Free CSA practice questions

A user holding the itil role opens an incident record and every field renders except a custom field named u_cost_centre, which is absent from the form, absent from the incident list view and empty in a CSV export of the same records. The read access control rule on the incident table itself evaluates to true for this user. What explains the behaviour?

• AA field level read access control rule on incident.u_cost_centre requires a role the user does not hold, and both the table rule and the field rule must pass before the value is returned.check_circle Correct
• BA UI policy on the Incident form hides u_cost_centre for users without a finance role, so the field is suppressed on the form and in every other view of the data.
• CA before query business rule on the incident table adds a condition that strips u_cost_centre from the result set returned to users without a finance role.
• DThe dictionary entry for u_cost_centre is configured as read only for the itil role, so the stored value stays hidden until the user is granted write access to the field.

Why A is correct: Correct: table level and field level read rules are both evaluated, so passing the table rule still leaves the field rule able to deny the single field wherever the data is requested.

Why B is wrong: Tempting because a UI policy is a common way to hide a field and does render it invisible on the form, but a UI policy acts only on the form at runtime and cannot remove a field from a list view or from an export.

Why C is wrong: Tempting because a before query business rule really does filter what a user gets back, but it filters whole records rather than individual fields, so it would hide incidents, not one column of a visible incident.

Why D is wrong: Tempting because a read only dictionary setting does restrict what a user may do with a field, but read only still displays the value; it blocks editing rather than reading.

Eight new starters must gain the access that approving change requests requires. An administrator creates a group named Change Approvers, adds the eight users as members, and finds their access is unchanged because the group carries no roles. Which action grants the access and keeps future starters working with the least ongoing maintenance?

• AGrant the role directly on each of the eight user records, so the assignment is explicit on the user and visible to anyone auditing that individual account.
• BAdd the role that carries the change approval access to the Change Approvers group record, so every current member and every future member inherits it through group membership.check_circle Correct
• CCreate an access control rule on the change request table that names the Change Approvers group in place of a role, so the group itself becomes the security check.
• DSet Change Approvers as the parent of a group that already holds the role, so the members of the new group pick up the roles held by the child group beneath it.

Why A is wrong: Tempting because direct role assignment does work and is easy to audit, but it must be repeated for every joiner and unpicked for every leaver, which is exactly the maintenance the group is there to remove.

Why B is correct: Correct: a role granted to a group is inherited by all of its members, and membership changes apply the role automatically without any further role administration.

Why C is wrong: Tempting because the group is the object the administrator has just built, but access control rules are satisfied by roles and conditions; a group is a container for members and roles, not a value the required roles list accepts.

Why D is wrong: Tempting because nested groups genuinely do pass roles down a hierarchy, but inheritance runs from parent to child, so members of a parent group gain nothing from the roles held by a child group.

An administrator who holds the admin role opens an existing access control rule to adjust its condition and finds the fields read only, with no option to create a new access control rule. Other configuration records on the same instance open and save normally for the same user in the same session. What explains this and restores the ability to edit the rule?

• ANo update set is currently selected for the session, so the platform blocks the creation and editing of configuration records until an in progress update set is made current.
• BThe high security plugin has not been activated on the instance, so access control rules stay locked and read only until an administrator activates that plugin from the plugin list.
• CThe administrator must elevate to the security_admin role for the current session, because creating and editing access control rules requires that elevated privilege in addition to the admin role.check_circle Correct
• DThe administrator holds the admin role directly rather than through a group, and access control rule maintenance is available only to users who receive the admin role by group membership.

Why A is wrong: Tempting because update sets do capture configuration changes and a closed set causes real problems, but the update set state does not make a single record type read only while other configuration records remain editable.

Why B is wrong: Tempting because security behaviour often does depend on a plugin, but the high security settings are part of the base platform, and an unactivated plugin would not present the record as read only in this way.

Why C is correct: Correct: security_admin is an elevated privilege that an administrator activates for a session, and without it the access control rule records are presented read only.

Why D is wrong: Tempting because groups are the usual way to distribute roles, but the platform makes no distinction between a role granted directly and the same role inherited from a group when it evaluates a role check.

An administrator builds a filter on the incident list by adding, in order, Active is true, then Priority is 1, then Assignment group is Network. The filter breadcrumb displays the three conditions in that same order. The administrator then clicks the Priority is 1 segment of the breadcrumb. Which set of records does the list return afterwards?

• ARecords where Active is true only, because clicking a breadcrumb segment removes that condition together with every condition added after it.
• BRecords where Priority is 1 only, because clicking a breadcrumb segment isolates that single condition and discards the conditions on either side of it.
• CRecords where Active is true and Priority is 1, because clicking a breadcrumb segment keeps that condition and drops the conditions added after it.check_circle Correct
• DRecords matching all three conditions, because breadcrumb segments are read only labels and the filter can be shortened only from the condition builder.

Why A is wrong: Tempting because clicking a segment does discard later conditions, but the clicked condition itself is retained rather than removed, so the Priority filter still applies.

Why B is wrong: Tempting because the clicked condition survives, but conditions to the left of the clicked segment are kept, so Active is true remains in force as well.

Why C is correct: Correct: a breadcrumb segment is a live control that reruns the query at that point in the filter, retaining the clicked condition and everything to its left.

Why D is wrong: Tempting because the breadcrumb looks like a status line, but each segment is clickable and removing conditions from it is a supported way to widen a list.

An administrator builds a filter on the incident list for open incidents assigned to the Service Desk group and wants every member of that group to be able to select the same filter from their own saved filters, without other staff on the instance seeing it and without each member rebuilding the conditions. Which approach meets the requirement?

• ASave the filter from the condition builder, name it, and leave its visibility set to everyone so that Service Desk members are certain to find it in their list.
• BSave the filter as a personal filter, then send each Service Desk member the list query string so that they can paste it in and save their own copy.
• CApply a tag named Service Desk to the matching incidents and share the tag with the group so that members open the tagged records instead of the filter.
• DSave the filter from the condition builder, name it, and set its visibility to the Service Desk group so that only members of that group can select it.check_circle Correct

Why A is wrong: Tempting because it does share one definition and guarantees the group can see it, but it also exposes the filter to every other user, which the requirement rules out.

Why B is wrong: Tempting because the query string does reproduce the conditions, but it creates a separate personal copy per user, so a later change has to be redistributed by hand.

Why C is wrong: Tempting because tags can be shared with a group, but a tag marks a fixed set of records and does not re-evaluate conditions as incidents open and close.

Why D is correct: Correct: a saved filter carries a visibility setting, and scoping it to a group publishes one shared definition to exactly the intended audience.

An administrator must produce a list of incidents whose caller belongs to the Finance department. The incident record stores the caller in a reference field pointing at the user record, and department is held on the user record, not on the incident record. The administrator wants a filter that keeps working as staff move between departments. Which approach produces the list?

• ABuild the filter condition by dot-walking from the Caller reference field on the incident to the Department field on the referenced user record, and set it to Finance.check_circle Correct
• BAdd the department field to the incident form through the form layout, then filter the incident list on that newly added field with a value of Finance.
• CFilter the incident list on a keyword search for Finance so that any incident mentioning the department in its description or work notes is returned.
• DCreate a report grouped by caller and read the Finance callers from the grouping, then filter the incident list by each of those caller names in turn.

Why A is correct: Correct: dot-walking follows the reference at query time, so the condition reads the current department on each caller's user record.

Why B is wrong: Tempting because form layout does surface related information, but placing a field on a form does not create a column on the incident record for the filter to evaluate.

Why C is wrong: Tempting because a keyword search is quick, but it matches free text rather than the caller's department, so it returns unrelated incidents and misses most valid ones.

Why D is wrong: Tempting because grouping does expose caller data, but the resulting name list is a snapshot that has to be rebuilt whenever staff join or leave the department.

A knowledge base holds articles that only staff in the Finance department should be able to open, and those staff hold no roles beyond the ones every logged in user receives. Which mechanism governs who is allowed to read the articles in that knowledge base?

• AA user criteria record matching the Finance department, added to the Can Read list of that knowledge basecheck_circle Correct
• BA role added to the knowledge base record, granted to each Finance user through their group membership
• CA read access control rule on the knowledge article table whose condition matches the department of the current user
• DA category inside the knowledge base named Finance, with the articles filed under it for the department

Why A is correct: User criteria evaluate attributes such as department, group, location, company and role, and the Can Read list on a knowledge base is exactly where read audience is declared.

Why B is wrong: Roles are the familiar way to gate most platform features, so reaching for one is tempting, but knowledge read access is evaluated through user criteria rather than a role field on the knowledge base.

Why C is wrong: Access control rules do protect the table generally, but the per knowledge base audience for articles is decided by user criteria, so writing a rule here duplicates and fights the supported mechanism.

Why D is wrong: Categories organise articles for browsing and searching, which feels like structure equals security, but a category carries no audience and hides nothing from anyone.

A knowledge base is readable by all employees, and a small group of subject matter experts must additionally be able to create and edit articles in it. Which change to the knowledge base record gives that group authoring access while leaving the reading audience untouched?

• AAdd a user criteria record matching the expert group to the Can Read list of the knowledge base
• BAdd a user criteria record matching the expert group to the Can Contribute list of the knowledge basecheck_circle Correct
• CSet the expert group as the owner of the knowledge base so that every member inherits authoring rights
• DCreate a category for the experts inside the knowledge base and allow the group to file articles under it

Why A is wrong: This is the right kind of record on the wrong list, since Can Read only decides who may open articles and adding experts there changes nothing about their ability to author.

Why B is correct: Can Contribute is the separate list that governs who may write in a knowledge base, so adding criteria there grants authoring without disturbing the Can Read audience.

Why C is wrong: A knowledge base does name an owner and knowledge managers, which sounds like an authoring grant, but the owner field takes a single user and governs stewardship rather than the contributor audience.

Why D is wrong: Categories look like the place to separate expert content, yet they only classify articles for browsing and carry no permission of any kind.

A knowledge base lists user criteria matching all permanent employees on its Can Read list, and separate user criteria matching contractors on its Cannot Read list. A contractor who is also a permanent employee record holder matches both sets of criteria. What determines the outcome for that user?

• AThe user gains read access, because a matching entry on the Can Read list is evaluated after the exclusion list
• BThe user gains read access, because user criteria matching is additive and any single match is sufficient
• CThe user is denied read access, because a match on the Cannot Read list takes precedence over a match on Can Readcheck_circle Correct
• DThe user gains read access, because the criteria are compared and the one matching more attributes takes effect

Why A is wrong: It is tempting to assume the inclusion list runs last and therefore wins, but the exclusion list is what settles a conflict, so access is denied rather than granted.

Why B is wrong: Multiple criteria on one list are indeed additive, so this reasoning is half right, yet it ignores that the Cannot Read list exists precisely to remove users the inclusion list would otherwise admit.

Why C is correct: The exclusion lists are designed to override the inclusion lists, so any user matching Cannot Read is kept out of the knowledge base regardless of another match.

Why D is wrong: Specificity decides the winner among access control rules on some platforms, which makes this feel familiar, but knowledge user criteria are not scored against each other by attribute count.

An administrator must ensure that the Justification field is populated whenever a request record is saved, including when records arrive through an import set or an inbound web service call rather than through a form. Which mechanism enforces the rule in all of those cases?

• AA UI policy on the table with a mandatory action on the Justification field, applied to every view of the form.
• BAn onSubmit client script that cancels the save when the Justification field is empty, so no record can be written without it.
• CA data policy on the table with the Justification field marked mandatory, since data policies are evaluated on the server for any insert or update.check_circle Correct
• DA UI policy with the Reverse if false option cleared, so the mandatory action persists once the condition has matched.

Why A is wrong: Tempting because a UI policy is the standard no-code way to make a field mandatory, but its actions run only in the browser on a loaded form, so an import or a web service insert bypasses it entirely.

Why B is wrong: Tempting because an onSubmit script does block a form save, but like a UI policy it is client side code that never executes for an import set row or a web service insert.

Why C is correct: Correct because a data policy runs server side, so the mandatory rule holds for form saves, import set loads and web service calls alike.

Why D is wrong: Tempting because clearing Reverse if false does make an action persist, but it only changes what happens when the condition stops matching on the form and adds no server side enforcement.

A UI policy on the Change Request form makes the Backout Plan field mandatory while the Risk field is set to High. A user sets Risk to High, then changes it back to Moderate in the same form session, and Backout Plan stays mandatory. Which UI policy setting governs whether the field returns to its earlier state?

• AThe Global check box, which controls whether the policy applies to every view of the form or only to the view named on the record.
• BThe Order field, which controls the sequence in which UI policies whose conditions match are evaluated on the form.
• CThe On load check box, which controls whether the policy is evaluated when the form is first rendered as well as afterwards.
• DThe Reverse if false check box, which controls whether the policy actions are undone once the condition is no longer true.check_circle Correct

Why A is wrong: Tempting because Global does widen where a policy takes effect, but it decides which views the policy covers and has no bearing on what happens once the condition stops matching.

Why B is wrong: Tempting because ordering does decide which policy acts last on a shared field, but ordering never undoes an action when a single policy's condition becomes false.

Why C is wrong: Tempting because On load affects the initial state of the fields, but it governs the first evaluation only and says nothing about reverting an applied action later.

Why D is correct: Correct because Reverse if false is the setting that returns fields to their prior mandatory, read only and visible state when the condition stops matching.

Two active UI policies on the same table both match the conditions on an open form. One sets the Assignment Group field to read only and the other leaves the same field editable. Which field on the UI policy records determines the state the user ends up seeing?

• AThe Order field, because matching policies are evaluated from the lowest order value upwards and the last one to act on a field settles its state.check_circle Correct
• BThe Active field, because only one UI policy on a table may be active against a given field at any time and the platform deactivates the other.
• CThe Global field, because a policy that applies to every view takes precedence over one restricted to a single view whatever their order values are.
• DThe Inherit field, because a policy inherited by an extended table overrides one defined directly on the table being viewed.

Why A is correct: Correct because order controls evaluation sequence, so the higher order policy runs later and its action on the shared field is the one that survives.

Why B is wrong: Tempting because Active does decide whether a policy runs at all, but the platform never deactivates a policy to resolve a conflict and any number may target the same field.

Why C is wrong: Tempting because Global sounds like a precedence flag, but it only widens the views a policy covers and grants no priority over a view specific policy.

Why D is wrong: Tempting because Inherit is a real setting that pushes a policy down to extended tables, but it controls reach rather than precedence and creates no override of a local policy.

An administrator must add a capability to an instance and is weighing two delivery mechanisms: a plugin listed in All Available Applications and an application obtained from the ServiceNow Store. Which statement describes how the two differ?

• AA plugin is downloaded from an external repository each time it is switched on, whereas a Store application ships inside the base platform build and only needs activating.
• BA plugin can be switched on only by ServiceNow personnel in response to a request, whereas a Store application can be installed directly by any user who holds the itil role on the instance.
• CA plugin is functionality already delivered with the instance that an administrator switches on from All Available Applications, whereas a Store application is obtained from the ServiceNow Store and installed onto the instance.check_circle Correct
• DA plugin can add tables, roles and business logic to the instance, whereas a Store application supplies only reports and dashboards that read tables the platform already provides.

Why A is wrong: Tempting because both mechanisms end with new functionality appearing on the instance, but the description is the wrong way round: the plugin is the part already delivered with the platform and the Store application is the part retrieved from outside the instance.

Why B is wrong: Tempting because some plugin actions do involve ServiceNow, but an administrator activates most plugins themselves, and installing a Store application is an administrative action rather than something the itil role grants.

Why C is correct: Correct because a plugin is dormant platform functionality that activation makes available, while a Store application is separately published content that must be brought onto the instance before it can be used.

Why D is wrong: Tempting because plugins do add tables and logic, but the limit placed on Store applications is invented: a Store application can also deliver tables, roles and server logic of its own.

While activating a plugin on a sub-production instance, an administrator is offered the option to load demo data as part of the activation. What does choosing that option do?

• AIt copies a sample of the production instance's records into the sub-production instance so the plugin can be tested against realistic data volumes.
• BIt takes a backup of the records already held in the tables the plugin touches, so that the activation can be reversed cleanly at a later date.
• CIt activates the plugins that this plugin depends on, because the sample records span several applications and cannot be loaded without those plugins.
• DIt inserts sample records supplied with the plugin so the new functionality can be explored and tested before the administrator configures any real data.check_circle Correct

Why A is wrong: Tempting because testing against realistic data is a genuine need, but demo data comes from the plugin itself and no data is drawn from another instance during activation.

Why B is wrong: Tempting because a safety net before a change sounds sensible, but the demo data option adds records rather than preserving existing ones, and it provides no rollback of the activation.

Why C is wrong: Tempting because dependencies are handled during activation, but that happens whether or not demo data is requested, so the option is not what governs dependency activation.

Why D is correct: Correct because demo data is a set of illustrative records packaged with the plugin, added purely so the newly activated feature has something to work with during evaluation.

An administrator activates a plugin that requires two other plugins which are not yet active on the instance. What happens to those required plugins during the activation?

• AThe required plugins are activated automatically as part of the same activation, because the plugin being activated cannot function without the functionality they provide.check_circle Correct
• BThe activation stops with a message naming the plugins that are missing, and the administrator has to activate each of them by hand before retrying the original request.
• CThe plugin activates immediately, but the parts of it that rely on the required plugins stay dormant until an administrator activates those plugins in a separate action.
• DThe activation is held in a pending state until ServiceNow confirms that the instance is entitled to each of the required plugins, then it completes without further input.

Why A is correct: Correct because a plugin declares the plugins it depends on, and activating it brings those dependencies on so the resulting functionality is complete and usable.

Why B is wrong: Tempting because software installers often refuse to proceed on an unmet dependency, but the platform resolves plugin dependencies for the administrator rather than blocking the activation.

Why C is wrong: Tempting because it sounds like a graceful partial activation, but the platform does not leave a plugin half enabled: the dependencies are brought in so the whole feature works.

Why D is wrong: Tempting because entitlement genuinely gates some paid content, but ordinary plugin dependencies are resolved on the instance and involve no approval step of this kind.

An administrator needs to see the platform as a particular user sees it, in order to confirm what that user can open, and cannot ask that user for their password. Which TWO statements describe how the platform's impersonation feature behaves? Select TWO.

• AImpersonation lets an administrator work with the roles of the selected user without knowing that user's password.check_circle Correct
• BImpersonation adds the selected user's roles to the administrator's own, so the session holds the sum of both role sets.
• CWork carried out while impersonating is attributed to the selected user, and the platform records that an impersonation took place.check_circle Correct
• DImpersonation requires the selected user to be signed out first, and their next sign in ends the administrator's impersonated session.
• EImpersonation is set for the instance as a whole, so every administrator signed in at that moment sees the selected user's view.

Why A is correct: Correct. Impersonation switches the session to the selected user's identity and role set, which is why it is the supported way to reproduce what a user can and cannot see.

Why B is wrong: Tempting because the administrator starts the session and can end it at will, which suggests their own access is retained. It is wrong because impersonation replaces the effective roles rather than adding to them, and a combined role set would defeat the purpose of testing another user's view.

Why C is correct: Correct. Records touched during the session carry the impersonated user as the actor, and the platform keeps its own trace of the impersonation so the real administrator remains accountable.

Why D is wrong: Tempting because it sounds like a sensible safeguard against two sessions for one identity. It is wrong because impersonation is independent of whether the selected user is signed in, and their activity does not terminate the administrator's session.

Why E is wrong: Tempting because instance level configuration does change what everyone sees. It is wrong because impersonation is scoped to the single session that started it and has no effect on any other signed in user.

An administrator updates the job title on a user record. The new title appears immediately on every incident, change request and knowledge article that references that user, and no integration or synchronisation job runs on the instance. Which characteristic of the Now Platform accounts for this?

• AEach application stores its own user table and a scheduled import job reconciles those tables against one another overnight.
• BA data integration between the applications propagates the changed field to each downstream copy as soon as the record is saved.
• CThe applications run on one platform with a single data model, so they all reference the same user record rather than separate copies.check_circle Correct
• DThe user record is cached in the browser session, so every open application reads the updated title from that shared client cache.

Why A is wrong: This describes how separately purchased tools are usually joined, which makes it a familiar assumption, but it is wrong here because the update was visible immediately and no reconciliation job exists on the instance.

Why B is wrong: Tempting because instant propagation can be achieved by integration in other architectures, but wrong because ServiceNow applications are not separate systems needing an integration to stay in step.

Why C is correct: Correct, because incident, change and knowledge records all point at the same user record on the shared data model, so there is one value to update and nothing to propagate.

Why D is wrong: Plausible because the browser does cache some data for the session, but wrong because other users on other sessions see the change too, so the consistency comes from the stored record and not from a client cache.

A new administrator asks how ServiceNow applications such as Incident Management and Service Catalog relate to the Now Platform they run on. Which description of that relationship is accurate?

• AThe platform is a reporting layer sitting above the applications, and each application supplies its own database and its own security model.
• BEach application is an independently hosted product with its own data store, and the platform contributes only the shared login page across them.
• CThe platform is a set of connectors joining separately hosted applications, and each application defines its own table structure and role model.
• DApplications are built from platform components such as tables, forms, access controls and flows, and they run on the platform's shared services.check_circle Correct

Why A is wrong: Tempting because reporting does span every application, but wrong because reporting is one platform capability among many and the applications do not bring their own databases or security models.

Why B is wrong: This matches how a suite of separately bought tools behaves, which makes it believable, but wrong because ServiceNow applications share the platform's tables, roles and services rather than only a sign in page.

Why C is wrong: Attractive because integration platforms do work this way, but wrong because there is nothing to connect: the applications already sit on one platform and one data model.

Why D is correct: Correct, because a ServiceNow application is a configured set of platform artefacts, so it inherits the platform's data model, security and automation rather than supplying its own.