ServiceNow CAD Practice Test 16
Question 150
An application requires default client-side display logic as the form first loads. Select TWO statements that correctly combine the onLoad client script initialization method with evidence or its governing principle.
- Use an onLoad client script and supported g_form methods for initial presentation.
- Use documented g_form methods suited to the field and client context.
- Use an onSubmit client script to provide feedback and return false when invalid.
- The message or supported field state appears when the form loads.
- Put a form-load requirement solely in an onSubmit handler and expect it before save.
Explanation
Correct Answers
A:Use an onLoad client script and supported g_form methods for initial presentation. This is the intended action for onLoad client script initialization.
D:The message or supported field state appears when the form loads. This is directly observable validation of the onLoad client script initialization result.
Incorrect Answers
B:Use documented g_form methods suited to the field and client context. This serves the different g_form API for form fields objective, not the selected onLoad client script initialization plan. onLoad scripts execute during form initialization, distinct from onChange or submit events.
C:Use an onSubmit client script to provide feedback and return false when invalid. This serves the different onSubmit client script validation objective, not the selected onLoad client script initialization plan. onLoad scripts execute during form initialization, distinct from onChange or submit events.
E:Put a form-load requirement solely in an onSubmit handler and expect it before save. This is not part of a safe or effective onLoad client script initialization design. Triggering initialization on every field change can create redundant behavior.
Question 151
Some users need normal case access but must not see administrative functions. Select TWO statements that correctly combine the Module-specific role requirements method with evidence or its governing principle.
- Define role containment or group membership intentionally and inspect effective privileges.
- Assign appropriate Roles to each sensitive module and keep underlying ACLs.
- Authorized reviewers reach the review module while unrelated users cannot retrieve its records.
- Give everyone access to sensitive navigation because a table is in a scoped application.
- Set the application menu Roles restriction for authorized access and independently test ACLs.
Explanation
Correct Answers
B:Assign appropriate Roles to each sensitive module and keep underlying ACLs. This is the intended action for Module-specific role requirements.
C:Authorized reviewers reach the review module while unrelated users cannot retrieve its records. This is directly observable validation of the Module-specific role requirements result.
Incorrect Answers
A:Define role containment or group membership intentionally and inspect effective privileges. This serves the different Role inclusion and effective access objective, not the selected Module-specific role requirements plan. Modules may have narrower navigation roles than the application menu as a whole.
D:Give everyone access to sensitive navigation because a table is in a scoped application. This is not part of a safe or effective Module-specific role requirements design. A broadly visible sensitive module increases confusion and disclosure risk.
E:Set the application menu Roles restriction for authorized access and independently test ACLs. This serves the different Application menu role restriction objective, not the selected Module-specific role requirements plan. Modules may have narrower navigation roles than the application menu as a whole.
Question 152
A record owner must match the authenticated caller rather than a displayed name. Which approach BEST meets the requirement while respecting the system constraints?
- Check membership using an appropriate server-side GlideUser method such as gs.getUser().isMemberOf.
- Read gs.getUserID in server-side script where the effective user identity is required.
- Read the app-specific property through gs.getProperty with an appropriate default.
- Populate trusted record ownership from a user-supplied arbitrary text field.
Explanation
Correct Answer
B:Read gs.getUserID in server-side script where the effective user identity is required. Server-side user identity references are more robust than trusting submitted display names. Verification should demonstrate that the stored owner or audit reference matches the authenticated user's sys_id.
Incorrect Answers
A:Check membership using an appropriate server-side GlideUser method such as gs.getUser().isMemberOf. This primarily addresses gs.getUser().isMemberOf group membership, not the specific gs.getUserID for current identity decision. Here, server-side user identity references are more robust than trusting submitted display names.
C:Read the app-specific property through gs.getProperty with an appropriate default. This primarily addresses gs.getProperty server configuration, not the specific gs.getUserID for current identity decision. Here, server-side user identity references are more robust than trusting submitted display names.
D:Populate trusted record ownership from a user-supplied arbitrary text field. This is an unsafe or ineffective shortcut for gs.getUserID for current identity. A client-provided name can be forged or ambiguous.
Question 153
A client needs a record-related lookup without blocking the browser thread. Which practical correction or implementation decision is MOST directly appropriate?
- Design a scoped server endpoint with asynchronous client callbacks.
- Use supported g_form calls and test the targeted UI type.
- Expect getXMLWait to be supported in every modern mobile or service portal client.
- Put initial form behavior in onLoad and avoid unnecessary server calls.
Explanation
Correct Answer
A:Design a scoped server endpoint with asynchronous client callbacks. The intended behavior can be checked because a callback receives only the permitted result and the form remains responsive.
Incorrect Answers
B:Use supported g_form calls and test the targeted UI type. This could help g_form API for form fields, but it does not resolve the GlideAjax asynchronous client-server pattern case. GlideAjax enables supported asynchronous calls from client logic to server Script Includes.
C:Expect getXMLWait to be supported in every modern mobile or service portal client. This would not correct the GlideAjax asynchronous client-server pattern workflow. Synchronous wait calls or unbounded client record queries can harm performance or fail in some UIs.
D:Put initial form behavior in onLoad and avoid unnecessary server calls. This could help onLoad client script initialization, but it does not resolve the GlideAjax asynchronous client-server pattern case. GlideAjax enables supported asynchronous calls from client logic to server Script Includes.
Question 154
A user belongs to the right app scope but cannot read protected salary fields. If the relevant Scope boundaries versus ACL authorizations safeguard is omitted, which outcome is the MOST directly associated failure?
- Approving all cross-scope privileges removes a layer of application isolation.
- Editing in Global by mistake can create uncontrolled shared metadata.
- Confusing a scope prefix with a runtime user role can leak restricted records.
- Choosing a record-free visualization engine would omit task state and audit trails.
Explanation
Correct Answer
C:Confusing a scope prefix with a runtime user role can leak restricted records. Application scope is an artifact isolation mechanism while ACLs govern record or field access. The corrective approach is to design cross-scope permissions and user ACLs separately.
Incorrect Answers
A:Approving all cross-scope privileges removes a layer of application isolation. This failure pattern belongs chiefly to Scope privileges and tracking; it is not the failure most directly tested in the Scope boundaries versus ACL authorizations situation. Confusing a scope prefix with a runtime user role can leak restricted records.
B:Editing in Global by mistake can create uncontrolled shared metadata. This failure pattern belongs chiefly to Application scope namespace; it is not the failure most directly tested in the Scope boundaries versus ACL authorizations situation. Confusing a scope prefix with a runtime user role can leak restricted records.
D:This failure pattern belongs chiefly to Workflow fit for scoped applications; it is not the failure most directly tested in the Scope boundaries versus ACL authorizations situation.
Question 155
A form should let users select a fixed priority category with stable internal values. An engineer must explain the recommendation for Choice field value and label. Which underlying principle is the MOST accurate?
- The active application determines ownership of many new configuration files.
- Field dictionaries determine storage type and metadata beyond form appearance.
- Choice lists bound selectable values while presenting readable labels.
- Unique identifiers and indexes support matching and efficient lookups.
Explanation
Correct Answer
C:Choice lists bound selectable values while presenting readable labels. Therefore the implementation decision is to configure an appropriate choice field with defined stored values and user-facing labels.
Incorrect Answers
A:The active application determines ownership of many new configuration files. This describes the separate Application picker and context mechanism; the present case instead requires Choice field value and label. Uncontrolled status strings cause inconsistent filtering and automation.
B:Field dictionaries determine storage type and metadata beyond form appearance. This describes the separate Dictionary field attributes and type safety mechanism; the present case instead requires Choice field value and label. Uncontrolled status strings cause inconsistent filtering and automation.
D:Unique identifiers and indexes support matching and efficient lookups. This describes the separate Unique business identifier and indexes mechanism; the present case instead requires Choice field value and label. Uncontrolled status strings cause inconsistent filtering and automation.
Question 156
A developer considers putting an API token in an ordinary readable application property. Which practical correction or implementation decision is MOST directly appropriate?
- Separate secrets from routine app properties and review their access.
- Choose explicit scoped names and document their owners.
- Record owners, approvals and rollback values for operational properties.
- Place a plaintext password into a broadly readable sys_property because it is convenient.
Explanation
Correct Answer
A:Separate secrets from routine app properties and review their access. The intended behavior can be checked because tests show only permitted principals can access credentials while timeout remains configurable.
Incorrect Answers
B:Choose explicit scoped names and document their owners. This could help Property naming in scoped applications, but it does not resolve the Properties are not a secret vault case. Ordinary configuration properties should not be assumed suitable for protected secrets.
C:Record owners, approvals and rollback values for operational properties. This could help Property change governance, but it does not resolve the Properties are not a secret vault case. Ordinary configuration properties should not be assumed suitable for protected secrets.
D:Place a plaintext password into a broadly readable sys_property because it is convenient. This would not correct the Properties are not a secret vault workflow. Exposing a token in property values or logs can leak access to an external system.
Question 157
A job should reconcile expired reservations on a schedule rather than wait for form edits. Which practical correction or implementation decision is MOST directly appropriate?
- Test schedule and timezone assumptions with representative dates.
- Validate the event name, instance record and optional parameters.
- Define and test the event name and listener configuration.
- Trigger the job solely from a user's browser refresh and call it a reliable nightly schedule.
Explanation
Correct Answer
A:Test schedule and timezone assumptions with representative dates. The intended behavior can be checked because the job runs at the expected time and logs the processed record count.
Incorrect Answers
B:Validate the event name, instance record and optional parameters. This could help gs.eventQueue dispatch from server script, but it does not resolve the Scheduled Script Execution timing case. Scheduled scripts run server logic according to schedule settings independent of interactive form updates.
C:Define and test the event name and listener configuration. This could help Event registry for named events, but it does not resolve the Scheduled Script Execution timing case. Scheduled scripts run server logic according to schedule settings independent of interactive form updates.
D:Trigger the job solely from a user's browser refresh and call it a reliable nightly schedule. This would not correct the Scheduled Script Execution timing workflow. Incorrect schedules can skip deadlines or run too frequently.
Question 158
A developer assumes scoped-table ownership grants every end user unrestricted access. Which practical correction or implementation decision is MOST directly appropriate?
- Treat having a table in a private scope as proof no end-user security rules are needed.
- Check current application context and ownership before saving changes.
- Design cross-scope permissions and user ACLs separately.
- Verify the application picker and scope prefix before creating files.
Explanation
Correct Answer
C:Design cross-scope permissions and user ACLs separately. The intended behavior can be checked because a positive and negative role test proves both layers behave as intended.
Incorrect Answers
A:Treat having a table in a private scope as proof no end-user security rules are needed. This would not correct the Scope boundaries versus ACL authorizations workflow. Confusing a scope prefix with a runtime user role can leak restricted records.
B:Check current application context and ownership before saving changes. This could help Application picker and context, but it does not resolve the Scope boundaries versus ACL authorizations case. Application scope is an artifact isolation mechanism while ACLs govern record or field access.
D:Verify the application picker and scope prefix before creating files. This could help Application scope namespace, but it does not resolve the Scope boundaries versus ACL authorizations case. Application scope is an artifact isolation mechanism while ACLs govern record or field access.
Question 159
A test notification appears to trigger but recipients do not receive mail. If the relevant Email delivery troubleshooting safeguard is omitted, which outcome is the MOST directly associated failure?
- Exposing a token in property values or logs can leak access to an external system.
- Trusting any sender and subject can let outsiders alter unrelated records.
- Hardcoded recipient strings can route sensitive records to the wrong person.
- A successful trigger record does not guarantee the message was delivered.
Explanation
Correct Answer
D:A successful trigger record does not guarantee the message was delivered. Email troubleshooting distinguishes notification selection from actual delivery status. The corrective approach is to review the generated outbound email and correct conditions or transport errors.
Incorrect Answers
A:This failure pattern belongs chiefly to Properties are not a secret vault; it is not the failure most directly tested in the Email delivery troubleshooting situation.
B:Trusting any sender and subject can let outsiders alter unrelated records. This failure pattern belongs chiefly to Inbound email action parsing; it is not the failure most directly tested in the Email delivery troubleshooting situation. A successful trigger record does not guarantee the message was delivered.
C:Hardcoded recipient strings can route sensitive records to the wrong person. This failure pattern belongs chiefly to Email recipients and templates; it is not the failure most directly tested in the Email delivery troubleshooting situation. A successful trigger record does not guarantee the message was delivered.
Question 160
A scheduled check reads a threshold that might not be configured in a new instance. A reviewer proposes this shortcut: Treat an absent property as a reliable Boolean true for every feature. Which principle BEST explains why a different solution is needed?
- Namespaced properties reduce configuration conflicts among unrelated applications.
- Application properties externalize configurable behavior from code.
- Data pills carry typed step and trigger outputs through a flow.
- Server-side property access can supply configuration with optional default values.
Explanation
Correct Answer
D:Server-side property access can supply configuration with optional default values. The appropriate approach is to read an application property using gs.getProperty with a safe documented fallback.
Incorrect Answers
A:Namespaced properties reduce configuration conflicts among unrelated applications. This is about Property naming in scoped applications, not why the proposed gs.getProperty with fallback shortcut should be rejected. Omitting default handling may lead to invalid comparisons or unintended behavior.
B:Application properties externalize configurable behavior from code. This is about Application properties for behavior toggles, not why the proposed gs.getProperty with fallback shortcut should be rejected. Omitting default handling may lead to invalid comparisons or unintended behavior.
C:Data pills carry typed step and trigger outputs through a flow. This is about Flow Designer data pills, not why the proposed gs.getProperty with fallback shortcut should be rejected. Omitting default handling may lead to invalid comparisons or unintended behavior.
