SERVICENOW INTERVIEW
QUESTIONS & ANSWERS.
One place for the questions ServiceNow interviewers actually ask, grouped by the role you are being screened for. Every answer is short enough to say out loud, and each section links to the deep-dive page and the timed practice drills for that topic.
ServiceNow Developer
Scripting-heavy screens. Expect GlideRecord, business rules, client scripts, GlideAjax and script includes with follow-up 'why' questions.
When do you use GlideRecord vs GlideAggregate?
GlideRecord walks rows and is right when you need field values or updates. GlideAggregate pushes COUNT/SUM/AVG to the database, so use it for metrics — it avoids pulling thousands of rows into memory just to increment a counter.
Before vs after vs async business rule — how do you choose?
Before: change values on the record being saved (no extra update). After: act on other records once this row is committed. Async: fire-and-forget work that must not slow the transaction, such as integrations or notifications fan-out.
Why is current.update() inside a before business rule a bug?
The record is already in the middle of its own update, so calling update() causes recursion and a second write. Set the field directly (current.field = value) and let the engine persist it.
How do you call server logic from a client script correctly?
GlideAjax against a Client Callable Script Include, with a callback. Avoid synchronous getXMLWait() — it freezes the browser — and never use g_form on the server side.
What makes a Script Include client callable and why does it matter?
It must extend AbstractAjaxProcessor and have Client callable checked. Without it, GlideAjax returns nothing; with it, only the methods you expose are reachable, which keeps the surface area small.
ServiceNow Administrator (CSA)
Configuration and governance. ACLs, UI policies, update sets, catalog and notifications dominate the CSA-level screen.
What order do ACLs evaluate in?
Most specific to least: table.field, then table.*, then the parent table. A failing field ACL only masks that field — the row itself stays visible if the table ACL passes.
UI Policy or Client Script?
UI Policy for declarative mandatory/visible/read-only behaviour — less code, runs client and server. Client Script when you need imperative logic like calculations or AJAX lookups.
What does an update set capture?
Configuration only: tables, fields, business rules, ACLs, UI policies, form layouts. Data rows are not captured — move those with import sets or XML export.
Catalog Item vs Record Producer?
A Catalog Item creates REQ/RITM and runs fulfilment. A Record Producer writes straight into a target table such as incident, with no request wrapper.
My notification isn't firing — how do you debug it?
Check when-to-send, the conditions against the actual row, whether Send to resolves to a recipient, 'send to event creator', and that the email account is active and not in test mode.
IRM / GRC Architect
Risk framework design questions. Interviewers probe scoring models, entity hierarchies and control attestation at scale.
How does risk scoring work in IRM?
Inherent score comes from likelihood x impact on the risk record; residual score applies control effectiveness. Scores roll up through the entity hierarchy, so the entity design drives the numbers as much as the formula does.
What is an entity vs an entity type vs an entity class?
Entity is the thing being assessed (an app, a vendor, a process). Entity type groups entities for scoping and filtering. Entity class links them to the underlying table so risks and controls can attach.
How do you avoid attestation fatigue?
Share control test results across mapped authority documents rather than issuing one attestation per citation, and stagger campaign schedules by control criticality.
Where do Issues come from and who owns them?
Issues are raised from failed control tests, audit findings or manual entry, and route to the control owner with a remediation task. The Issue is the single record that ties evidence to closure.
CMDB / Discovery Engineer
Data-quality questions. Expect IRE, reconciliation, MID Server design, CI classes and CSDM alignment.
What does the Identification and Reconciliation Engine actually do?
IRE decides whether an inbound payload matches an existing CI (identification rules) and which data source is allowed to write each attribute (reconciliation rules). Without it, every import creates duplicates.
Why would Discovery find a device but not classify it?
Port scan succeeded but classification failed — usually missing or wrong credentials, a probe that returned no usable fingerprint, or no classifier matching the returned data.
When do you add a second MID Server?
For network segmentation (a subnet the first can't reach), for throughput once the ECC queue backs up, or for high availability via a MID Server cluster.
What problem does CSDM solve?
It standardises how services, applications and infrastructure relate so reporting, ITSM and Service Mapping all speak the same model instead of each team inventing its own hierarchy.
ITSM / Process Consultant
Process fluency over syntax. Incident vs problem vs change, SLAs, and Flow Designer automation.
Incident vs Problem vs Change — the one-line version?
Incident restores service now. Problem removes the underlying cause. Change controls the planned modification that fixes it. Interviewers listen for whether you keep the records separate.
How do SLAs attach and pause?
An SLA definition attaches when its start condition matches, pauses on pause conditions (for example, awaiting the caller), and stops on the stop condition. Schedules decide which hours count.
Flow Designer or legacy Workflow for new automation?
Flow Designer — scoped, versioned, testable, and it has spokes for integrations. Legacy Workflow only stays for content not yet migrated.
Practice, don't just read
Reciting answers gets you through the phone screen; the technical round asks you to write script. Run the drills.