ServiceNow CAD - Certified Application Developer - ServiceNow

In the Automated Test Framework (ATF) of ServiceNow, the " Impersonate " test step is used to simulate actions as a specific user. This is crucial for testing functionalities that depend on user roles, permissions, or specific user contexts.

Key Points:

Purpose: The " Impersonate " step allows the test to execute subsequent steps as if performed by the specified user, ensuring that role-based permissions and access controls are accurately tested.

Usage: To add an " Impersonate " step:

Open your test in ATF.

Click on " Add Test Step. "

Select " Impersonate User. "

Choose the user you want to impersonate for the test.

Considerations: Ensure that the user being impersonated has the necessary roles and permissions for the actions being tested. Additionally, be aware that impersonation affects both server-side and client-side operations during the test.

https://developer.servicenow.com/dev.do#!/learn/learning-plans/quebec/servicenow_administrator/app_store_learnv2_automatingapps_quebec_scheduled_script_execution_scripts

The objects that you can use in a Scheduled Script Execution (Scheduled Job) script are GlideSystem and GlideRecord. GlideSystem provides methods for performing system operations, such as logging, running background scripts, or getting system information. GlideRecord provides methods for working with records in the database, such as querying, updating, inserting, or deleting records. The current object is not available in Scheduled Script Execution scripts, as it refers to the current record on a form or list. The GlideUser object is also not available, as it refers to the current user session. Reference: Scheduled Script Execution, GlideSystem, GlideRecord

When a new application table is created and the option to create a module is used, ServiceNow creates a list module for that table in the application menu. The default module name is based on the plural form of the application or table label, so users see a natural list-style module name in the Application Navigator. The “U_” or “X_” style prefixes relate to technical table names and scoped naming, not to the user-facing module title. The same name as the application is normally used for the application menu, not the list module. This is why option B is the correct CAD answer.

================

When creating a table in a privately-scoped application, four Access Controls are automatically created for the table. These Access Controls define the permissions for the four basic operations on the table: Create, Delete, Read, and Write. The Create operation allows the user to create new records on the table. The Delete operation allows the user to delete existing records on the table. The Read operation allows the user to view the records on the table. The Write operation allows the user to modify the records on the table. By default, these Access Controls grant access to the admin role and the application scope. You can modify or delete these Access Controls as needed.

The other options are not valid Access Controls for a table. Insert, Query, and Update are not operations, but methods of the GlideRecord class that are used to manipulate records on the server-side. They are not part of the Access Control rules.

https://docs.servicenow.com/bundle/tokyo-application-development/page/build/applications/task/t_SelectAnAppFromTheAppPicker.html

In ServiceNow, the admin role includes all other roles implicitly. So if a user has admin, g_user.hasRole( ' any_role ' ) returns true.

From ServiceNow Docs – g_user API:

“The hasRole() method returns true if the user has the specified role or is an admin.”

The method call that returns true only if the currently logged in user has the catalog_admin role and in no other case is g_user.hasRoleExactly(‘catalog_admin’). This method checks if the user has exactly one role, and returns true if it matches the argument. The other methods return true if the user has one or more roles, or if the user has any role from a list of arguments. References: [ServiceNow Docs - GlideUser API], [ServiceNow Community - Difference between hasRole() and hasRoleExactly()]

 It is best practice to define the business requirements and the process(es) an application will manage as part of the application development plan. The following are some of the considerations to document as part of the business process:

Business problem. This is the description of the problem or opportunity that the application is intended to address or exploit. It should include the background, context, scope, and objectives of the problem or opportunity.

Data input/output. This is the specification of the data that the application will need to collect, store, manipulate, and display. It should include the data sources, formats, validations, transformations, and integrations of the data.

Users/stakeholders. This is the identification of the users and stakeholders who will be involved in or affected by the application. It should include the roles, responsibilities, expectations, and needs of the users and stakeholders.

Process steps. This is the definition of the steps and activities that the application will perform or support. It should include the inputs, outputs, triggers, conditions, and outcomes of each step or activity.

The following are not some of the considerations to document as part of the business process:

Project schedule. This is the estimation of the time and resources required to complete the application development project. It should include the milestones, deliverables, dependencies, and risks of the project. This is not part of the business process, but part of the project management plan.

Database capacity. This is the measurement of the amount of data that the application will generate and store in the database. It should include the data volume, growth rate, retention policy, and backup strategy of the data. This is not part of the business process, but part of the technical design and architecture of the application.

Available licenses. This is the number and type of licenses that the application will consume or require from the ServiceNow platform. It should include the license model, cost, and allocation of the licenses. This is not part of the business process, but part of the financial and legal aspects of the application. References: Application Development Process, Business Process Analysis

Inherited fields in ServiceNow are fields that are part of a parent table and automatically become part of child tables through inheritance. This structure is foundational in the ServiceNow data model, ensuring that child tables maintain a consistent relationship with their parent tables.

Here’s why inherited fields cannot be deleted from a child table:

System Design:ServiceNow employs a table inheritance model where child tables derive fields and properties from parent tables. Deleting inherited fields from a child table would break the integrity of the data model, as those fields are shared across multiple tables.

Impact on Functionality:Many inherited fields, such as sys_created_on or sys_updated_by, are integral to the functionality of the platform. Removing them could disrupt workflows, reporting, and auditing capabilities.

Alternative Approach:If you want to hide or restrict access to inherited fields in a child table, you can use ACLs (Access Control Lists) to prevent users from viewing or modifying these fields. Another option is to use UI Policies or Client Scripts to control their visibility on forms.

Developer Note:Attempting to delete inherited fields violates ServiceNow’s core principles of maintaining a robust and unified data structure. The platform enforces these rules to ensure consistent behavior across all tables in the hierarchy.

ServiceNow Developer Documentation on Table Inheritance​.

Best practices outlined on SN Pro Tips regarding scoped application development and table structures​.

Flow Designer runs automation based on triggers. A primary trigger type is a Record trigger, which starts a flow when a record is created, updated, or created or updated. This matches option A and is one of the most common ways to automate application behavior using table data. Flow Designer also supports triggers tied to SLA-related events, enabling flows to react when an SLA is approaching breach or breaches, which aligns to option E in the way the platform exposes SLA timing events for automation. In addition, flows can be started by an inbound request through supported APIs, allowing external systems or scripts to invoke flow execution, which aligns to option F. By contrast, elevating to security_admin is a privileged security operation, not a Flow trigger; logging in as a specific user is an authentication/session activity rather than an automation trigger; and outbound email is typically an action that a flow can send, not an event that triggers a flow. The correct answers focus on documented Flow trigger categories rather than UI or security behaviors.