ServiceNow CAD Practice Test 77
Question 760
A saved loan needs a related audit record created after insert. Which approach BEST meets the requirement while respecting the system constraints?
- Encapsulate shared server logic in a scoped Script Include and call it from eligible contexts.
- Use an async Business Rule where delayed processing meets the business requirement.
- Call current.update repeatedly inside an after rule without controlling recursion.
- Use an after Business Rule for post-save related actions, avoiding recursion.
Explanation
Correct Answer
D:Use an after Business Rule for post-save related actions, avoiding recursion. After rules run after database operations and can react to persisted changes. Verification should demonstrate that a dependent record is created only after the relevant source operation.
Incorrect Answers
A:Encapsulate shared server logic in a scoped Script Include and call it from eligible contexts. This primarily addresses Script Include utility reuse, not the specific After Business Rule related records decision. Here, after rules run after database operations and can react to persisted changes.
B:Use an async Business Rule where delayed processing meets the business requirement. This primarily addresses Async Business Rule processing, not the specific After Business Rule related records decision. Here, after rules run after database operations and can react to persisted changes.
C:Call current.update repeatedly inside an after rule without controlling recursion. This is an unsafe or ineffective shortcut for After Business Rule related records. Using an inappropriate before-rule dependency on a not-yet-saved sys_id can fail.
Question 761
A Record Producer collects requester and asset details as variables. If the relevant Producer variable mapping safeguard is omitted, which outcome is the MOST directly associated failure?
- A UI policy cannot replace ACL enforcement or every server-side data validation.
- Unmapped variables may not populate the intended target fields.
- A misleading success message can hide a failed write or create duplicate retries.
- Creating a catalog item alone may produce a request item rather than the intended app record.
Explanation
Correct Answer
B:Unmapped variables may not populate the intended target fields. Catalog variables are user inputs that require explicit mapping or producer script logic. The corrective approach is to test variable-to-field mapping and type conversion on creation.
Incorrect Answers
A:A UI policy cannot replace ACL enforcement or every server-side data validation. This failure pattern belongs chiefly to UI policies for required and visible fields; it is not the failure most directly tested in the Producer variable mapping situation. Unmapped variables may not populate the intended target fields.
C:A misleading success message can hide a failed write or create duplicate retries. This failure pattern belongs chiefly to Producer post-submission behavior; it is not the failure most directly tested in the Producer variable mapping situation. Unmapped variables may not populate the intended target fields.
D:Creating a catalog item alone may produce a request item rather than the intended app record. This failure pattern belongs chiefly to Record Producer creates app record; it is not the failure most directly tested in the Producer variable mapping situation. Unmapped variables may not populate the intended target fields.
Question 762
A second custom app should not insert or delete records in the first app's table. Select TWO statements that correctly combine the Table application access and CRUD scope method with evidence or its governing principle.
- Enable every Create Read Update Delete option for all scopes without checking the integration contract.
- Authorized read requests succeed while forbidden cross-scope writes fail.
- Review cross-scope access tracking and approve the specific required privilege if justified.
- Configure allowed cross-scope operations at the target table and separately define ACLs.
- Keep internal application files within private scope and expose only approved APIs.
Explanation
Correct Answers
B:Authorized read requests succeed while forbidden cross-scope writes fail. This is directly observable validation of the Table application access and CRUD scope result.
D:Configure allowed cross-scope operations at the target table and separately define ACLs. This is the intended action for Table application access and CRUD scope.
Incorrect Answers
A:Enable every Create Read Update Delete option for all scopes without checking the integration contract. This is not part of a safe or effective Table application access and CRUD scope design. Making a table accessible from all scopes does not by itself authorize end users.
C:Review cross-scope access tracking and approve the specific required privilege if justified. This serves the different Runtime cross-scope access tracking objective, not the selected Table application access and CRUD scope plan. Table application access determines cross-scope operation possibilities beyond user permissions.
E:Keep internal application files within private scope and expose only approved APIs. This serves the different Private scope protects internal application files objective, not the selected Table application access and CRUD scope plan. Table application access determines cross-scope operation possibilities beyond user permissions.
Question 763
A billing app exposes a read-only shared reference table to a scheduling app. If the relevant Table application access and CRUD scope safeguard is omitted, which outcome is the MOST directly associated failure?
- Making a table accessible from all scopes does not by itself authorize end users.
- Marking all utilities public increases unnecessary coupling and attack surface.
- Arbitrary edits to foreign-scope ACLs can break isolation and fail permissions.
- A broadly visible sensitive module increases confusion and disclosure risk.
Explanation
Correct Answer
A:Making a table accessible from all scopes does not by itself authorize end users. Table application access determines cross-scope operation possibilities beyond user permissions. The corrective approach is to apply least-privileged cross-scope permissions and negative test operations.
Incorrect Answers
B:This failure pattern belongs chiefly to Private scope protects internal application files; it is not the failure most directly tested in the Table application access and CRUD scope situation.
C:This failure pattern belongs chiefly to Scope context and security rule ownership; it is not the failure most directly tested in the Table application access and CRUD scope situation.
D:A broadly visible sensitive module increases confusion and disclosure risk. This failure pattern belongs chiefly to Module-specific role requirements; it is not the failure most directly tested in the Table application access and CRUD scope situation. Making a table accessible from all scopes does not by itself authorize end users.
Question 764
A form must show a result computed from a scoped server utility. Which approach BEST meets the requirement while respecting the system constraints?
- Expect getXMLWait to be supported in every modern mobile or service portal client.
- Use an onSubmit client script to provide feedback and return false when invalid.
- Use an accessible client-callable Script Include with asynchronous GlideAjax and validated input.
- Use onChange with checks for isLoading and the relevant old/new value.
Explanation
Correct Answer
C:Use an accessible client-callable Script Include with asynchronous GlideAjax and validated input. GlideAjax enables supported asynchronous calls from client logic to server Script Includes. Verification should demonstrate that a callback receives only the permitted result and the form remains responsive.
Incorrect Answers
A:Expect getXMLWait to be supported in every modern mobile or service portal client. This is an unsafe or ineffective shortcut for GlideAjax asynchronous client-server pattern. Synchronous wait calls or unbounded client record queries can harm performance or fail in some UIs.
B:Use an onSubmit client script to provide feedback and return false when invalid. This primarily addresses onSubmit client script validation, not the specific GlideAjax asynchronous client-server pattern decision. Here, glideAjax enables supported asynchronous calls from client logic to server Script Includes.
D:Use onChange with checks for isLoading and the relevant old/new value. This primarily addresses onChange client script guards, not the specific GlideAjax asynchronous client-server pattern decision. Here, glideAjax enables supported asynchronous calls from client logic to server Script Includes.
Question 765
Three app flows repeat the same approval notification sequence. After the recommended Reusable subflow design change is implemented, which observation MOST directly verifies that it works?
- Evidence identifies trigger record, step inputs, error and controlled correction.
- Execution details show later actions receive actual values from the intended source.
- The event appears with its expected name and processing after an approved action.
- Multiple calling flows complete the same validated subflow behavior.
Explanation
Correct Answer
D:Multiple calling flows complete the same validated subflow behavior. This directly tests whether the Reusable subflow design goal was met. Subflows support reusable automation with explicit input and output contracts.
Incorrect Answers
A:Evidence identifies trigger record, step inputs, error and controlled correction. This is evidence about Flow execution logs and troubleshooting, not direct proof of the required Reusable subflow design behavior. The relevant check is that multiple calling flows complete the same validated subflow behavior.
B:Execution details show later actions receive actual values from the intended source. This is evidence about Flow Designer data pills, not direct proof of the required Reusable subflow design behavior. The relevant check is that multiple calling flows complete the same validated subflow behavior.
C:The event appears with its expected name and processing after an approved action. This is evidence about Event registry for named events, not direct proof of the required Reusable subflow design behavior. The relevant check is that multiple calling flows complete the same validated subflow behavior.
Question 766
An approved app requires a reusable validation Script Include from another app. Which approach BEST meets the requirement while respecting the system constraints?
- Assume a Script Include is public in every scope solely because its name is known.
- Configure the Script Include's accessible-from setting and relevant caller restrictions.
- Configure allowed cross-scope operations at the target table and separately define ACLs.
- Switch to an authorized scope and follow the platform's security rules for the target object.
Explanation
Correct Answer
B:Configure the Script Include's accessible-from setting and relevant caller restrictions. Cross-scope API exposure should be intentional to protect app boundaries. Verification should demonstrate that authorized caller contexts invoke the API while unrelated contexts fail.
Incorrect Answers
A:Assume a Script Include is public in every scope solely because its name is known. This is an unsafe or ineffective shortcut for Script Include accessible from scope setting. Unrestricted cross-scope method calls can bypass planned encapsulation.
C:Configure allowed cross-scope operations at the target table and separately define ACLs. This primarily addresses Table application access and CRUD scope, not the specific Script Include accessible from scope setting decision. Here, cross-scope API exposure should be intentional to protect app boundaries.
D:Switch to an authorized scope and follow the platform's security rules for the target object. This primarily addresses Scope context and security rule ownership, not the specific Script Include accessible from scope setting decision. Here, cross-scope API exposure should be intentional to protect app boundaries.
Question 767
A department needs a ticket to reference its owning location without copying every location attribute. Testing exposes this failure: Typing display names into arbitrary strings creates stale and ambiguous links. Which remediation should be applied FIRST?
- Extend a suitable parent table after reviewing inheritance implications.
- Create and test a reference relationship with appropriate access controls.
- Model the relationship with a suitable many-to-many association table.
- Store user names as comma-separated free text and assume they are reliable foreign keys.
Explanation
Correct Answer
B:Create and test a reference relationship with appropriate access controls. Confirmation requires seeing that reference selection opens and resolves the correct existing record.
Incorrect Answers
A:Extend a suitable parent table after reviewing inheritance implications. It addresses Table extension and inherited fields, not the diagnosed Reference field relations failure. Typing display names into arbitrary strings creates stale and ambiguous links.
C:Model the relationship with a suitable many-to-many association table. It addresses Many-to-many relationship tables, not the diagnosed Reference field relations failure. Typing display names into arbitrary strings creates stale and ambiguous links.
D:Store user names as comma-separated free text and assume they are reliable foreign keys. This retains the Reference field relations problem. Reference fields model relationships using a target table rather than ordinary unvalidated text.
Question 768
A team wants to publish a scoped custom application to other company instances. A reviewer proposes this shortcut: Assume a code snippet pasted into another instance carries every table and ACL dependency. Which principle BEST explains why a different solution is needed?
- Installation success alone does not validate full business behavior.
- Application Repository supports sharing and controlled installation of application versions.
- Installed application management identifies versioned app artifacts rather than only source folders.
- Delegation does not eliminate the need for review and test evidence.
Explanation
Correct Answer
B:Application Repository supports sharing and controlled installation of application versions. The appropriate approach is to use the supported Application Repository distribution and installation workflow where applicable.
Incorrect Answers
A:Installation success alone does not validate full business behavior. This is about Post-install validation and rollback, not why the proposed Application repository release distribution shortcut should be rejected. Copying only one script file is not equivalent to installing the packaged application.
C:Installed application management identifies versioned app artifacts rather than only source folders. This is about My Company Applications lifecycle, not why the proposed Application repository release distribution shortcut should be rejected. Copying only one script file is not equivalent to installing the packaged application.
D:Delegation does not eliminate the need for review and test evidence. This is about Code review and scoped contribution workflow, not why the proposed Application repository release distribution shortcut should be rejected. Copying only one script file is not equivalent to installing the packaged application.
Question 769
High-priority cases should enter approval while ordinary cases follow a different path. After the recommended Flow conditions and branching change is implemented, which observation MOST directly verifies that it works?
- Tests traverse only the intended branch and record branch outcomes.
- Failed steps leave an inspectable execution record and avoid duplicate side effects.
- A test notification uses only authorized event context.
- Execution details show later actions receive actual values from the intended source.
Explanation
Correct Answer
A:Tests traverse only the intended branch and record branch outcomes. This directly tests whether the Flow conditions and branching goal was met. Conditional flow logic determines which actions execute based on evaluated inputs.
Incorrect Answers
B:Failed steps leave an inspectable execution record and avoid duplicate side effects. This is evidence about Flow action error handling and retry, not direct proof of the required Flow conditions and branching behavior. The relevant check is that tests traverse only the intended branch and record branch outcomes.
C:A test notification uses only authorized event context. This is evidence about Event parameters for notifications, not direct proof of the required Flow conditions and branching behavior. The relevant check is that tests traverse only the intended branch and record branch outcomes.
D:Execution details show later actions receive actual values from the intended source. This is evidence about Flow Designer data pills, not direct proof of the required Flow conditions and branching behavior. The relevant check is that tests traverse only the intended branch and record branch outcomes.
Question 770
A project app must permit reading while limiting edits to authorized groups. Which practical correction or implementation decision is MOST directly appropriate?
- Investigate ACL decisions and apply the smallest permission fix.
- Put a read ACL on a table and assume it automatically enforces a manager-only write policy.
- Define an operation-specific write policy and test record updates.
- Validate scripted ACL behavior for direct record and API requests.
Explanation
Correct Answer
C:Define an operation-specific write policy and test record updates. The intended behavior can be checked because unauthorized write attempts are rejected while permissible reads still succeed.
Incorrect Answers
A:Investigate ACL decisions and apply the smallest permission fix. This could help Access Control Debug and denial analysis, but it does not resolve the Table write operation ACL case. Read and write authorizations are separate operations that may have different rules.
B:Put a read ACL on a table and assume it automatically enforces a manager-only write policy. This would not correct the Table write operation ACL workflow. A read role alone should not imply unrestricted mutation of records.
D:Validate scripted ACL behavior for direct record and API requests. This could help Scripted ACL conditional check, but it does not resolve the Table write operation ACL case. Read and write authorizations are separate operations that may have different rules.