ServiceNow CAD Practice Test 74
Question 730
A Business Rule should conditionally permit a sensitive action by an operator. An engineer must explain the recommendation for gs.hasRole server authorization. Which underlying principle is the MOST accurate?
- Human-readable names and stable internal record identifiers serve different purposes.
- Security checks must protect actual data access regardless of how records are reached.
- Feedback methods communicate to the user and are not substitutes for access controls.
- gs.hasRole consults effective user role membership in a server-side context.
Explanation
Correct Answer
D:Gs.hasRole consults effective user role membership in a server-side context. Therefore the implementation decision is to use a documented server-side GlideSystem role check such as gs.hasRole with the intended role.
Incorrect Answers
A:Browser-only role detection is not reliable authorization for server mutations. This describes the separate gs.getUserName versus sys_id mechanism; the present case instead requires gs.hasRole server authorization.
B:Browser-only role detection is not reliable authorization for server mutations. Security checks must protect actual data access regardless of how records are reached.
C:Browser-only role detection is not reliable authorization for server mutations. Feedback methods communicate to the user and are not substitutes for access controls.
Question 731
A supervisor wants one-click access to an application's task records. Select TWO statements that correctly combine the List module target table method with evidence or its governing principle.
- Create or configure an application menu with the intended modules.
- Selecting the module opens the intended records list.
- Apply appropriate menu and module role restrictions and independently enforce data ACLs.
- Rename a module label and assume it changes the table queried by the module.
- Configure a module of the correct list type targeting the table.
Explanation
Correct Answers
B:Selecting the module opens the intended records list. This is directly observable validation of the List module target table result.
E:Configure a module of the correct list type targeting the table. This is the intended action for List module target table.
Incorrect Answers
A:Create or configure an application menu with the intended modules. This serves the different Application menu navigation objective, not the selected List module target table plan. Modules are navigation actions that point to lists, forms or other supported destinations.
C:Apply appropriate menu and module role restrictions and independently enforce data ACLs. This serves the different Module and menu role visibility objective, not the selected List module target table plan. Modules are navigation actions that point to lists, forms or other supported destinations.
D:Rename a module label and assume it changes the table queried by the module. This is not part of a safe or effective List module target table design. A module targeting the wrong table can display unrelated data.
Question 732
A reporting navigation section must appear only to authorized analyst roles. After the recommended Module and menu role visibility change is implemented, which observation MOST directly verifies that it works?
- The application navigator displays the menu for an eligible user.
- The intended dependency works with a recorded allowed cross-scope policy.
- Authorized users see the module and unauthorized users cannot retrieve the protected data.
- Navigation opens a list restricted by the expected filter and ACLs.
Explanation
Correct Answer
C:Authorized users see the module and unauthorized users cannot retrieve the protected data. This directly tests whether the Module and menu role visibility goal was met. Navigation visibility and table access are separate security concerns.
Incorrect Answers
A:The application navigator displays the menu for an eligible user. This is evidence about Application menu navigation, not direct proof of the required Module and menu role visibility behavior. The relevant check is that authorized users see the module and unauthorized users cannot retrieve the protected data.
B:The intended dependency works with a recorded allowed cross-scope policy. This is evidence about Scope privileges and tracking, not direct proof of the required Module and menu role visibility behavior. The relevant check is that authorized users see the module and unauthorized users cannot retrieve the protected data.
D:Navigation opens a list restricted by the expected filter and ACLs. This is evidence about Filtered module navigation, not direct proof of the required Module and menu role visibility behavior. The relevant check is that authorized users see the module and unauthorized users cannot retrieve the protected data.
Question 733
A new table needs required types and lengths defined before forms use them. Which practical correction or implementation decision is MOST directly appropriate?
- Define dictionary types and test data values in a development instance.
- Verify parent suitability and test inherited behavior before deploying.
- Use a string label to convert an underlying string field into a true date/time database field.
- Design a scoped table with appropriate field types and names.
Explanation
Correct Answer
A:Define dictionary types and test data values in a development instance. The intended behavior can be checked because stored values validate as intended dates, integers and bounded strings.
Incorrect Answers
B:Verify parent suitability and test inherited behavior before deploying. This could help Table extension and inherited fields, but it does not resolve the Dictionary field attributes and type safety case. Field dictionaries determine storage type and metadata beyond form appearance.
C:Use a string label to convert an underlying string field into a true date/time database field. This would not correct the Dictionary field attributes and type safety workflow. Treating every property as text can cause incorrect calculations and queries.
D:Design a scoped table with appropriate field types and names. This could help Application-owned table creation, but it does not resolve the Dictionary field attributes and type safety case. Field dictionaries determine storage type and metadata beyond form appearance.
Question 734
A developer wants a visible confirmation for a completed server action. An engineer must explain the recommendation for gs.addInfoMessage user feedback. Which underlying principle is the MOST accurate?
- GlideSystem can access system property values for server-side configuration.
- Feedback methods communicate to the user and are not substitutes for access controls.
- Administrator testing alone cannot demonstrate ordinary-user ACL behavior.
- gs.hasRole consults effective user role membership in a server-side context.
Explanation
Correct Answer
B:Feedback methods communicate to the user and are not substitutes for access controls. Therefore the implementation decision is to use a supported GlideSystem info or error message method for user-facing feedback where appropriate.
Incorrect Answers
A:Displaying a success message before verifying the write can conceal failure. GlideSystem can access system property values for server-side configuration.
C:Displaying a success message before verifying the write can conceal failure. This describes the separate Impersonation for end-user testing mechanism; the present case instead requires gs.addInfoMessage user feedback.
D:Displaying a success message before verifying the write can conceal failure. This describes the separate gs.hasRole server authorization mechanism; the present case instead requires gs.addInfoMessage user feedback.
Question 735
An organization requires properties to be traceable to their owning app. Select TWO statements that correctly combine the Property naming in scoped applications method with evidence or its governing principle.
- Use a unique, namespaced app property naming convention.
- Use one shared global property named mode to control every application without review.
- Define a well-named application property with documented type, default and governance.
- The owning application reads its own setting without collisions.
- Put property changes under authorized change management and test expected effects.
Explanation
Correct Answers
A:Use a unique, namespaced app property naming convention. This is the intended action for Property naming in scoped applications.
D:The owning application reads its own setting without collisions. This is directly observable validation of the Property naming in scoped applications result.
Incorrect Answers
B:Use one shared global property named mode to control every application without review. This is not part of a safe or effective Property naming in scoped applications design. Generic property names can be overwritten or misinterpreted across teams.
C:Define a well-named application property with documented type, default and governance. This serves the different Application properties for behavior toggles objective, not the selected Property naming in scoped applications plan. Namespaced properties reduce configuration conflicts among unrelated applications.
E:Put property changes under authorized change management and test expected effects. This serves the different Property change governance objective, not the selected Property naming in scoped applications plan. Namespaced properties reduce configuration conflicts among unrelated applications.
Question 736
A cleanup job touches many records and needs safe restart semantics. An engineer must explain the recommendation for Scheduled job idempotent processing. Which underlying principle is the MOST accurate?
- Shared Script Includes centralize server business logic for maintainability.
- Notifications select recipients and content based on events or record conditions.
- Repeating scheduled operations requires state tracking when writes are not naturally idempotent.
- Event parameters can carry contextual data between the event producer and consumer.
Explanation
Correct Answer
C:Repeating scheduled operations requires state tracking when writes are not naturally idempotent. Therefore the implementation decision is to query only eligible records and mark processed work using a consistent idempotency strategy.
Incorrect Answers
A:A job without processed markers can create repeated tasks or notifications. This describes the separate Utility Script Include for scheduled jobs mechanism; the present case instead requires Scheduled job idempotent processing.
B:A job without processed markers can create repeated tasks or notifications. This describes the separate Email notification trigger and condition mechanism; the present case instead requires Scheduled job idempotent processing.
D:A job without processed markers can create repeated tasks or notifications. Event parameters can carry contextual data between the event producer and consumer.
Question 737
A custom finance menu must be hidden from employees without finance access. Which approach BEST meets the requirement while respecting the system constraints?
- Assign appropriate Roles to each sensitive module and keep underlying ACLs.
- Treat menu hiding as complete protection against direct record queries.
- Set the application menu Roles restriction for authorized access and independently test ACLs.
- Create suitable application roles and assign them to intended groups or users.
Explanation
Correct Answer
C:Set the application menu Roles restriction for authorized access and independently test ACLs. Navigation roles control visibility; they do not replace table ACL authorization. Verification should demonstrate that finance-role users see the relevant menu while others cannot access its protected records.
Incorrect Answers
A:Assign appropriate Roles to each sensitive module and keep underlying ACLs. This primarily addresses Module-specific role requirements, not the specific Application menu role restriction decision. Here, navigation roles control visibility; they do not replace table ACL authorization.
B:Treat menu hiding as complete protection against direct record queries. This is an unsafe or ineffective shortcut for Application menu role restriction. A hidden menu can still leave a table accessible via direct URL or API.
D:Create suitable application roles and assign them to intended groups or users. This primarily addresses Application role assignment model, not the specific Application menu role restriction decision. Here, navigation roles control visibility; they do not replace table ACL authorization.
Question 738
An employee needs an explicit Create entry for the application table. An engineer must explain the recommendation for New-record module entry point. Which underlying principle is the MOST accurate?
- Reusing platform capabilities reduces duplicate schemas and unnecessary maintenance.
- Modules are navigation actions that point to lists, forms or other supported destinations.
- Modules can provide distinct navigation actions for creating versus listing records.
- Navigation visibility and table access are separate security concerns.
Explanation
Correct Answer
C:Modules can provide distinct navigation actions for creating versus listing records. Therefore the implementation decision is to configure a module that opens the appropriate new-record form.
Incorrect Answers
A:A list-only link may not meet a required direct creation path. Reusing platform capabilities reduces duplicate schemas and unnecessary maintenance.
B:A list-only link may not meet a required direct creation path. This describes the separate List module target table mechanism; the present case instead requires New-record module entry point.
D:A list-only link may not meet a required direct creation path. This describes the separate Module and menu role visibility mechanism; the present case instead requires New-record module entry point.
Question 739
A team plans to deploy a new app on a clean test instance. Select TWO statements that correctly combine the App installation dependencies method with evidence or its governing principle.
- Smoke-test records, roles, flows and integrations and retain supported recovery steps.
- Assume any exported app can run independently of all required plugins or packages.
- Review application records and installed version in My Company Applications or supported manager.
- Check required application dependencies and versions before installation.
- The clean test instance resolves dependencies and executes smoke tests.
Explanation
Correct Answers
D:Check required application dependencies and versions before installation. This is the intended action for App installation dependencies.
E:The clean test instance resolves dependencies and executes smoke tests. This is directly observable validation of the App installation dependencies result.
Incorrect Answers
A:Smoke-test records, roles, flows and integrations and retain supported recovery steps. This serves the different Post-install validation and rollback objective, not the selected App installation dependencies plan. App installation requires compatible dependencies and platform conditions.
B:Assume any exported app can run independently of all required plugins or packages. This is not part of a safe or effective App installation dependencies design. Installing without a dependency plan can leave missing tables or APIs.
C:Review application records and installed version in My Company Applications or supported manager. This serves the different My Company Applications lifecycle objective, not the selected App installation dependencies plan. App installation requires compatible dependencies and platform conditions.
Question 740
A user belongs to the right app scope but cannot read protected salary fields. Which approach BEST meets the requirement while respecting the system constraints?
- Configure permitted cross-scope table access and ACLs for the actual consumers.
- Build in the intended private application scope and use its generated namespace.
- Treat having a table in a private scope as proof no end-user security rules are needed.
- Apply both application scope restrictions and user-focused table or field ACLs.
Explanation
Correct Answer
D:Apply both application scope restrictions and user-focused table or field ACLs. Application scope is an artifact isolation mechanism while ACLs govern record or field access. Verification should demonstrate that a positive and negative role test proves both layers behave as intended.
Incorrect Answers
A:Configure permitted cross-scope table access and ACLs for the actual consumers. This primarily addresses Cross-scope table application access, not the specific Scope boundaries versus ACL authorizations decision. Here, application scope is an artifact isolation mechanism while ACLs govern record or field access.
B:Build in the intended private application scope and use its generated namespace. This primarily addresses Application scope namespace, not the specific Scope boundaries versus ACL authorizations decision. Here, application scope is an artifact isolation mechanism while ACLs govern record or field access.
C:Treat having a table in a private scope as proof no end-user security rules are needed. This is an unsafe or ineffective shortcut for Scope boundaries versus ACL authorizations. Confusing a scope prefix with a runtime user role can leak restricted records.
