ServiceNow CAD Practice Test 45
Question 440
A development team needs to keep custom application source metadata in an external Git repository. Which approach BEST meets the requirement while respecting the system constraints?
- Configure supported Studio source control integration to the approved remote repository.
- Rename the app without configuring repository access and assume it starts committing automatically.
- Use supported source control retrieval or pull operations after reviewing branch and local changes.
- Review supported source control operations and resolve unsupported merges in appropriate external Git tooling.
Explanation
Correct Answer
A:Configure supported Studio source control integration to the approved remote repository. ServiceNow source control integration manages application metadata versions through repository operations. Verification should demonstrate that the app is linked to the expected repository and committed changes are traceable.
Incorrect Answers
B:Rename the app without configuring repository access and assume it starts committing automatically. This is an unsafe or ineffective shortcut for Link app to Git repository in Studio. Untracked manual editing can produce undocumented deployment drift.
C:Use supported source control retrieval or pull operations after reviewing branch and local changes. This primarily addresses Retrieve upstream source changes, not the specific Link app to Git repository in Studio decision. Here, serviceNow source control integration manages application metadata versions through repository operations.
D:Review supported source control operations and resolve unsupported merges in appropriate external Git tooling. This primarily addresses Branch and merge limitations in platform integration, not the specific Link app to Git repository in Studio decision. Here, serviceNow source control integration manages application metadata versions through repository operations.
Question 441
A change request says every artifact must belong to the new custom app. Which practical correction or implementation decision is MOST directly appropriate?
- Test and document allowed inter-scope calls and deny unneeded ones.
- Design cross-scope permissions and user ACLs separately.
- Assume the active browser tab always switches the ServiceNow application context automatically.
- Check current application context and ownership before saving changes.
Explanation
Correct Answer
D:Check current application context and ownership before saving changes. The intended behavior can be checked because the resulting application file belongs to the intended app scope.
Incorrect Answers
A:Test and document allowed inter-scope calls and deny unneeded ones. This could help Scope privileges and tracking, but it does not resolve the Application picker and context case. The active application determines ownership of many new configuration files.
B:Design cross-scope permissions and user ACLs separately. This could help Scope boundaries versus ACL authorizations, but it does not resolve the Application picker and context case. The active application determines ownership of many new configuration files.
C:Assume the active browser tab always switches the ServiceNow application context automatically. This would not correct the Application picker and context workflow. Making changes in the wrong scope complicates packaging and protection.
Question 442
A new reservation must be rejected when a required invariant is violated. A reviewer proposes this shortcut: Update the same record again from an after rule to perform simple pre-save field assignment. Which principle BEST explains why a different solution is needed?
- Before Business Rules act before the database operation in the applicable transaction.
- Client behavior improves usability but is not a trusted server security or integrity boundary.
- Script Includes support reusable server-side JavaScript rather than copying logic across rules.
- Display Business Rules can provide server-derived data to client form loading.
Explanation
Correct Answer
A:Before Business Rules act before the database operation in the applicable transaction. The appropriate approach is to use a before Business Rule in the proper table and operation to validate or adjust current.
Incorrect Answers
B:Client behavior improves usability but is not a trusted server security or integrity boundary. This is about Client-side validation versus authoritative enforcement, not why the proposed Before Business Rule validation shortcut should be rejected. Placing required pre-save validation only in a post-commit notification is too late.
C:Script Includes support reusable server-side JavaScript rather than copying logic across rules. This is about Script Include utility reuse, not why the proposed Before Business Rule validation shortcut should be rejected. Placing required pre-save validation only in a post-commit notification is too late.
D:Display Business Rules can provide server-derived data to client form loading. This is about Display Business Rule and g_scratchpad, not why the proposed Before Business Rule validation shortcut should be rejected. Placing required pre-save validation only in a post-commit notification is too late.
Question 443
A team needs traceable ownership of code changes from multiple delegated developers. An engineer must explain the recommendation for Code review and scoped contribution workflow. Which underlying principle is the MOST accurate?
- Source control rights may be assigned separately from general delegated editing.
- Installation success alone does not validate full business behavior.
- Delegation does not eliminate the need for review and test evidence.
- Delegated developer entitlements can restrict which app components each user edits.
Explanation
Correct Answer
C:Delegation does not eliminate the need for review and test evidence. Therefore the implementation decision is to use reviewed source changes, tests and an approval process for delegated contributions.
Incorrect Answers
A:Source control rights may be assigned separately from general delegated editing. This describes the separate Delegated source-control authorization mechanism; the present case instead requires Code review and scoped contribution workflow. Unreviewed edits may introduce regressions or overbroad permissions.
B:Installation success alone does not validate full business behavior. This describes the separate Post-install validation and rollback mechanism; the present case instead requires Code review and scoped contribution workflow. Unreviewed edits may introduce regressions or overbroad permissions.
D:Delegated developer entitlements can restrict which app components each user edits. This describes the separate File-type-specific delegated permissions mechanism; the present case instead requires Code review and scoped contribution workflow. Unreviewed edits may introduce regressions or overbroad permissions.
Question 444
A service owner wants to process authorized inbound messages into record updates. Which practical correction or implementation decision is MOST directly appropriate?
- Validate sender authorization and target record before applying the update.
- Treat a subject line containing an incident number as sufficient authentication for every update.
- Use approved recipient resolution and validate rendered email content.
- Test notification trigger cases and recipient selection.
Explanation
Correct Answer
A:Validate sender authorization and target record before applying the update. The intended behavior can be checked because test replies update the intended case only when sender and conditions permit.
Incorrect Answers
B:Treat a subject line containing an incident number as sufficient authentication for every update. This would not correct the Inbound email action parsing workflow. Trusting any sender and subject can let outsiders alter unrelated records.
C:Use approved recipient resolution and validate rendered email content. This could help Email recipients and templates, but it does not resolve the Inbound email action parsing case. Inbound email handlers can map received messages into application behavior.
D:Test notification trigger cases and recipient selection. This could help Email notification trigger and condition, but it does not resolve the Inbound email action parsing case. Inbound email handlers can map received messages into application behavior.
Question 445
A developer wants a visible confirmation for a completed server action. Testing exposes this failure: Displaying a success message before verifying the write can conceal failure. Which remediation should be applied FIRST?
- Check membership using an appropriate server-side GlideUser method such as gs.getUser().isMemberOf.
- Emit accurate messages after validating the operation and its outcome.
- Read gs.getUserID in server-side script where the effective user identity is required.
- Use gs.addInfoMessage alone to grant the user's record write permission.
Explanation
Correct Answer
B:Emit accurate messages after validating the operation and its outcome. Confirmation requires seeing that the form displays understandable feedback without exposing restricted data.
Incorrect Answers
A:Check membership using an appropriate server-side GlideUser method such as gs.getUser().isMemberOf. It addresses gs.getUser().isMemberOf group membership, not the diagnosed gs.addInfoMessage user feedback failure. Displaying a success message before verifying the write can conceal failure.
C:Read gs.getUserID in server-side script where the effective user identity is required. It addresses gs.getUserID for current identity, not the diagnosed gs.addInfoMessage user feedback failure. Displaying a success message before verifying the write can conceal failure.
D:Use gs.addInfoMessage alone to grant the user's record write permission. This retains the gs.addInfoMessage user feedback problem. Feedback methods communicate to the user and are not substitutes for access controls.
Question 446
A code review detects security metadata being authored under the wrong scope. An engineer must explain the recommendation for Scope context and security rule ownership. Which underlying principle is the MOST accurate?
- Table application access determines cross-scope operation possibilities beyond user permissions.
- Security metadata and application scope boundaries can constrain what ACLs may be edited.
- Read and write authorizations are separate operations that may have different rules.
- User access can depend on assigned roles and configured role relationships.
Explanation
Correct Answer
B:Security metadata and application scope boundaries can constrain what ACLs may be edited. Therefore the implementation decision is to switch to an authorized scope and follow the platform's security rules for the target object.
Incorrect Answers
A:Arbitrary edits to foreign-scope ACLs can break isolation and fail permissions. Table application access determines cross-scope operation possibilities beyond user permissions.
C:Arbitrary edits to foreign-scope ACLs can break isolation and fail permissions. This describes the separate Table write operation ACL mechanism; the present case instead requires Scope context and security rule ownership.
D:User access can depend on assigned roles and configured role relationships. This pertains to Role inclusion and effective access rather than the required Scope context and security rule ownership task. Security metadata and application scope boundaries can constrain what ACLs may be edited.
Question 447
A contributor modifies a scoped Script Include and requests approval before release. If the relevant Code review and scoped contribution workflow safeguard is omitted, which outcome is the MOST directly associated failure?
- File-edit permission alone need not imply permission to change repository links.
- Copying only one script file is not equivalent to installing the packaged application.
- Unreviewed edits may introduce regressions or overbroad permissions.
- Blanket all-file access undermines separation of duties.
Explanation
Correct Answer
C:Unreviewed edits may introduce regressions or overbroad permissions. Delegation does not eliminate the need for review and test evidence. The corrective approach is to require peer review and platform testing before promotion.
Incorrect Answers
A:File-edit permission alone need not imply permission to change repository links. This failure pattern belongs chiefly to Delegated source-control authorization; it is not the failure most directly tested in the Code review and scoped contribution workflow situation. Unreviewed edits may introduce regressions or overbroad permissions.
B:Copying only one script file is not equivalent to installing the packaged application. This failure pattern belongs chiefly to Application repository release distribution; it is not the failure most directly tested in the Code review and scoped contribution workflow situation. Unreviewed edits may introduce regressions or overbroad permissions.
D:Blanket all-file access undermines separation of duties. This failure pattern belongs chiefly to File-type-specific delegated permissions; it is not the failure most directly tested in the Code review and scoped contribution workflow situation. Unreviewed edits may introduce regressions or overbroad permissions.
Question 448
A team rotates integration credentials without editing application scripts. Which practical correction or implementation decision is MOST directly appropriate?
- Configure and test the outbound REST request using approved endpoints.
- Put an API secret in a client script because the browser will not display its JavaScript.
- Configure approved authentication and test expiry or rotation behavior.
- Check status, handle errors and parse expected response fields.
Explanation
Correct Answer
C:Configure approved authentication and test expiry or rotation behavior. The intended behavior can be checked because authorized calls succeed and credentials are absent from source code and public logs.
Incorrect Answers
A:Configure and test the outbound REST request using approved endpoints. This could help Outbound REST Message configuration, but it does not resolve the REST authentication with stored credentials case. Integration authentication should be managed separately from code configuration.
B:Put an API secret in a client script because the browser will not display its JavaScript. This would not correct the REST authentication with stored credentials workflow. Hard-coded keys in shared scripts expose secrets and complicate rotation.
D:Check status, handle errors and parse expected response fields. This could help RESTMessageV2 execution and response, but it does not resolve the REST authentication with stored credentials case. Integration authentication should be managed separately from code configuration.
Question 449
A user changes the request category and related guidance must refresh. Select TWO statements that correctly combine the onChange client script guards method with evidence or its governing principle.
- Use onChange with checks for isLoading and the relevant old/new value.
- The script responds to deliberate field changes without duplicate startup actions.
- Use an onLoad client script and supported g_form methods for initial presentation.
- Treat every onChange invocation during load as a confirmed user edit.
- Use documented g_form methods suited to the field and client context.
Explanation
Correct Answers
A:Use onChange with checks for isLoading and the relevant old/new value. This is the intended action for onChange client script guards.
B:The script responds to deliberate field changes without duplicate startup actions. This is directly observable validation of the onChange client script guards result.
Incorrect Answers
C:Use an onLoad client script and supported g_form methods for initial presentation. This serves the different onLoad client script initialization objective, not the selected onChange client script guards plan. onChange execution receives old and new values and a loading flag.
D:Treat every onChange invocation during load as a confirmed user edit. This is not part of a safe or effective onChange client script guards design. Ignoring the loading condition can produce unnecessary work while the form initializes.
E:Use documented g_form methods suited to the field and client context. This serves the different g_form API for form fields objective, not the selected onChange client script guards plan. onChange execution receives old and new values and a loading flag.
Question 450
A security reviewer needs evidence of access by several app personas. Which practical correction or implementation decision is MOST directly appropriate?
- Test both navigation visibility and record security as different users.
- Declare ACL tests passed because the admin account can open every form.
- Test security with direct read attempts and impersonated users.
- Validate positive and negative security scenarios with representative identities.
Explanation
Correct Answer
D:Validate positive and negative security scenarios with representative identities. The intended behavior can be checked because read, create and write results match an explicit access matrix for each persona.
Incorrect Answers
A:Test both navigation visibility and record security as different users. This could help Application menu role restriction, but it does not resolve the Impersonation for end-user testing case. Administrator testing alone cannot demonstrate ordinary-user ACL behavior.
B:Declare ACL tests passed because the admin account can open every form. This would not correct the Impersonation for end-user testing workflow. Testing only as admin may mask missing permissions or overly broad access.
C:Test security with direct read attempts and impersonated users. This could help Distinguish module access from record roles, but it does not resolve the Impersonation for end-user testing case. Administrator testing alone cannot demonstrate ordinary-user ACL behavior.
