ServiceNow CAD Practice Test 46
Question 450
A security reviewer needs evidence of access by several app personas. Which practical correction or implementation decision is MOST directly appropriate?
- Test both navigation visibility and record security as different users.
- Declare ACL tests passed because the admin account can open every form.
- Test security with direct read attempts and impersonated users.
- Validate positive and negative security scenarios with representative identities.
Explanation
Correct Answer
D:Validate positive and negative security scenarios with representative identities. The intended behavior can be checked because read, create and write results match an explicit access matrix for each persona.
Incorrect Answers
A:Test both navigation visibility and record security as different users. This could help Application menu role restriction, but it does not resolve the Impersonation for end-user testing case. Administrator testing alone cannot demonstrate ordinary-user ACL behavior.
B:Declare ACL tests passed because the admin account can open every form. This would not correct the Impersonation for end-user testing workflow. Testing only as admin may mask missing permissions or overly broad access.
C:Test security with direct read attempts and impersonated users. This could help Distinguish module access from record roles, but it does not resolve the Impersonation for end-user testing case. Administrator testing alone cannot demonstrate ordinary-user ACL behavior.
Question 451
An import set contains external field cost_center_text but the target table uses a reference. Which approach BEST meets the requirement while respecting the system constraints?
- Mark a suitable unique field map as Coalesce and validate key uniqueness.
- Apply controlled transform validation such as an onBefore script and audit skipped rows.
- Define an appropriate Transform Map and explicit field maps for source to target values.
- Rename only the CSV filename and assume the column mapping is corrected.
Explanation
Correct Answer
C:Define an appropriate Transform Map and explicit field maps for source to target values. Transform Maps determine how import set fields populate target table fields. Verification should demonstrate that imported records show correct target columns and mapped references.
Incorrect Answers
A:Mark a suitable unique field map as Coalesce and validate key uniqueness. This primarily addresses Coalesce for update versus insert, not the specific Transform map source-to-target mapping decision. Here, transform Maps determine how import set fields populate target table fields.
B:Apply controlled transform validation such as an onBefore script and audit skipped rows. This primarily addresses Import reconciliation and onBefore rejection, not the specific Transform map source-to-target mapping decision. Here, transform Maps determine how import set fields populate target table fields.
D:Rename only the CSV filename and assume the column mapping is corrected. This is an unsafe or ineffective shortcut for Transform map source-to-target mapping. An unconfigured map can leave target fields blank or misdirect values.
Question 452
A flow action and an event handler also need the same server-side validation. Which practical correction or implementation decision is MOST directly appropriate?
- Depend on a browser client script being present when a background job executes.
- Define and test one reusable utility with correct scoped access.
- Limit event parameter content and verify listener behavior.
- Validate the event name, instance record and optional parameters.
Explanation
Correct Answer
B:Define and test one reusable utility with correct scoped access. The intended behavior can be checked because the job and event consumer produce consistent results on the same test records.
Incorrect Answers
A:Depend on a browser client script being present when a background job executes. This would not correct the Utility Script Include for scheduled jobs workflow. Copying an algorithm into each event and job makes them drift during fixes.
C:Limit event parameter content and verify listener behavior. This could help Event parameters for notifications, but it does not resolve the Utility Script Include for scheduled jobs case. Shared Script Includes centralize server business logic for maintainability.
D:Validate the event name, instance record and optional parameters. This could help gs.eventQueue dispatch from server script, but it does not resolve the Utility Script Include for scheduled jobs case. Shared Script Includes centralize server business logic for maintainability.
Question 453
A department needs eligible users to reach a producer but protect the created records. Testing exposes this failure: Relying on a hidden producer alone cannot block direct API record creation. Which remediation should be applied FIRST?
- Map supported producer variables into the intended table columns and test transformations.
- Assume a publicly visible producer automatically grants permanent read access to every created record.
- Configure a Record Producer targeting the required app table and map its variables appropriately.
- Test both catalog availability and server-side target ACL controls.
Explanation
Correct Answer
D:Test both catalog availability and server-side target ACL controls. Confirmation requires seeing that eligible users create appropriate records while unauthorized create and read attempts fail.
Incorrect Answers
A:Map supported producer variables into the intended table columns and test transformations. It addresses Producer variable mapping, not the diagnosed Record producer access and audience failure. Relying on a hidden producer alone cannot block direct API record creation.
B:Assume a publicly visible producer automatically grants permanent read access to every created record. This retains the Record producer access and audience problem. Producer visibility and target-table access are distinct authorization concerns.
C:Configure a Record Producer targeting the required app table and map its variables appropriately. It addresses Record Producer creates app record, not the diagnosed Record producer access and audience failure. Relying on a hidden producer alone cannot block direct API record creation.
Question 454
A flow emits a named event and the listener needs context without a database-wide scan. An engineer must explain the recommendation for Event parameters for notifications. Which underlying principle is the MOST accurate?
- Scheduled scripts run server logic according to schedule settings independent of interactive form updates.
- Event parameters can carry contextual data between the event producer and consumer.
- Shared Script Includes centralize server business logic for maintainability.
- Server-side property access can supply configuration with optional default values.
Explanation
Correct Answer
B:Event parameters can carry contextual data between the event producer and consumer. Therefore the implementation decision is to supply documented event parameters when queuing the event and consume them safely.
Incorrect Answers
A:Passing secrets or unvalidated user-supplied addresses in event parameters can disclose data. This describes the separate Scheduled Script Execution timing mechanism; the present case instead requires Event parameters for notifications.
C:Passing secrets or unvalidated user-supplied addresses in event parameters can disclose data. This describes the separate Utility Script Include for scheduled jobs mechanism; the present case instead requires Event parameters for notifications.
D:Passing secrets or unvalidated user-supplied addresses in event parameters can disclose data. Server-side property access can supply configuration with optional default values.
Question 455
A production property adjusts who receives notifications and must not be modified casually. Which approach BEST meets the requirement while respecting the system constraints?
- Allow anonymous form users to modify application properties directly.
- Read an application property using gs.getProperty with a safe documented fallback.
- Parse and validate property strings into the expected data types before using them.
- Put property changes under authorized change management and test expected effects.
Explanation
Correct Answer
D:Put property changes under authorized change management and test expected effects. Configuration data can affect production behavior as seriously as code changes. Verification should demonstrate that reviewed before-and-after values and execution evidence match an approved change.
Incorrect Answers
A:Allow anonymous form users to modify application properties directly. This is an unsafe or ineffective shortcut for Property change governance. Uncontrolled edits can quietly reroute users or increase processing cost.
B:Read an application property using gs.getProperty with a safe documented fallback. This primarily addresses gs.getProperty with fallback, not the specific Property change governance decision. Here, configuration data can affect production behavior as seriously as code changes.
C:Parse and validate property strings into the expected data types before using them. This primarily addresses Parse property types explicitly, not the specific Property change governance decision. Here, configuration data can affect production behavior as seriously as code changes.
Question 456
A training application assigns many instructors to many courses. Which approach BEST meets the requirement while respecting the system constraints?
- Configure field types and dictionary attributes suited to data semantics.
- Store all associated sys_ids in one unlabeled free-text column as the full relational model.
- Model the relationship with a suitable many-to-many association table.
- Configure an appropriate choice field with defined stored values and user-facing labels.
Explanation
Correct Answer
C:Model the relationship with a suitable many-to-many association table. Many-to-many relations need an association rather than a single scalar reference. Verification should demonstrate that association records link each permitted pair without repeating primary entity records.
Incorrect Answers
A:Configure field types and dictionary attributes suited to data semantics. This primarily addresses Dictionary field attributes and type safety, not the specific Many-to-many relationship tables decision. Here, many-to-many relations need an association rather than a single scalar reference.
B:Store all associated sys_ids in one unlabeled free-text column as the full relational model. This is an unsafe or ineffective shortcut for Many-to-many relationship tables. Placing a single reference field on one side cannot represent all pairings.
D:Configure an appropriate choice field with defined stored values and user-facing labels. This primarily addresses Choice field value and label, not the specific Many-to-many relationship tables decision. Here, many-to-many relations need an association rather than a single scalar reference.
Question 457
An operations group wants a configurable process involving assignments and audit records. Which practical correction or implementation decision is MOST directly appropriate?
- Document gaps and extend existing features where they meet the business need.
- Include UI and ACL validation in an early feasibility prototype.
- Prototype the data model and user workflow before committing to custom development.
- Assume every unrelated business process requires a separately hosted custom web server.
Explanation
Correct Answer
C:Prototype the data model and user workflow before committing to custom development. The intended behavior can be checked because users submit records and reviewers see authorized assignment and approval history.
Incorrect Answers
A:Document gaps and extend existing features where they meet the business need. This could help Reuse standard capabilities versus bespoke application, but it does not resolve the Workflow fit for scoped applications case. ServiceNow application development suits record-centered business workflows with governed access.
B:Include UI and ACL validation in an early feasibility prototype. This could help Experience design and app permissions, but it does not resolve the Workflow fit for scoped applications case. ServiceNow application development suits record-centered business workflows with governed access.
D:Assume every unrelated business process requires a separately hosted custom web server. This would not correct the Workflow fit for scoped applications workflow. Choosing a record-free visualization engine would omit task state and audit trails.
Question 458
A connected vendor endpoint returns 403 for one request but 200 for another. If the relevant REST logging and diagnostics safeguard is omitted, which outcome is the MOST directly associated failure?
- An unconfigured map can leave target fields blank or misdirect values.
- Sending malformed JSON or wrong verbs produces rejected or incorrect requests.
- Hard-coded keys in shared scripts expose secrets and complicate rotation.
- Logging Authorization headers unredacted can expose credentials.
Explanation
Correct Answer
D:Logging Authorization headers unredacted can expose credentials. HTTP statuses and safe logs support distinguishing integration errors. The corrective approach is to record masked diagnostics and examine the failing endpoint and method.
Incorrect Answers
A:An unconfigured map can leave target fields blank or misdirect values. This failure pattern belongs chiefly to Transform map source-to-target mapping; it is not the failure most directly tested in the REST logging and diagnostics situation. Logging Authorization headers unredacted can expose credentials.
B:Sending malformed JSON or wrong verbs produces rejected or incorrect requests. This failure pattern belongs chiefly to REST endpoint and payload validation; it is not the failure most directly tested in the REST logging and diagnostics situation. Logging Authorization headers unredacted can expose credentials.
C:Hard-coded keys in shared scripts expose secrets and complicate rotation. This failure pattern belongs chiefly to REST authentication with stored credentials; it is not the failure most directly tested in the REST logging and diagnostics situation. Logging Authorization headers unredacted can expose credentials.
Question 459
A sensitive integration uses proprietary app logic not meant to be public interfaces. Which practical correction or implementation decision is MOST directly appropriate?
- Apply least-privileged cross-scope permissions and negative test operations.
- Confirm ownership and perform approved changes in the correct application context.
- Configure application access and verify cross-scope denial and allowed interfaces.
- Make every internal app helper globally accessible to avoid review.
Explanation
Correct Answer
C:Configure application access and verify cross-scope denial and allowed interfaces. The intended behavior can be checked because unrelated application contexts cannot invoke private files without permitted cross-scope access.
Incorrect Answers
A:Apply least-privileged cross-scope permissions and negative test operations. This could help Table application access and CRUD scope, but it does not resolve the Private scope protects internal application files case. Scope protection restricts application artifact usage across apps.
B:Confirm ownership and perform approved changes in the correct application context. This could help Scope context and security rule ownership, but it does not resolve the Private scope protects internal application files case. Scope protection restricts application artifact usage across apps.
D:Make every internal app helper globally accessible to avoid review. This would not correct the Private scope protects internal application files workflow. Marking all utilities public increases unnecessary coupling and attack surface.
Question 460
A newly deployed application opens but its workflow and ACLs behave differently than in development. After the recommended Post-install validation and rollback change is implemented, which observation MOST directly verifies that it works?
- The clean test instance resolves dependencies and executes smoke tests.
- A failed deployment is detected and a supported rollback or remediation path is available.
- The target instance installs the reviewed app version and dependencies successfully.
- The approved branch contains reviewed resolution and ServiceNow imports the intended revision.
Explanation
Correct Answer
B:A failed deployment is detected and a supported rollback or remediation path is available. This directly tests whether the Post-install validation and rollback goal was met. Installation success alone does not validate full business behavior.
Incorrect Answers
A:The clean test instance resolves dependencies and executes smoke tests. This is evidence about App installation dependencies, not direct proof of the required Post-install validation and rollback behavior. The relevant check is that a failed deployment is detected and a supported rollback or remediation path is available.
C:The target instance installs the reviewed app version and dependencies successfully. This is evidence about Application repository release distribution, not direct proof of the required Post-install validation and rollback behavior. The relevant check is that a failed deployment is detected and a supported rollback or remediation path is available.
D:The approved branch contains reviewed resolution and ServiceNow imports the intended revision. This is evidence about Branch and merge limitations in platform integration, not direct proof of the required Post-install validation and rollback behavior. The relevant check is that a failed deployment is detected and a supported rollback or remediation path is available.
