Free Practice Questions for ServiceNow CSA Exam

Update Setsare the standard way to capturecustomizationsand move them from one ServiceNow instance to another. These customizations include:

Business Rules

UI Policies

Script Includes

Fields and Tables

Workflows

Update Setstrack changes in an instance and allow them to beexportedandimportedinto other environments (e.g., fromDevelopmenttoTestand then toProduction).

They ensure thatconfiguration changesare preserved and applied consistently across instances.

Why is Option A Correct?Why Are the Other Options Incorrect?B. Code Sets

There is no concept ofCode Setsin ServiceNow.

C. Update Packs

Update Packsdo not exist in ServiceNow. The correct term isUpdate Sets.

D. Configuration Logs

Configuration Logsrecord system activity butdo not package customizationsfor migration.

E. Remote Sets

Remote Update Setsexist, but they are just a variation ofUpdate Setsused when moving changes betweenremote instances.

The broader term "Update Sets" is more accurate.

F. Local Sets

No such termexists in ServiceNow.

G. Code Packs

There is no"Code Pack"in ServiceNow.

ServiceNow CSA Guide - Update Sets and Customization Migration

ServiceNow Developer Documentation - Using Update Sets

ServiceNow Best Practices - Moving Configuration Between Instances

References to Official Certified System Administrator (CSA) Documentation:

ABusiness Rulein ServiceNow is aserver-side scriptthat executes when records are inserted, updated, deleted, or queried in a specified table. Business Rules allow automation and customization of workflows by defining logic that runs under specific conditions.

Table (B) –Correct

ABusiness Rulemust be associated with aspecific tablewhere it will execute (e.g., Incident, Change, Task).

This determineswhich recordsthe rule applies to.

Script to Run (E) –Correct

A script must be provided when defining advanced logic in a Business Rule.

Business Rules useserver-side JavaScriptto perform various actions, such as setting field values, enforcing validation, or triggering workflows.

Timing (H) –Correct

The execution timing of a Business Rule determineswhenit runs relative to a database transaction.

Business Rules can run:

Before(before record is saved)

After(after record is saved)

Async(after the transaction completes)

Display(when a form loads)

Condition to Evaluate (I) –Correct

Conditions definewhen the Business Rule should executebased on specific criteria.

Example: A Business Rule might runonly when the priority is set to High.

A. UI Action(Incorrect)

UI Actions (buttons, links, context menus) are separate from Business Rules and are used for UI customization.

C. Fields to update(Incorrect)

While Business Rules can update fields,you do not specify "fields to update" as a required setting. Instead, updates are made via scripts within the rule.

D. Who can run(Incorrect)

Business Rulesalways run on the server-sideand do not require user-specific execution settings.

F. Application Scope(Incorrect)

Although Business Rules belong to an application scope, this isautomatically determinedbased on the current application.

G. Update Set(Incorrect)

Business Rules arecaptured in an Update Set, but this is not a configuration setting while creating the rule.

ServiceNow Business Rules Overview:https://docs.servicenow.com/bundle/utah-application-development/page/script/server-scripting/concept/business-rules.html

Creating Business Rules:https://docs.servicenow.com/en-US/bundle/utah-application-development/page/script/server-scripting/task/t_CreateABusinessRule.html

Key Elements to Specify When Creating a Business Rule:Incorrect Options:Official References from Certified System Administrator (CSA) Documentation:

In ServiceNow, users can log into theService Portalusingcertificate-based authentication methods. The two commonly supported methods are:

ACACis a smart card issued by theU.S. Department of Defense (DoD).

It is used by military personnel, contractors, and government employees for secure authentication.

ServiceNow supportsCAC authenticationby integrating with external identity providers.

APIV cardis used byU.S. federal agenciesfor authentication.

It followsFederal Information Processing Standard (FIPS) 201for identity verification.

ServiceNow allows users to log in using PIV authentication, ensuringsecure accessto government and enterprise systems.

1. Common Access Card (CAC) – (Correct Answer)2. Personal Identity Verification (PIV) – (Correct Answer)

Both CAC and PIV are widely recognized certificate-based authentication methodsused in ServiceNow for secure user authentication.

They provide multi-factor authentication (MFA)and meet federal security standards.

Why "C. CAC" and "E. PIV" are the Correct Answers?

A. Extended Validation Access (EVA) – Incorrect

No such authentication method exists in ServiceNow.Extended Validation (EV) certificatesare used for website security, not user authentication.

B. Organization Verification Card (OVC) – Incorrect

Not a recognized ServiceNow authentication method.

D. Domain Authentication Card (DAC) – Incorrect

No such authentication method exists in ServiceNow.

Explanation of Incorrect Options:

ServiceNow Docs: Common Access Card (CAC) Authentication

ServiceNow Docs: Personal Identity Verification (PIV) Authentication

ServiceNow CSA Study Guide – Authentication Methods in ServiceNow

References from Certified System Administrator (CSA) Documentation:

In ServiceNow,Record Producersallow users to create records in tables through a user-friendly interface in the Service Catalog. Since the goal is to enableonly first-line workersto order the T-shirt, we need to control access based on their role.

ARecord Producerin the Service Catalog is the best way to gather user input (size, color, etc.) and create a new order record in the system.

The"Available For"list allows administrators to restrict access to specificusers or roles.

TheFirst Line [sn_first_line]role is explicitly designed to includeonly first-line workerswhile excluding managers.

Why is Option A Correct?Why Are the Other Options Incorrect?B. Create Catalog Item and use the Not Available list to specify the Manager Group

Catalog Itemsare valid for this use case but using the"Not Available For"list is a less effective approach.

If newmanager rolesorgroupsare added in the future, this method won’t automatically exclude them.

It’s better toexplicitly definewho can access the item rather than relying on exclusions.

C. Create Catalog Item and use the Available For list to specify ITIL [itil] role

TheITIL roleis typically assigned to Service Desk personnel and IT staff,not first-line workers.

This approach would allowmany unintended usersto request the T-shirt.

D. Create Order Guide and use the User Criteria list to specify First Line [sn_first_line] role

Order Guidesare used to bundle multiple catalog items and guide users through a complex ordering process.

Since this scenario only involves asingle item (T-shirt request),using an Order Guide is unnecessary.

ServiceNow Service Catalog Management - Record Producers

ServiceNow User Criteria and Access Control Best Practices

ServiceNow CSA Guide - Managing Roles and Access Restrictions

References to Official Certified System Administrator (CSA) Documentation:

ServiceNow provides multiplesecurity-related modulesthat aSystem Administratorfrequently uses to manage access, authentication, and overall system security.

Why These Options Are Correct?A. System Properties > Security

This module allowsadministrators to configure general security settings, including password policies, session timeout, and encryption settings.

It helps manage security parameters at a system-wide level.

E. System Security > Access Control (ACL)

Access Control Lists (ACLs)define what data users can access, modify, and delete within the instance.

ACLs operate at thetable, field, and record levels, ensuring proper role-based access control (RBAC).

This is one of themost commonly usedsecurity modules by admins.

G. System Security > High Security Settings

High Security Settings (previously known as Security Hardening)enforce strict security controls, such as requiring multi-factor authentication (MFA) and enforcing strict password policies.

It is often used for compliance withsecurity regulationslike HIPAA, GDPR, and ISO 27001.

Why the Other Options Are Incorrect?B. Utilities > Migrate Security

This optiondoes not existin ServiceNow. There is no"Migrate Security"under Utilities.

C. System Security > Security

There is no"System Security > Security"module in ServiceNow. The correct structure isSystem Security > Access ControlorSystem Properties > Security.

D. Self-Service > My Access

This is aself-service modulefor end users to request and review their access.

It isnota tool thatSystem Administratorsuse to manage security settings.

F. Password Management > Security Questions

This is used to configuresecurity questions for password recoverybut isnot a core security modulethat admins frequently use.

General Security Settings in ServiceNow

ServiceNow Access Control (ACL) Best Practices

ServiceNow System Security and Role Management

References to Official Certified System Administrator (CSA) Documentation:

Access Control Rules (ACLs) are a fundamental security feature in ServiceNow that protect applications by identifying and restricting access to files and data. ACLs define which users or roles have permissions to create, read, write, or delete data within an application.

Understanding Access Control Rules (ACLs)ACLs in ServiceNow operate based on three key elements:

Object Type– Defines what is being secured (table-level or field-level access).

Operation– Specifies the type of access (Create, Read, Write, Delete, Execute, etc.).

Condition & Script– Determines when access is granted (role-based permissions or specific conditions).

Data Security:Ensures that only authorized users can access specific data.

Granular Access:Controls permissions at the table and field level.

Regulatory Compliance:Helps organizations maintain security standards and data protection laws.

ServiceNow applies ACLs from the most specific to the most general (Field-level → Table-level → Global-level).

If no ACL explicitly allows access, the system denies it by default (Deny by Default Policy).

ACLs can be role-based, condition-based, or script-based for advanced security configurations.

A. Application Configuration– This refers to application settings but does not control access to data.

B. Verbose Log– Logging helps in debugging but does not secure applications or restrict access.

D. Application Scope– Defines application boundaries but does not control data access permissions.

ServiceNow CSA Documentation: Access Control Rules (ACLs)

ServiceNow Security Best Practices: Security and Access Control

Why Access Control Rules are Important?How ACLs Work in ServiceNow?Incorrect Answer Choices Explanation:Official CSA Documentation Reference:

In ServiceNow,Tagsare used tocategorize, flag, and quickly locate recordswithin the system. Tags help users organize records for easy retrieval and filtering.

User-created or system-defined tagsallow for custom categorization of records.

Tags can beapplied to any record, such asincidents, changes, knowledge articles, or tasks.

Users canfilter records based on tagsfor quick access.

Tags arepersonal(for individual users) orglobal(shared across users).

Incident Management:

A user can tag"High Priority"incidents for quick reference.

Knowledge Base Articles:

Articles related topassword resetcan be tagged as"Password Issues"for easier searchability.

Service Catalog Requests:

Users can tag frequently used catalog items as"Common Requests".

Key Features of Tags in ServiceNow:Example Use Cases of Tags:

Tags categorize and organize records, making them easy to find.

They act ascustom labelsthat help users filter and retrieve records efficiently.

They arebuilt-in featuresin ServiceNow and can be managed from theTag Management module.

Why "C. Tags" is the Correct Answer?

A. Search – Incorrect

TheSearch functionhelps users find records but does not categorize or flag them.

B. Favorites – Incorrect

Favoritesallow users tobookmark frequently accessed modules and reports, but they do not categorize records.

D. Bookmarks – Incorrect

Bookmarksare not a native ServiceNow feature for categorizing records;Favoritesserve this function instead.

Explanation of Incorrect Options:

ServiceNow Docs: Using Tags to Organize Records

ServiceNow CSA Study Guide – Navigating and Searching in ServiceNow

ServiceNow Product Documentation: Managing and Filtering Tagged Records

References from Certified System Administrator (CSA) Documentation:

InServiceNow (and databases in general), data is stored intables, which consist of:

Columns (Fields):Representindividual data attributes(e.g., Name, Email, Status).

Rows (Records):Representindividual entriesin the table (e.g., a specific Incident or User).

Key Concepts:Table

Columns (Fields)

Rows (Records)

Incident

Number, Caller, Priority, Description

Each unique incident entry

User

Name, Email, Role, Department

Each individual user record

A column represents a single field (data attribute), such as "Priority" or "Short Description."

A row represents a record (entry in the table), such as an individual incident or user.

A. A column is a field in the database and a record is one user→Incorrect

Records are not limited to users; a record could be an Incident, Change, or any other entry.

C. A column is one field and a record is one column→Incorrect

Arecord is not a single column; a record consists of multiple fields (columns).

D. A column contains data from one user and a record is one set of fields→Incorrect

Columns contain data for all users/records, not just one user.

A record is one row, not just a set of fields.

Why is "B. A column is one field and a record is one row" the Correct Answer?Why the Other Options Are Incorrect?

ServiceNow Docs: Understanding Tables and Fieldshttps://docs.servicenow.com/en-US/bundle/utah-platform-administration/page/administer/metadata/concept/c_TablesAndFields.html

References from Certified System Administrator (CSA) Documentation:

TheServiceNow Virtual Agentis an AI-powered chatbot that assists userswithin a messaging interface(such as Microsoft Teams, Slack, or Service Portal). It helpsautomate resolutions and guide usersthrough common IT and HR issues.

Incident Auto-ResolutionallowsVirtual Agenttoautomatically detect, intercept, and resolve incidentsbefore they reach a human agent.

It appliesmachine learning (ML) and predefined rulesto determine whether a ticketcan be resolved through automation.

If an issuematches a known solution, the Virtual Agentprovides the resolution stepsto the user.

If self-resolution fails, the ticket isescalated to an agent.

It is anofficial feature in ServiceNow Virtual Agent.

It allows the chatbot tointercept incidentsand attempt resolution before escalation.

B. Ticket Resolver→Incorrect

"Ticket Resolver" isnot an official ServiceNow feature.

C. Virtual Agent Helper→Incorrect

No feature called "Virtual Agent Helper" exists in ServiceNow.

D. Web Intelligence→Incorrect

Web Intelligenceisnot related to ServiceNow Virtual Agent.

What is Incident Auto-Resolution?Why is "A. Incident Auto-Resolution" the Correct Answer?Why the Other Options Are Incorrect?

ServiceNow Docs: Virtual Agent & Incident Auto-Resolutionhttps://docs.servicenow.com/en-US/bundle/utah-virtual-agent/page/administer/virtual-agent/concept/incident-auto-resolution.html

References from Certified System Administrator (CSA) Documentation:This confirms that"Incident Auto-Resolution" is the correct answer, as it allowsVirtual Agent to intercept and resolve submitted incidents automatically.