ServiceNow CAD Practice Test 34
Question 330
An app posts a JSON object with required product ID and state fields. A reviewer proposes this shortcut: Assume any JSON-shaped object is valid for any HTTP endpoint. Which principle BEST explains why a different solution is needed?
- ServiceNow REST messages describe external HTTP operations used by app integrations.
- HTTP statuses and safe logs support distinguishing integration errors.
- Transform scripts allow custom mapping logic where declarative mapping is insufficient.
- REST integrations depend on endpoint, method, headers and payload schema.
Explanation
Correct Answer
D:REST integrations depend on endpoint, method, headers and payload schema. The appropriate approach is to validate HTTP method, content type, required JSON fields and endpoint contract.
Incorrect Answers
A:ServiceNow REST messages describe external HTTP operations used by app integrations. This is about Outbound REST Message configuration, not why the proposed REST endpoint and payload validation shortcut should be rejected. Sending malformed JSON or wrong verbs produces rejected or incorrect requests.
B:HTTP statuses and safe logs support distinguishing integration errors. This is about REST logging and diagnostics, not why the proposed REST endpoint and payload validation shortcut should be rejected. Sending malformed JSON or wrong verbs produces rejected or incorrect requests.
C:Transform scripts allow custom mapping logic where declarative mapping is insufficient. This is about Transform scripts for calculated mappings, not why the proposed REST endpoint and payload validation shortcut should be rejected. Sending malformed JSON or wrong verbs produces rejected or incorrect requests.
Question 331
An application owner needs to locate whether an email failed creation or delivery. Select TWO statements that correctly combine the Email delivery troubleshooting method with evidence or its governing principle.
- Queue an appropriate event or use supported notifications rather than duplicating email code.
- Declare email delivered solely because an event was queued successfully.
- Configure inbound action matching to distinguish new and reply cases and test reference correlation.
- The email log shows generation, recipients and any failure reason.
- Inspect notification conditions, outbound email records and delivery status using authorized tools.
Explanation
Correct Answers
D:The email log shows generation, recipients and any failure reason. This is directly observable validation of the Email delivery troubleshooting result.
E:Inspect notification conditions, outbound email records and delivery status using authorized tools. This is the intended action for Email delivery troubleshooting.
Incorrect Answers
A:Queue an appropriate event or use supported notifications rather than duplicating email code. This serves the different Event-driven email versus synchronous code objective, not the selected Email delivery troubleshooting plan. Email troubleshooting distinguishes notification selection from actual delivery status.
B:Declare email delivered solely because an event was queued successfully. This is not part of a safe or effective Email delivery troubleshooting design. A successful trigger record does not guarantee the message was delivered.
C:Configure inbound action matching to distinguish new and reply cases and test reference correlation. This serves the different Inbound email creation versus reply objective, not the selected Email delivery troubleshooting plan. Email troubleshooting distinguishes notification selection from actual delivery status.
Question 332
A developer wants to automate obvious field mapping without losing renamed columns. Which practical correction or implementation decision is MOST directly appropriate?
- Choose a stable unique key and test re-import idempotency.
- Add explicit validation, handling of missing values and conversion tests.
- Assume Auto Map Matching Fields infers every foreign-key and unit conversion automatically.
- Validate mapping outputs with realistic records and handle exceptions.
Explanation
Correct Answer
D:Validate mapping outputs with realistic records and handle exceptions. The intended behavior can be checked because direct name matches map and remaining fields receive reviewed explicit maps.
Incorrect Answers
A:Choose a stable unique key and test re-import idempotency. This could help Coalesce for update versus insert, but it does not resolve the Auto Map Matching Fields limits case. Auto-map assists matching field names but cannot infer every semantic transformation.
B:Add explicit validation, handling of missing values and conversion tests. This could help Transform scripts for calculated mappings, but it does not resolve the Auto Map Matching Fields limits case. Auto-map assists matching field names but cannot infer every semantic transformation.
C:Assume Auto Map Matching Fields infers every foreign-key and unit conversion automatically. This would not correct the Auto Map Matching Fields limits workflow. Unexamined auto mapping can omit fields whose source names differ.
Question 333
A delegated owner wants only selected roles to see administrative modules. Select TWO statements that correctly combine the Application menu role restriction method with evidence or its governing principle.
- Set the application menu Roles restriction for authorized access and independently test ACLs.
- Assign appropriate Roles to each sensitive module and keep underlying ACLs.
- Impersonate authorized and unauthorized test users and exercise supported record operations.
- Treat menu hiding as complete protection against direct record queries.
- Finance-role users see the relevant menu while others cannot access its protected records.
Explanation
Correct Answers
A:Set the application menu Roles restriction for authorized access and independently test ACLs. This is the intended action for Application menu role restriction.
E:Finance-role users see the relevant menu while others cannot access its protected records. This is directly observable validation of the Application menu role restriction result.
Incorrect Answers
B:Assign appropriate Roles to each sensitive module and keep underlying ACLs. This serves the different Module-specific role requirements objective, not the selected Application menu role restriction plan. Navigation roles control visibility; they do not replace table ACL authorization.
C:Impersonate authorized and unauthorized test users and exercise supported record operations. This serves the different Impersonation for end-user testing objective, not the selected Application menu role restriction plan. Navigation roles control visibility; they do not replace table ACL authorization.
D:Treat menu hiding as complete protection against direct record queries. This is not part of a safe or effective Application menu role restriction design. A hidden menu can still leave a table accessible via direct URL or API.
Question 334
A research unit asks ServiceNow to perform massive GPU matrix computation. If the relevant Avoid using platform as high-performance compute engine safeguard is omitted, which outcome is the MOST directly associated failure?
- A module targeting the wrong table can display unrelated data.
- A proof of concept that bypasses release gates can introduce unreviewed artifacts.
- Duplicating an existing product workflow can fragment reporting and upgrades.
- Executing massive compute loops inside business-rule transactions can degrade instance responsiveness.
Explanation
Correct Answer
D:Executing massive compute loops inside business-rule transactions can degrade instance responsiveness. A workflow platform is not a substitute for specialized large-scale numerical computing. The corrective approach is to separate compute from workflow using a secure integration boundary.
Incorrect Answers
A:A module targeting the wrong table can display unrelated data. This failure pattern belongs chiefly to List module target table; it is not the failure most directly tested in the Avoid using platform as high-performance compute engine situation. Executing massive compute loops inside business-rule transactions can degrade instance responsiveness.
B:A proof of concept that bypasses release gates can introduce unreviewed artifacts. This failure pattern belongs chiefly to Scoped app lifecycle planning; it is not the failure most directly tested in the Avoid using platform as high-performance compute engine situation. Executing massive compute loops inside business-rule transactions can degrade instance responsiveness.
C:Duplicating an existing product workflow can fragment reporting and upgrades. This failure pattern belongs chiefly to Reuse standard capabilities versus bespoke application; it is not the failure most directly tested in the Avoid using platform as high-performance compute engine situation. Executing massive compute loops inside business-rule transactions can degrade instance responsiveness.
Question 335
A developer thinks only visible navigation can expose the table. Testing exposes this failure: UI hiding alone leaves alternate access paths unprotected. Which remediation should be applied FIRST?
- Impersonate authorized and unauthorized test users and exercise supported record operations.
- Test security with direct read attempts and impersonated users.
- Create suitable application roles and assign them to intended groups or users.
- Assume role restrictions in the navigator prevent any direct API access.
Explanation
Correct Answer
B:Test security with direct read attempts and impersonated users. Confirmation requires seeing that direct URL and API tests fail for users without the record role.
Incorrect Answers
A:Impersonate authorized and unauthorized test users and exercise supported record operations. It addresses Impersonation for end-user testing, not the diagnosed Distinguish module access from record roles failure. UI hiding alone leaves alternate access paths unprotected.
C:Create suitable application roles and assign them to intended groups or users. It addresses Application role assignment model, not the diagnosed Distinguish module access from record roles failure. UI hiding alone leaves alternate access paths unprotected.
D:Assume role restrictions in the navigator prevent any direct API access. This retains the Distinguish module access from record roles problem. Security checks must protect actual data access regardless of how records are reached.
Question 336
A billing app exposes a read-only shared reference table to a scheduling app. A reviewer proposes this shortcut: Enable every Create Read Update Delete option for all scopes without checking the integration contract. Which principle BEST explains why a different solution is needed?
- Scope protection restricts application artifact usage across apps.
- Table application access determines cross-scope operation possibilities beyond user permissions.
- Cross-scope privilege records track and govern permitted interactions.
- Table ACLs and field ACLs can both affect whether sensitive data is revealed.
Explanation
Correct Answer
B:Table application access determines cross-scope operation possibilities beyond user permissions. The appropriate approach is to configure allowed cross-scope operations at the target table and separately define ACLs.
Incorrect Answers
A:Scope protection restricts application artifact usage across apps. This is about Private scope protects internal application files, not why the proposed Table application access and CRUD scope shortcut should be rejected. Making a table accessible from all scopes does not by itself authorize end users.
C:Cross-scope privilege records track and govern permitted interactions. This is about Runtime cross-scope access tracking, not why the proposed Table application access and CRUD scope shortcut should be rejected. Making a table accessible from all scopes does not by itself authorize end users.
D:Table ACLs and field ACLs can both affect whether sensitive data is revealed. This is about Field-level ACL for sensitive data, not why the proposed Table application access and CRUD scope shortcut should be rejected. Making a table accessible from all scopes does not by itself authorize end users.
Question 337
An application owner needs to locate whether an email failed creation or delivery. Which practical correction or implementation decision is MOST directly appropriate?
- Declare email delivered solely because an event was queued successfully.
- Refactor eligible email behavior into a registered event and notification.
- Review the generated outbound email and correct conditions or transport errors.
- Validate reply identifiers, sender permissions and new-message handling.
Explanation
Correct Answer
C:Review the generated outbound email and correct conditions or transport errors. The intended behavior can be checked because the email log shows generation, recipients and any failure reason.
Incorrect Answers
A:Declare email delivered solely because an event was queued successfully. This would not correct the Email delivery troubleshooting workflow. A successful trigger record does not guarantee the message was delivered.
B:Refactor eligible email behavior into a registered event and notification. This could help Event-driven email versus synchronous code, but it does not resolve the Email delivery troubleshooting case. Email troubleshooting distinguishes notification selection from actual delivery status.
D:Validate reply identifiers, sender permissions and new-message handling. This could help Inbound email creation versus reply, but it does not resolve the Email delivery troubleshooting case. Email troubleshooting distinguishes notification selection from actual delivery status.
Question 338
A case transitions to approved and a background notification should be queued. Which approach BEST meets the requirement while respecting the system constraints?
- Call a registered event with gs.eventQueue from an appropriate server context.
- Move reusable logic into a scoped utility Script Include and call it from permitted server contexts.
- Use a client-only g_form message as though it were a guaranteed server event queue entry.
- Query only eligible records and mark processed work using a consistent idempotency strategy.
Explanation
Correct Answer
A:Call a registered event with gs.eventQueue from an appropriate server context. gs.eventQueue is a server-side event mechanism used for asynchronous downstream responses. Verification should demonstrate that the event log shows a queued event tied to the expected record.
Incorrect Answers
B:Move reusable logic into a scoped utility Script Include and call it from permitted server contexts. This primarily addresses Utility Script Include for scheduled jobs, not the specific gs.eventQueue dispatch from server script decision. Here, gs.eventQueue is a server-side event mechanism used for asynchronous downstream responses.
C:Use a client-only g_form message as though it were a guaranteed server event queue entry. This is an unsafe or ineffective shortcut for gs.eventQueue dispatch from server script. Incorrect table or parameter values can make event consumers act on the wrong record.
D:Query only eligible records and mark processed work using a consistent idempotency strategy. This primarily addresses Scheduled job idempotent processing, not the specific gs.eventQueue dispatch from server script decision. Here, gs.eventQueue is a server-side event mechanism used for asynchronous downstream responses.
Question 339
An app integration unexpectedly receives a denied cross-scope script access response. After the recommended Runtime cross-scope access tracking change is implemented, which observation MOST directly verifies that it works?
- The approved operation succeeds and unapproved calls remain restricted.
- A consumer installation respects configured artifact edit and visibility restrictions.
- The controlled ACL or metadata change belongs to the intended application and passes review.
- Referential fields point to a user sys_id while logs show an appropriate readable label.
Explanation
Correct Answer
A:The approved operation succeeds and unapproved calls remain restricted. This directly tests whether the Runtime cross-scope access tracking goal was met. Cross-scope privilege records track and govern permitted interactions.
Incorrect Answers
B:A consumer installation respects configured artifact edit and visibility restrictions. This is evidence about Protected application files and distribution, not direct proof of the required Runtime cross-scope access tracking behavior. The relevant check is that the approved operation succeeds and unapproved calls remain restricted.
C:The controlled ACL or metadata change belongs to the intended application and passes review. This is evidence about Scope context and security rule ownership, not direct proof of the required Runtime cross-scope access tracking behavior. The relevant check is that the approved operation succeeds and unapproved calls remain restricted.
D:Referential fields point to a user sys_id while logs show an appropriate readable label. This is evidence about gs.getUserName versus sys_id, not direct proof of the required Runtime cross-scope access tracking behavior. The relevant check is that the approved operation succeeds and unapproved calls remain restricted.
Question 340
A developer wants to publish an application event when an equipment request is approved. A reviewer proposes this shortcut: Assume creating a notification alone automatically registers every custom event string. Which principle BEST explains why a different solution is needed?
- Shared Script Includes centralize server business logic for maintainability.
- Registered events decouple a business signal from the listeners that respond.
- Namespaced properties reduce configuration conflicts among unrelated applications.
- Scheduled scripts run server logic according to schedule settings independent of interactive form updates.
Explanation
Correct Answer
B:Registered events decouple a business signal from the listeners that respond. The appropriate approach is to define an app-specific event in the event registry before raising it.
Incorrect Answers
A:Shared Script Includes centralize server business logic for maintainability. This is about Utility Script Include for scheduled jobs, not why the proposed Event registry for named events shortcut should be rejected. Raising misspelled event names can prevent intended listeners from firing.
C:Namespaced properties reduce configuration conflicts among unrelated applications. This is about Property naming in scoped applications, not why the proposed Event registry for named events shortcut should be rejected. Raising misspelled event names can prevent intended listeners from firing.
D:Scheduled scripts run server logic according to schedule settings independent of interactive form updates. This is about Scheduled Script Execution timing, not why the proposed Event registry for named events shortcut should be rejected. Raising misspelled event names can prevent intended listeners from firing.
