Database Management & Platform Security Questions

Correct answer: A. LDAP; B. OIDC; D. JDBC

The Data sources topic lists the data source types File, JDBC, LDAP, OIDC, REST (Integration Hub), Data Stream Integration Hub and Custom (Load by Script). JDBC pulls from a database, LDAP from an LDAP server over port 389 or 636, and OIDC from a source reachable through OpenID Connect.

• Why C is wrong: JSON is a supported import file format, not a data source type. JSON files are loaded through a File type data source.
• Why E is wrong: Excel is a supported import file format (XLS or XLSX), not a data source type. Excel files are brought in through a File type data source.

Correct answer: A. None of the fields in the table

Record ACLs are processed table first, then field, and a user must pass both table and field ACLs to access a record object. If a user fails a table ACL, the user is denied access to all fields in the table, even if the user passes a field ACL, so the passing short_description ACL does not help.

• Why B is wrong: A passing field ACL only matters after the table ACL is passed. Failing the table ACL denies access to all fields, including Short description.
• Why C is wrong: Fields shown as read-only are the result of failing a write ACL. Failing a read table ACL denies access to the fields entirely.
• Why D is wrong: Fields without their own field ACL are still inside the table, and failing the table ACL denies access to all fields in that table.

Correct answer: D. The Applies-to field

The Applies-to field determines whether an ACL applies to a record at all; if it is empty, the ACL applies to all records. A data condition only evaluates an ACL that has already been applied. The docs give the example of Applies-To: Priority = P1 securing only Priority 1 incidents in the Incident table.

• Why A is wrong: Requires role is a condition the user must meet once the ACL matches. It does not limit which records the ACL applies to.
• Why B is wrong: A security attribute is a condition evaluated about the user or session, such as whether the user is authenticated. It does not decide which records the ACL applies to.
• Why C is wrong: A data condition is evaluation criteria for an ACL that is already applied. The Applies-to field, not the data condition, decides whether the ACL affects a record.

Correct answer: C. The *.number ACL

Field ACLs are matched in this order: table and field (incident.number), parent table and field (task.number), any table and field (*.number), table and any field (incident.*), parent table and any field (task.*), then any table and any field (*.*). With no incident.number or task.number ACL, *.number is evaluated first.

• Why A is wrong: *.* (any table and any field) is the last field ACL in the processing order.
• Why B is wrong: task.* (parent table and any field) is fifth in the order, after both *.number and incident.*.
• Why D is wrong: incident.* (table and any field) is fourth in the order, after *.number (any table and the field name).

Correct answer: B. No field map in the transform map is set to Coalesce

Coalesce is what lets a transform update existing target records: when a field map is marked Coalesce, the instance looks for a target record with the same value and updates it. If no coalesce is defined, all imported rows are treated as new records and no existing records are updated, which produces duplicates on a rerun.

• Why A is wrong: The Import Set Deleter cleans up old import set staging data. It does not affect how rows are matched to existing target records.
• Why C is wrong: The data source type only defines where the data comes from. Whether rows update or insert depends on coalesce field maps.
• Why D is wrong: Import sets do run as the System user, which affects encrypted fields. It has no effect on whether rows insert or update.

Correct answer: B. An ACL whose single role has no row in the database; E. An ACL whose script is just answer=true

The docs define invalid ACLs as ACLs with roles that do not exist, ACLs with security attributes that do not exist, and ACLs with a script that contains "answer=true" or "true". By default the ACL engine completely denies access if an ACL is empty or invalid, and it denies access when none of the roles referenced by an ACL exist.

• Why A is wrong: The missing-role denial does not apply to ACLs that have a mix of valid and invalid roles.
• Why C is wrong: An ACL with an existing role and a data condition has defined components, so it is neither empty nor invalid.
• Why D is wrong: Only security attributes that do not exist make an ACL invalid. An existing security attribute is a valid condition.

Correct answer: A. A foreign record insert

A foreign record insert occurs when an import makes a change to a table that is not the target table for that import. It happens when updating a reference field; the docs use this exact example: updating the caller on an incident means the import is actually updating the sys_user table.

• Why B is wrong: A dictionary override changes how a field behaves on a child table. It has nothing to do with import changes.
• Why C is wrong: Transformation is the conversion of import set data into the target table using a transform map, not a change to a different table.
• Why D is wrong: A conditional coalesce is a script that decides whether a staging row matches an existing target record. It does not describe changes to a non-target table.

Correct answer: D. Define a dictionary override for Incident

Dictionary overrides let a field on an extended table be defined differently from the same field on the parent table. The docs give this example: an override can change the default value on Incident without affecting the default value on Task or on Change. Default values are one of the field aspects an override can change.

• Why A is wrong: Changing the default on the Task dictionary entry changes the parent field, which every table extending Task inherits, including Change Request.
• Why B is wrong: The form layout controls which fields appear on the form. It does not change the field default value stored in the dictionary.
• Why C is wrong: ACLs restrict access to data. A field ACL controls who can read or write Priority, not its default value.

Correct answer: C. Elevate to the security_admin role

Normal admin users can view and debug access control rules. To create or update existing access control rules, administrators must elevate privileges to the security_admin role, using Elevate Roles from the user menu. The elevated role lasts for the rest of the session or until the administrator deselects it.

• Why A is wrong: The user_admin role is for creating and editing groups. Editing ACLs requires elevating to security_admin.
• Why B is wrong: Impersonation lets the admin use the instance exactly as the impersonated user. An itil user cannot edit ACLs, so this does not help.
• Why D is wrong: Debug Security Rules shows which ACLs apply to fields and how they evaluated. It helps troubleshoot ACLs but does not grant the right to edit them.

Correct answer: B. Create a new table that extends Task

Administrators and application developers can only extend tables during table creation. Extending links the new table to the parent, creates system fields and lets the child share fields and records with the parent. Because the existing table was not extended when it was created, the way forward is a new table that extends Task.

• Why A is wrong: A dictionary override changes a field on a table that already extends the parent. It cannot create the parent and child relationship.
• Why C is wrong: Extending happens only during table creation, so an existing table cannot be changed afterward to extend Task.
• Why D is wrong: A reference field links records in two tables, but it does not make the table a child class that shares Task fields.

Correct answer: B. onComplete

Transformation event scripts run at different stages of a transform. The onComplete event script is processed at the end of an import run, after all data rows are read and transformed, so it runs once per run. It has access to the log object for the current import run, so it can write a summary to the import log.

• Why A is wrong: onForeignInsert runs at the start of creating a related, referenced record, before that record is created. It is not tied to the end of the run.
• Why C is wrong: onChoiceCreate runs at the start of a choice value creation, before the new choice value is created. It is not tied to the end of the run.
• Why D is wrong: onBefore runs at the start of each row transformation, so it runs once per row, before the row is transformed.

Correct answer: C. A new user record is created

With multiple-field coalesce, a target record is updated only if it has the same values in all coalesce fields as the staging record; all coalesce field values must match. Because Employee number differs, no matching record is found, and when no matching record is found a new record is created in the target table.

• Why A is wrong: An update requires every coalesce field to match. One matching field out of two is not enough.
• Why B is wrong: Coalesce does not merge partial matches. The row either updates a fully matching record or inserts a new one.
• Why D is wrong: A coalesce mismatch is not an error. When no matching record is found, the transform creates a new record.

Correct answer: A. Review the Shared Security Model

The Security Center best practices include reviewing the Shared Security Model, so customers understand their shared role in maintaining instance security. The Shared Responsibility Model defines the partnership between ServiceNow and the customer, with specific responsibilities for each party.

• Why B is wrong: A security contact receives security-related information from the ServiceNow Security Team. It does not define the split of responsibilities.
• Why C is wrong: The ServiceNow Access Control plugin controls which ServiceNow employees can access your instance, and when. It does not describe shared responsibilities.
• Why D is wrong: Changing default credentials secures the built-in admin, ITIL and employee accounts. It does not define who is responsible for what.

Correct answer: D. Users who have the admin role

The default deny property glide.sm.default_mode controls the wildcard table ACLs. With Deny Access, those rules restrict read, write, create and delete on all tables unless the user has the admin role or meets another table ACL. With no other table ACL on this table, admins keep access.

• Why A is wrong: The itil role grants nothing here because no table-specific ACL references it, and the wildcard rules allow only admins.
• Why B is wrong: Having some role does not pass the wildcard table ACLs under Deny Access. Only the admin role or another matching table ACL grants access.
• Why C is wrong: With Deny Access, being authenticated is not enough. The wildcard table ACLs deny read unless the user is an admin or passes another table ACL.

Correct answer: B. Assign the roles to each team's group

When roles are assigned to groups rather than to individual users, members of the group inherit the role, and when a user switches groups the new group role is assigned automatically. The docs recommend simplifying user administration by assigning roles to groups built for each persona.

• Why A is wrong: Roles on user records must be edited by hand each time an agent moves, which is what the administrator wants to avoid.
• Why C is wrong: Time-limited roles support only admin, snc_read_only, impersonator and snc_required_script_writer_permission, for at most 5 days. They do not follow team membership.
• Why D is wrong: Departments categorize users. Roles are granted to users and groups, and group membership is what passes roles on to members.

Correct answer: A. Security monitoring console

The Security monitoring console supervises security notifications and metrics. Its Security event notifications section tracks events such as impersonation or data exports and shows the count for the last seven days, and its Metric threshold notifications panel shows threshold alerts.

• Why B is wrong: The Security configuration console shows the hardening compliance score, security scan results and Customer Actions, not security event notifications.
• Why C is wrong: The Security posture console covers best practices and posture dashboards, such as integration accounts, privileged accounts and users who never logged in.
• Why D is wrong: The Security scanner runs security checks to find misconfiguration. It does not track impersonation or data export events.

Correct answer: C. Select Update score on Security hardening

The hardening compliance score is calculated automatically on the first of the month, or after Security Center is installed or reinstalled. An administrator can trigger a recalculation at any time with the Update score button on the Security hardening page.

• Why A is wrong: The score is not recalculated nightly. It is calculated automatically on the first of the month or after Security Center is installed or reinstalled.
• Why B is wrong: Customer Actions lists important security updates to apply. It is a separate tool and does not recalculate the hardening score.
• Why D is wrong: The Security scanner checks the instance against a set of security checks. Running a scan does not recalculate the hardening compliance score.

Correct answer: D. By the robust import set transformer

Both transform maps and robust import set transformers convert data, but robust import set transformers separate the transform and processing functions. If a data source has both a transform map and a robust import set transformer, the system uses the robust import set transformer instead of the transform map.

• Why A is wrong: The opposite is true: when both exist, the robust import set transformer is used instead of the transform map.
• Why B is wrong: The two do not run in sequence. The system uses the robust import set transformer instead of the transform map.
• Why C is wrong: Having both is not an error. The system picks the robust import set transformer.

Correct answer: B. Correctness

CMDB Health aggregates three KPIs: correctness, compliance and completeness. Correctness is made up of the orphan, staleness and duplicate metrics. A CI is stale when it was not updated within the Effective Duration of the staleness rule for its class (60 days in the default rule).

• Why A is wrong: Completeness measures CIs with required or recommended fields that are not populated, not how recently CIs were updated.
• Why C is wrong: Compliance is based on the results of CMDB audit runs, which compare actual field values against expected values.
• Why D is wrong: Relationship health covers duplicate, orphan and stale relationships. Stale CIs themselves are counted by the staleness metric of correctness.

Correct answer: A. A list_edit operation ACL

The list_edit operation enables users to update records (rows) from a list, and failing a list_edit ACL means the user cannot update rows from a list. A write ACL would also make fields read-only on forms, so list_edit is the operation that targets list editing without blocking form updates.

• Why B is wrong: Failing a write ACL makes the field read-only in forms and lists, so it would also stop agents from updating incidents on the form.
• Why C is wrong: report_on controls whether users can create reports on the table. It does not affect list editing.
• Why D is wrong: add_to_list controls whether users can view or personalize specific columns in a list. It does not control editing rows.

Correct answer: C. The Crawl stage

CSDM is implemented in stages that build on each other: foundation, crawl, walk, run and fly. In the Crawl stage you work on base-system CMDB tables associated with ITSM, which gives the minimum CMDB support needed for Incident Management and Change Management. It follows Foundation, where referential data is prepared.

• Why A is wrong: In the Walk stage, you identify and populate the network infrastructure CIs and applications that technical teams support.
• Why B is wrong: In the Run stage, you set up the relationship between a technology and the business that sells and consumes it.
• Why D is wrong: In the Foundation stage, admins prepare the referential data. That work is already finished in this scenario.