Free ServiceNow Certified Application Developer (CAD) practice test: 30 questions with answers

A field-level read ACL enforces the restriction on the server for that specific field, so it applies to every access path. A table-level ACL controls the whole record, not one field. A client script can be bypassed through the API, and a data policy warns but does not restrict.

A read ACL for the sales role allows reading, and the absence of a write grant leaves records unchangeable for that group. The admin role gives far more than read access, disabling access control removes protection for everyone, and shared logins break accountability.

gs.hasRole checks whether the current user has the role, so the script can gate the action on that check. Logging, deleting and date formatting do not check roles, and deleteMultiple is destructive.

Field-level read ACLs restrict only the sensitive fields, so the user can read the rest of the table. The admin role gives everything, removing the read ACL exposes the table to everyone, and hiding the form blocks the fields the user needs.

Server-side checks cannot be bypassed by a user's browser, and keeping sensitive fields out of client-side scripts prevents them from reaching the browser at all. Credentials in client scripts can be read by anyone, and disabling ACL checks or running unrestricted queries from the browser removes protection.

Adding the field to the table dictionary creates the data element, and placing it on the form layout makes it visible to users. Creating a new table for every form moves records and breaks the standard model. Adding a field to Task does not place it on the incident form without a layout change, and an HTML snippet displays nothing in the data model.

A script include holds a reusable server-side function that any business rule can call, so the logic lives in one place. UI macros and notification templates do not hold validation logic, and client transfer rules are not a reuse mechanism for server-side checks.

A reference field links each certification to a record in the Vendor table, which keeps the relationship consistent and queryable. Typed names drift and misspell, a hard-coded choice list goes stale, and a journal field stores notes rather than a relationship.

A separate line item table with a reference to the contract models the one-to-many relationship, so each item is a queryable record. Long text fields and choice lists cannot hold structured attributes, and one table with columns for every attribute produces sparse, hard-to-maintain data.

Tables and their fields, together with dictionary entries and relationships between tables, form the data model. Bookmarks, cached images and email signatures are browser or user settings, not part of the application's data model.

A before business rule on update runs on the server before the record is written, so the assignment group is set in the same transaction and cannot be skipped by the user. A client script can be bypassed, and an hourly job or a manual button delays the change and depends on people.

Flow Designer provides a record trigger on resolution and actions to send the notification, which handles this multi-step logic in one place. Update sets package changes, import sets load data, and list layouts only change display.

A scheduled script execution runs a script on a recurring schedule, which fits a nightly job. A UI action needs a user to click, a notification template defines a message without scheduling it, and a client script runs in the browser.

Duplicate emails usually come from two rules performing the same action, or one rule firing on both insert and update. Recipient counts and slow mail servers do not duplicate a message, and update sets do not send notifications.

Record triggers fire when records change, and scheduled triggers run on a recurrence. Cache clearing, console scripts and keyboard shortcuts are not flow triggers.

A saved filter shared with the group gives every member the same default view of active incidents assigned to their group. A read-only section shows one record, not a list. Client scripts that delete records are unsafe, and update sets move configuration rather than filter a list.

A UI policy with a condition on the category field makes the field mandatory only when the condition is true, and it needs no server script. A business rule that runs on save and applies to all categories is wrong, and a data policy is not conditional on the category value in this way.

A form view for a role gives managers their own layout while agents keep theirs, and the data stays the same. A scheduled job or a script include that changes form HTML is a fragile workaround, and an ACL removes access rather than changing layout.

An onLoad client script runs when the form is displayed, which is when the field needs its value. A before business rule runs on save on the server, a scheduled job runs at fixed times, and transform maps apply during imports.

A list control with the chosen columns and a shared saved filter give the group the same columns and records. Hard-coded rows go stale, separate table copies duplicate data, and PDF exports are snapshots rather than a consistent live view.

An import set stages the CSV rows, and a transform map maps the source columns to target fields and fields to the destination table. UI policies, variable sets and ACLs do not load data from files.

The Table API is a REST interface that lets external systems create and update records with authenticated requests. A UI page needs a person, an import set without a transform stages data without applying it, and a client script runs in a browser rather than as an integration.

A field map script in the transform map can run a GlideRecord query to find the matching record during the transform. UI policies affect forms, ACLs affect access, and scheduled jobs do not perform the lookup inside the transform.

A REST integration that looks up the value when needed shows current data without storing a copy. Imports store data and make it stale, UI macros render static content, and update sets carry configuration rather than live values.

A transform map condition, or run-if script, filters which rows the map processes, so only ready rows are transformed. UI policies affect forms, ACLs control access, and notifications report but do not filter processing.

An update set captures configuration changes so they can be previewed, reviewed and committed to another instance. Data policies, scheduled jobs and notification templates are runtime features, not promotion packages.

Source control integration keeps code versioned, branched and reviewed across developers, which update sets in a shared folder do not provide. Emailing files or editing production directly lose history and bypass review.

The update set's list of captured changes shows each configuration record included in the package, which is what the reviewer needs. Customer Service, journal fields and time cards do not show the contents of an update set.

Testing in a sub-production instance and reviewing the update set before promotion reduce the risk of defects and unintended changes reaching production. Changing production directly, skipping tests and deleting update sets without backup all increase risk.

An update set captures both records together so they move as one package and can be reviewed before commit. Screenshots and emailed code cannot be applied, and a scheduled job copying code is an uncontrolled deployment.