ServiceNow CAD Practice Test 35
Question 340
A developer wants to publish an application event when an equipment request is approved. A reviewer proposes this shortcut: Assume creating a notification alone automatically registers every custom event string. Which principle BEST explains why a different solution is needed?
- Shared Script Includes centralize server business logic for maintainability.
- Registered events decouple a business signal from the listeners that respond.
- Namespaced properties reduce configuration conflicts among unrelated applications.
- Scheduled scripts run server logic according to schedule settings independent of interactive form updates.
Explanation
Correct Answer
B:Registered events decouple a business signal from the listeners that respond. The appropriate approach is to define an app-specific event in the event registry before raising it.
Incorrect Answers
A:Shared Script Includes centralize server business logic for maintainability. This is about Utility Script Include for scheduled jobs, not why the proposed Event registry for named events shortcut should be rejected. Raising misspelled event names can prevent intended listeners from firing.
C:Namespaced properties reduce configuration conflicts among unrelated applications. This is about Property naming in scoped applications, not why the proposed Event registry for named events shortcut should be rejected. Raising misspelled event names can prevent intended listeners from firing.
D:Scheduled scripts run server logic according to schedule settings independent of interactive form updates. This is about Scheduled Script Execution timing, not why the proposed Event registry for named events shortcut should be rejected. Raising misspelled event names can prevent intended listeners from firing.
Question 341
A custom application needs these inputs stored on matching target fields. An engineer must explain the recommendation for Producer variable mapping. Which underlying principle is the MOST accurate?
- Record producer completion is a user workflow that should report the actual created target.
- Record Producers provide a simplified record-creation interface for specified tables.
- UI policies offer declarative client-facing form behavior for mandatory, visible and read-only states.
- Catalog variables are user inputs that require explicit mapping or producer script logic.
Explanation
Correct Answer
D:Catalog variables are user inputs that require explicit mapping or producer script logic. Therefore the implementation decision is to map supported producer variables into the intended table columns and test transformations.
Incorrect Answers
A:Unmapped variables may not populate the intended target fields. This describes the separate Producer post-submission behavior mechanism; the present case instead requires Producer variable mapping.
B:Unmapped variables may not populate the intended target fields. This describes the separate Record Producer creates app record mechanism; the present case instead requires Producer variable mapping.
C:Unmapped variables may not populate the intended target fields. UI policies offer declarative client-facing form behavior for mandatory, visible and read-only states.
Question 342
A shared app depends on another scoped utility and fails after partial installation. If the relevant App installation dependencies safeguard is omitted, which outcome is the MOST directly associated failure?
- Installing without a dependency plan can leave missing tables or APIs.
- Copying only one script file is not equivalent to installing the packaged application.
- Unreviewed edits may introduce regressions or overbroad permissions.
- Unknown installed versions can create drift between test and production.
Explanation
Correct Answer
A:Installing without a dependency plan can leave missing tables or APIs. App installation requires compatible dependencies and platform conditions. The corrective approach is to document dependencies and test install on a representative target.
Incorrect Answers
B:Copying only one script file is not equivalent to installing the packaged application. This failure pattern belongs chiefly to Application repository release distribution; it is not the failure most directly tested in the App installation dependencies situation. Installing without a dependency plan can leave missing tables or APIs.
C:Unreviewed edits may introduce regressions or overbroad permissions. This failure pattern belongs chiefly to Code review and scoped contribution workflow; it is not the failure most directly tested in the App installation dependencies situation. Installing without a dependency plan can leave missing tables or APIs.
D:Unknown installed versions can create drift between test and production. This failure pattern belongs chiefly to My Company Applications lifecycle; it is not the failure most directly tested in the App installation dependencies situation. Installing without a dependency plan can leave missing tables or APIs.
Question 343
A team must review cross-scope access records for a planned integration. Which practical correction or implementation decision is MOST directly appropriate?
- Expose documented limited interfaces and test cross-scope invocation.
- Check current application context and ownership before saving changes.
- Test and document allowed inter-scope calls and deny unneeded ones.
- Treat all denied cross-scope calls as bugs to fix by globally turning off protection.
Explanation
Correct Answer
C:Test and document allowed inter-scope calls and deny unneeded ones. The intended behavior can be checked because the intended dependency works with a recorded allowed cross-scope policy.
Incorrect Answers
A:Expose documented limited interfaces and test cross-scope invocation. This could help Restricted cross-scope scripting, but it does not resolve the Scope privileges and tracking case. Runtime cross-scope controls provide a review boundary separate from data ACLs.
B:Check current application context and ownership before saving changes. This could help Application picker and context, but it does not resolve the Scope privileges and tracking case. Runtime cross-scope controls provide a review boundary separate from data ACLs.
D:Treat all denied cross-scope calls as bugs to fix by globally turning off protection. This would not correct the Scope privileges and tracking workflow. Approving all cross-scope privileges removes a layer of application isolation.
Question 344
A saved loan needs a related audit record created after insert. After the recommended After Business Rule related records change is implemented, which observation MOST directly verifies that it works?
- The message or supported field state appears when the form loads.
- Multiple callers get consistent results with one maintained implementation.
- A dependent record is created only after the relevant source operation.
- An onLoad client script can access the prepared permitted scratchpad value.
Explanation
Correct Answer
C:A dependent record is created only after the relevant source operation. This directly tests whether the After Business Rule related records goal was met. After rules run after database operations and can react to persisted changes.
Incorrect Answers
A:The message or supported field state appears when the form loads. This is evidence about onLoad client script initialization, not direct proof of the required After Business Rule related records behavior. The relevant check is that a dependent record is created only after the relevant source operation.
B:Multiple callers get consistent results with one maintained implementation. This is evidence about Script Include utility reuse, not direct proof of the required After Business Rule related records behavior. The relevant check is that a dependent record is created only after the relevant source operation.
D:An onLoad client script can access the prepared permitted scratchpad value. This is evidence about Display Business Rule and g_scratchpad, not direct proof of the required After Business Rule related records behavior. The relevant check is that a dependent record is created only after the relevant source operation.
Question 345
A department needs eligible users to reach a producer but protect the created records. Which practical correction or implementation decision is MOST directly appropriate?
- Confirm target record creation before presenting the completed state.
- Set and validate initial values in the supported producer creation context.
- Test both catalog availability and server-side target ACL controls.
- Assume a publicly visible producer automatically grants permanent read access to every created record.
Explanation
Correct Answer
C:Test both catalog availability and server-side target ACL controls. The intended behavior can be checked because eligible users create appropriate records while unauthorized create and read attempts fail.
Incorrect Answers
A:Confirm target record creation before presenting the completed state. This could help Producer post-submission behavior, but it does not resolve the Record producer access and audience case. Producer visibility and target-table access are distinct authorization concerns.
B:Set and validate initial values in the supported producer creation context. This could help Producer script for controlled assignment, but it does not resolve the Record producer access and audience case. Producer visibility and target-table access are distinct authorization concerns.
D:Assume a publicly visible producer automatically grants permanent read access to every created record. This would not correct the Record producer access and audience workflow. Relying on a hidden producer alone cannot block direct API record creation.
Question 346
A server utility reads a configurable app threshold that administrators can adjust. If the relevant gs.getProperty server configuration safeguard is omitted, which outcome is the MOST directly associated failure?
- Putting access-control decisions solely in a user-editable property can create bypasses.
- Treating a free-form group name as membership proof bypasses authorization.
- An overly broad read rule can expose sensitive records outside the intended app.
- Browser-only role detection is not reliable authorization for server mutations.
Explanation
Correct Answer
A:Putting access-control decisions solely in a user-editable property can create bypasses. GlideSystem can access system property values for server-side configuration. The corrective approach is to scope and document the property and preserve real ACL enforcement.
Incorrect Answers
B:Treating a free-form group name as membership proof bypasses authorization. This failure pattern belongs chiefly to gs.getUser().isMemberOf group membership; it is not the failure most directly tested in the gs.getProperty server configuration situation. Putting access-control decisions solely in a user-editable property can create bypasses.
C:An overly broad read rule can expose sensitive records outside the intended app. This failure pattern belongs chiefly to Table read access control; it is not the failure most directly tested in the gs.getProperty server configuration situation. Putting access-control decisions solely in a user-editable property can create bypasses.
D:Browser-only role detection is not reliable authorization for server mutations. This failure pattern belongs chiefly to gs.hasRole server authorization; it is not the failure most directly tested in the gs.getProperty server configuration situation. Putting access-control decisions solely in a user-editable property can create bypasses.
Question 347
A case form contains salary details that ordinary case readers must not access. If the relevant Field-level ACL for sensitive data safeguard is omitted, which outcome is the MOST directly associated failure?
- Granting access based on either unrelated condition alone may bypass intended restrictions.
- Approving every denied operation creates unsafe transitive privileges.
- A read role alone should not imply unrestricted mutation of records.
- Hiding a field in a form view does not prevent direct API reads.
Explanation
Correct Answer
D:Hiding a field in a form view does not prevent direct API reads. Table ACLs and field ACLs can both affect whether sensitive data is revealed. The corrective approach is to set field-level ACLs and verify results with actual low-privilege requests.
Incorrect Answers
A:This failure pattern belongs chiefly to Access control condition versus role; it is not the failure most directly tested in the Field-level ACL for sensitive data situation.
B:Approving every denied operation creates unsafe transitive privileges. This failure pattern belongs chiefly to Runtime cross-scope access tracking; it is not the failure most directly tested in the Field-level ACL for sensitive data situation. Hiding a field in a form view does not prevent direct API reads.
C:A read role alone should not imply unrestricted mutation of records. This failure pattern belongs chiefly to Table write operation ACL; it is not the failure most directly tested in the Field-level ACL for sensitive data situation. Hiding a field in a form view does not prevent direct API reads.
Question 348
A client script shows a user-friendly warning when a numeric value is invalid. Which approach BEST meets the requirement while respecting the system constraints?
- Configure form layout or Form Designer sections and organize fields by user task.
- Pair client feedback with server-side or data policy validation as appropriate.
- Assume a browser onSubmit script alone protects every integration write.
- Configure tailored form views and assign views through supported mechanisms.
Explanation
Correct Answer
B:Pair client feedback with server-side or data policy validation as appropriate. Client behavior improves usability but is not a trusted server security or integrity boundary. Verification should demonstrate that invalid entries fail on both form submission and non-form write paths.
Incorrect Answers
A:Configure form layout or Form Designer sections and organize fields by user task. This primarily addresses Form layout sections and field placement, not the specific Client-side validation versus authoritative enforcement decision. Here, client behavior improves usability but is not a trusted server security or integrity boundary.
C:Assume a browser onSubmit script alone protects every integration write. This is an unsafe or ineffective shortcut for Client-side validation versus authoritative enforcement. A REST update may bypass browser-only checks and store invalid data.
D:Configure tailored form views and assign views through supported mechanisms. This primarily addresses Multiple form views by persona, not the specific Client-side validation versus authoritative enforcement decision. Here, client behavior improves usability but is not a trusted server security or integrity boundary.
Question 349
A workflow must skip a sensitive action for an ineligible request. Testing exposes this failure: A missing condition may send every case to the privileged branch. Which remediation should be applied FIRST?
- Let an action run unconditionally and rely on users to undo unauthorized results.
- Configure supported failure handling, controlled retries and notifications for the flow.
- Test both true and false paths with representative records.
- Review existing Workflow behavior and select an appropriate supported Flow Designer design for new automation.
Explanation
Correct Answer
C:Test both true and false paths with representative records. Confirmation requires seeing that tests traverse only the intended branch and record branch outcomes.
Incorrect Answers
A:Let an action run unconditionally and rely on users to undo unauthorized results. This retains the Flow conditions and branching problem. Conditional flow logic determines which actions execute based on evaluated inputs.
B:Configure supported failure handling, controlled retries and notifications for the flow. It addresses Flow action error handling and retry, not the diagnosed Flow conditions and branching failure. A missing condition may send every case to the privileged branch.
D:Review existing Workflow behavior and select an appropriate supported Flow Designer design for new automation. It addresses Workflow versus Flow Designer lifecycle, not the diagnosed Flow conditions and branching failure. A missing condition may send every case to the privileged branch.
Question 350
A project form should display its child tasks under the parent record. If the relevant Related lists on forms safeguard is omitted, which outcome is the MOST directly associated failure?
- Maintaining only one sprawling view can hinder usability for distinct personas.
- Missing relationship configuration can make the related list empty or misleading.
- Creating choice labels without consistent internal semantics can break filters and rules.
- A UI policy cannot replace ACL enforcement or every server-side data validation.
Explanation
Correct Answer
B:Missing relationship configuration can make the related list empty or misleading. Related lists expose relationships to records rather than concatenating child IDs into a text field. The corrective approach is to verify underlying references and include the correct related list.
Incorrect Answers
A:Maintaining only one sprawling view can hinder usability for distinct personas. This failure pattern belongs chiefly to Multiple form views by persona; it is not the failure most directly tested in the Related lists on forms situation. Missing relationship configuration can make the related list empty or misleading.
C:Creating choice labels without consistent internal semantics can break filters and rules. This failure pattern belongs chiefly to Choice definitions and dependent choices; it is not the failure most directly tested in the Related lists on forms situation. Missing relationship configuration can make the related list empty or misleading.
D:A UI policy cannot replace ACL enforcement or every server-side data validation. This failure pattern belongs chiefly to UI policies for required and visible fields; it is not the failure most directly tested in the Related lists on forms situation. Missing relationship configuration can make the related list empty or misleading.