:Apply bounded timeout and retry handling with an idempotency strategy for writes. It addresses REST timeout and retry safety, not the diagnosed REST authentication with stored credentials failure. Hard-coded keys in shared scripts expose secrets and complicate rotation.
C:Put an API secret in a client script because the browser will not display its JavaScript. This retains the REST authentication with stored credentials problem. Integration authentication should be managed separately from code configuration.
D:Configure an outbound REST Message with the intended method, endpoint and parameters. It addresses Outbound REST Message configuration, not the diagnosed REST authentication with stored credentials failure. Hard-coded keys in shared scripts expose secrets and complicate rotation.
Question 121
A developer needs code to retrieve an HTTP status and response body for a vendor API. An engineer must explain the recommendation for RESTMessageV2 execution and response. Which underlying principle is the MOST accurate?
- REST integrations depend on endpoint, method, headers and payload schema.
- ServiceNow REST messages describe external HTTP operations used by app integrations.
- Transform Maps determine how import set fields populate target table fields.
- RESTMessageV2 performs server-side outbound requests and returns a response object.
Explanation
Correct Answer
D:RESTMessageV2 performs server-side outbound requests and returns a response object. Therefore the implementation decision is to use supported sn_ws.RESTMessageV2 server-side APIs and validate response status and payload.
Incorrect Answers
A:Assuming every network call succeeds can silently lose changes. REST integrations depend on endpoint, method, headers and payload schema.
B:Assuming every network call succeeds can silently lose changes. This describes the separate Outbound REST Message configuration mechanism; the present case instead requires RESTMessageV2 execution and response.
C:Assuming every network call succeeds can silently lose changes. Transform Maps determine how import set fields populate target table fields.
Question 122
A developer in one scope attempts to change an unrelated application's protected ACL. If the relevant Scope context and security rule ownership safeguard is omitted, which outcome is the MOST directly associated failure?
- UI hiding alone leaves alternate access paths unprotected.
- Exposing sensitive implementation files unintentionally may undermine support and integrity.
- Arbitrary edits to foreign-scope ACLs can break isolation and fail permissions.
- Making a table accessible from all scopes does not by itself authorize end users.
Explanation
Correct Answer
C:Arbitrary edits to foreign-scope ACLs can break isolation and fail permissions. Security metadata and application scope boundaries can constrain what ACLs may be edited. The corrective approach is to confirm ownership and perform approved changes in the correct application context.
Incorrect Answers
A:UI hiding alone leaves alternate access paths unprotected. This failure pattern belongs chiefly to Distinguish module access from record roles; it is not the failure most directly tested in the Scope context and security rule ownership situation. Arbitrary edits to foreign-scope ACLs can break isolation and fail permissions.
B:Exposing sensitive implementation files unintentionally may undermine support and integrity. This failure pattern belongs chiefly to Protected application files and distribution; it is not the failure most directly tested in the Scope context and security rule ownership situation. Arbitrary edits to foreign-scope ACLs can break isolation and fail permissions.
D:This failure pattern belongs chiefly to Table application access and CRUD scope; it is not the failure most directly tested in the Scope context and security rule ownership situation.
Question 123
A nightly supplier file repeats external asset IDs but should refresh existing records. If the relevant Coalesce for update versus insert safeguard is omitted, which outcome is the MOST directly associated failure?
- An unconfigured map can leave target fields blank or misdirect values.
- Unchecked URLs and method choices can send confidential data to unintended destinations.
- Without coalesce the same feed may insert duplicate business records.
- Writing unvalidated file rows directly into business tables risks corruption.
Explanation
Correct Answer
C:Without coalesce the same feed may insert duplicate business records. Coalesce matches imported values to target rows and chooses update versus insert. The corrective approach is to choose a stable unique key and test re-import idempotency.
Incorrect Answers
A:An unconfigured map can leave target fields blank or misdirect values. This failure pattern belongs chiefly to Transform map source-to-target mapping; it is not the failure most directly tested in the Coalesce for update versus insert situation. Without coalesce the same feed may insert duplicate business records.
B:Unchecked URLs and method choices can send confidential data to unintended destinations. This failure pattern belongs chiefly to Outbound REST Message configuration; it is not the failure most directly tested in the Coalesce for update versus insert situation. Without coalesce the same feed may insert duplicate business records.
D:Writing unvalidated file rows directly into business tables risks corruption. This failure pattern belongs chiefly to CSV file data source and import set; it is not the failure most directly tested in the Coalesce for update versus insert situation. Without coalesce the same feed may insert duplicate business records.
Question 124
A shared support inbox needs to distinguish new requests from existing conversation replies. Testing exposes this failure: Weak matching can create duplicates or update the wrong record. Which remediation should be applied FIRST?
- Validate reply identifiers, sender permissions and new-message handling.
- Queue an appropriate event or use supported notifications rather than duplicating email code.
- Create a new record for every reply without checking its correlation to an existing case.
- Configure an inbound email action or supported inbound processing with identity and record matching.
Explanation
Correct Answer
A:Validate reply identifiers, sender permissions and new-message handling. Confirmation requires seeing that a fresh email creates one record while a recognized reply updates the intended existing one.
Incorrect Answers
B:Queue an appropriate event or use supported notifications rather than duplicating email code. It addresses Event-driven email versus synchronous code, not the diagnosed Inbound email creation versus reply failure. Weak matching can create duplicates or update the wrong record.
C:Create a new record for every reply without checking its correlation to an existing case. This retains the Inbound email creation versus reply problem. Inbound email processing uses message classification and matching rules.
D:Configure an inbound email action or supported inbound processing with identity and record matching. It addresses Inbound email action parsing, not the diagnosed Inbound email creation versus reply failure. Weak matching can create duplicates or update the wrong record.
Question 125
A contributor modifies a scoped Script Include and requests approval before release. After the recommended Code review and scoped contribution workflow change is implemented, which observation MOST directly verifies that it works?
- The developer can edit allowed files while unrelated app and global administration are blocked.
- The authorized developer sees source control commands only for the intended app.
- The clean test instance resolves dependencies and executes smoke tests.
- The change record identifies author, reviewer, tests and approved target version.
Explanation
Correct Answer
D:The change record identifies author, reviewer, tests and approved target version. This directly tests whether the Code review and scoped contribution workflow goal was met. Delegation does not eliminate the need for review and test evidence.
Incorrect Answers
A:The developer can edit allowed files while unrelated app and global administration are blocked. This is evidence about Delegated Development for privately scoped apps, not direct proof of the required Code review and scoped contribution workflow behavior. The relevant check is that the change record identifies author, reviewer, tests and approved target version.
B:The authorized developer sees source control commands only for the intended app. This is evidence about Delegated source-control authorization, not direct proof of the required Code review and scoped contribution workflow behavior. The relevant check is that the change record identifies author, reviewer, tests and approved target version.
C:The clean test instance resolves dependencies and executes smoke tests. This is evidence about App installation dependencies, not direct proof of the required Code review and scoped contribution workflow behavior. The relevant check is that the change record identifies author, reviewer, tests and approved target version.
Question 126
A record owner must match the authenticated caller rather than a displayed name. After the recommended gs.getUserID for current identity change is implemented, which observation MOST directly verifies that it works?
- Role-positive and role-negative tests produce the expected server-side branch.
- The stored owner or audit reference matches the authenticated user's sys_id.
- Authorized caller contexts invoke the API while unrelated contexts fail.
- The form displays understandable feedback without exposing restricted data.
Explanation
Correct Answer
B:The stored owner or audit reference matches the authenticated user's sys_id. This directly tests whether the gs.getUserID for current identity goal was met. Server-side user identity references are more robust than trusting submitted display names.
Incorrect Answers
A:Role-positive and role-negative tests produce the expected server-side branch. This is evidence about gs.hasRole server authorization, not direct proof of the required gs.getUserID for current identity behavior. The relevant check is that the stored owner or audit reference matches the authenticated user's sys_id.
C:Authorized caller contexts invoke the API while unrelated contexts fail. This is evidence about Script Include accessible from scope setting, not direct proof of the required gs.getUserID for current identity behavior. The relevant check is that the stored owner or audit reference matches the authenticated user's sys_id.
D:The form displays understandable feedback without exposing restricted data. This is evidence about gs.addInfoMessage user feedback, not direct proof of the required gs.getUserID for current identity behavior. The relevant check is that the stored owner or audit reference matches the authenticated user's sys_id.
Question 127
An application manager needs to authorize limited Git operations for one delegated developer. An engineer must explain the recommendation for Delegated source-control authorization. Which underlying principle is the MOST accurate?
- Delegated Development supports controlled non-admin development for eligible privately scoped applications.
- App installation requires compatible dependencies and platform conditions.
- Source control rights may be assigned separately from general delegated editing.
- Delegated developer entitlements can restrict which app components each user edits.
Explanation
Correct Answer
C:Source control rights may be assigned separately from general delegated editing. Therefore the implementation decision is to grant the specific delegated Source Control permission when permitted by policy.
Incorrect Answers
A:File-edit permission alone need not imply permission to change repository links. This describes the separate Delegated Development for privately scoped apps mechanism; the present case instead requires Delegated source-control authorization.
B:File-edit permission alone need not imply permission to change repository links. This describes the separate App installation dependencies mechanism; the present case instead requires Delegated source-control authorization.
D:File-edit permission alone need not imply permission to change repository links. Delegated developer entitlements can restrict which app components each user edits.
Question 128
A clerk wants a navigator command to open a blank new inspection record. After the recommended New-record module entry point change is implemented, which observation MOST directly verifies that it works?
- The application navigator displays the menu for an eligible user.
- Selecting the module opens the intended records list.
- A release checklist identifies owner, version, acceptance tests and rollback plan.
- The eligible user reaches a new record form of the correct table.
Explanation
Correct Answer
D:The eligible user reaches a new record form of the correct table. This directly tests whether the New-record module entry point goal was met. Modules can provide distinct navigation actions for creating versus listing records.
Incorrect Answers
A:The application navigator displays the menu for an eligible user. This is evidence about Application menu navigation, not direct proof of the required New-record module entry point behavior. The relevant check is that the eligible user reaches a new record form of the correct table.
B:Selecting the module opens the intended records list. This is evidence about List module target table, not direct proof of the required New-record module entry point behavior. The relevant check is that the eligible user reaches a new record form of the correct table.
C:A release checklist identifies owner, version, acceptance tests and rollback plan. This is evidence about Scoped app lifecycle planning, not direct proof of the required New-record module entry point behavior. The relevant check is that the eligible user reaches a new record form of the correct table.
Question 129
Staff need a navigation item that opens all equipment loans as a list. If the relevant List module target table safeguard is omitted, which outcome is the MOST directly associated failure?
- A list-only link may not meet a required direct creation path.
- A module targeting the wrong table can display unrelated data.
- Deleting tables to hide obsolete modules can destroy unrelated data.
- Typing display names into arbitrary strings creates stale and ambiguous links.
Explanation
Correct Answer
B:A module targeting the wrong table can display unrelated data. Modules are navigation actions that point to lists, forms or other supported destinations. The corrective approach is to test module targets and list visibility as an allowed role.
Incorrect Answers
A:A list-only link may not meet a required direct creation path. This failure pattern belongs chiefly to New-record module entry point; it is not the failure most directly tested in the List module target table situation. A module targeting the wrong table can display unrelated data.
C:Deleting tables to hide obsolete modules can destroy unrelated data. This failure pattern belongs chiefly to Active state and module ordering; it is not the failure most directly tested in the List module target table situation. A module targeting the wrong table can display unrelated data.
D:Typing display names into arbitrary strings creates stale and ambiguous links. This failure pattern belongs chiefly to Reference field relations; it is not the failure most directly tested in the List module target table situation. A module targeting the wrong table can display unrelated data.
Question 130
A training application assigns many instructors to many courses. After the recommended Many-to-many relationship tables change is implemented, which observation MOST directly verifies that it works?
- Authorized testers submit and view records while unauthorized testers are denied.
- Stored choice values remain consistent across forms, reports and scripts.
- Association records link each permitted pair without repeating primary entity records.
- Reference selection opens and resolves the correct existing record.
Explanation
Correct Answer
C:Association records link each permitted pair without repeating primary entity records. This directly tests whether the Many-to-many relationship tables goal was met. Many-to-many relations need an association rather than a single scalar reference.
Incorrect Answers
A:Authorized testers submit and view records while unauthorized testers are denied. This is evidence about Experience design and app permissions, not direct proof of the required Many-to-many relationship tables behavior. The relevant check is that association records link each permitted pair without repeating primary entity records.
B:Stored choice values remain consistent across forms, reports and scripts. This is evidence about Choice field value and label, not direct proof of the required Many-to-many relationship tables behavior. The relevant check is that association records link each permitted pair without repeating primary entity records.
D:Reference selection opens and resolves the correct existing record. This is evidence about Reference field relations, not direct proof of the required Many-to-many relationship tables behavior. The relevant check is that association records link each permitted pair without repeating primary entity records.