SERVICENOW CSA
INTERVIEW Q&A.
Twenty CSA-level questions a 2026 ServiceNow interviewer is likely to ask, grouped by topic with model answers tight enough to recite in a phone screen. Skim, then practice the muscle memory in the timed quizzes.
ACLs
What is the evaluation order of ACLs in ServiceNow?
ACLs evaluate most-specific to least-specific: table.field → table.* → parent table.*. For a field read, the field ACL runs first; if no field ACL matches, the table ACL is the fallback. A failing field ACL only masks the field — the row stays visible.
Difference between a Role, Group, and ACL?
A Role is a permission token assigned directly or through a Group. A Group bundles users for assignment and notification. An ACL is the actual security check (row + field-level) that asks 'does this user have role X / pass this script' before granting CRUD.
UI Policies
When do you choose a UI Policy over a Client Script?
Use UI Policy for declarative mandatory/visible/readonly behavior — they're easier to maintain, run client + server, and survive form refactors. Reach for a Client Script when you need imperative logic (calculations, AJAX calls, conditional dialogs).
What is the order of execution between UI Policies and Client Scripts?
On form load: Client Scripts (onLoad) run, then UI Policies. On change: Client Script onChange runs, then UI Policy. UI Policies effectively run last, so they can override what a Client Script just set.
Update Sets
What goes in an Update Set vs Data?
Update Sets capture configuration: business rules, tables, fields, ACLs, UI policies, form layouts. Data records (incidents, users, CMDB CIs) are NOT captured — move those with Import Sets, XML export, or the System Clone process.
Two update sets touched the same business rule — what wins?
Last-committed wins. The newer sys_update_xml record in the target instance overwrites the older. Best practice: review the Preview step for collisions, accept the intended payload, and skip the rest.
Service Catalog
Catalog Item vs Record Producer?
A Catalog Item creates a request (REQ + RITM + tasks) for fulfilment workflows. A Record Producer inserts directly into a target table (e.g. incident) — no REQ/RITM, no approval chain by default. Use Producers for self-service forms that just need a row.
Where do variables live in the request lifecycle?
Variables are stored on the sc_item_option_mtom join to sc_item_option and surface on the RITM. Reference them in workflows via current.variables.<name> and in scripts via gs.getProperty()-style accessors.
Notifications
Why isn't my Notification firing on insert?
Check: (1) When-to-send is set to 'Event is fired' or 'Record inserted/updated', (2) the Conditions match the row, (3) Send to has at least one recipient that resolves, (4) Send to event creator is on if the trigger user is the only recipient, (5) the email account is active and not in test mode.
What's the difference between Event-based and Record-based notifications?
Record-based fires when a record meets the conditions on insert/update. Event-based listens to a named event registered in sysevent_register and fired with gs.eventQueue() — better for decoupled async fan-out and when you need custom event parms.
Tables
What is table extension and when does it cause problems?
Extension lets a child table inherit columns from a parent (task → incident). Problems: cross-table queries on the parent scan all children, ACLs on the parent apply to all children, and you can't shorten parent fields once children depend on them.
Import Sets
What does a Transform Map do?
It maps staging-table columns (sys_import_set_row) into a target table during a Transform run. Includes coalesce fields (dedup keys), field mappings, scripts (onBefore/onAfter/onForeignInsert), and choice-action handling.
Workflows
Flow Designer vs legacy Workflow?
Flow Designer is the modern, low-code, scoped, versioned, async-friendly engine — preferred for all new automation. Legacy Workflow is graph-based, global-scope by default, harder to test, and only kept around for unmigrated content.
CMDB
What is reconciliation in CMDB and why does it matter?
Reconciliation rules decide which data source 'wins' when multiple discovery sources update the same CI attribute. Without rules, the last writer wins and your CMDB drifts. Define source priorities per attribute or class.
Reports
Difference between an ACL on a report and an audience?
An ACL on sys_report controls who can view the report definition. The Visibility / Audience controls who can see it on a dashboard or in lists. You need both: ACL grants the underlying records and the report metadata.
Roles
What does the itil role grant?
Itil is the standard fulfiller role — read/write on task and most ITSM tables (incident, problem, change), and access to the Service Desk modules. It does NOT grant admin-only operations or scoped app elevations.
Performance
How do you debug a slow list view?
Open the URL with ?sysparm_debug=true, check Slow Query Log under System Diagnostics, inspect indexes on the order-by + condition columns, look for reference dot-walks in the list (each is a join), and consider a database view if the same join is repeated.
Upgrades
What is Skip vs Revert during an upgrade?
Skip keeps your customization and leaves the upgrade record un-applied. Revert restores the OOTB version, discarding your change. Always run the Upgrade Monitor before going live so you choose deliberately rather than accepting defaults.
Properties
What is a System Property and how do you create one safely?
sys_properties rows are key/value settings read via gs.getProperty(). Create them through System Properties > Categories so they're grouped, scope them to your app, and never store secrets there — use System Vault or Credentials instead.
Scoped Apps
What are the trade-offs of a scoped app vs global?
Scoped apps are namespaced, versioned, easier to publish/share, and enforce stricter APIs (no direct global-table writes without cross-scope access). Global gives you maximum flexibility but pollutes the platform and makes future migration painful.
Drill deeper
Pair this list with the developer-side scripting guides for full coverage of the platform technical questions.