ServiceNow CTA ServiceNowCertified Technical Architect (CTA) Exam Practice Test

Service Mapping in ServiceNow has two primary capabilities:

A. Create a service-centric Configuration Management Database (CMDB): Service Mapping helps shift the focus of the CMDB from individual components to a service-centric view. It achieves this by mapping the relationships between infrastructure components and the services they support, providing a clear understanding of how IT supports business services.

E. Establish links between IT infrastructure components and application services: This is the core function of Service Mapping. It automatically discovers and maps the dependencies between applications, infrastructure (servers, databases, network devices), and the services they deliver. This creates a visual representation of the IT landscape and how it supports business services.

Why not the other options?

B: While Service Mapping can indirectly contribute to cybersecurity by providing visibility into the IT environment, enhancing cybersecurity measures is not its primary function.

C: Automating routine IT infrastructure updates is typically handled by other ServiceNow capabilities like Orchestration, not Service Mapping.

D: Software licensing management is usually handled by Software Asset Management tools, not Service Mapping.

To effectively manage risks during a go-live, it's essential to have a back-out plan and mitigation plan for unforeseen circumstances. This includes:

Back-out Plan: A detailed procedure for reverting to the previous system or version if the go-live encounters critical issues.

Mitigation Plans: Prepared responses for anticipated risks (e.g., data migration errors, performance issues, user resistance). These plans outline steps to address these risks if they occur.

Risk Assessment: A thorough risk assessment should be conducted before the go-live to identify potential risks and their likelihood.

Why not the other options?

A. A list of key performance metrics to track the performance: While performance monitoring is important, it's not the primary element for managing risks.

C. A detailed communication plan for all stakeholders: Communication is crucial, but it's a separate component of the go-live plan.

D. A schedule for user training and support sessions: User training and support are important but not directly related to risk management.

The primary purpose of a go-live plan is to facilitate a seamless and smooth transition process when deploying new software or changes to a production environment. It acts as a roadmap for the go-live event, outlining the steps involved, roles and responsibilities, and timelines.  

A go-live plan typically includes:

Pre-Go-Live Activities: Data migration, system checks, communication to users.

Go-Live Activities: Deployment steps, rollback procedures, monitoring.

Post-Go-Live Activities: Support procedures, user training, issue resolution.  

Why not the other options?

B. To record root causes for problems arising out of the transition: While problem resolution isimportant, it's not the primary purpose of the go-live plan.

C. To establish a backup system for data recovery: Backups are essential, but they are a separate consideration from the go-live plan.

D. To conduct a comprehensive review of all project documents: This review should happen earlier in the project lifecycle.

Client-side Encryption is the best solution to encrypt customer credit card numbers before they are stored in the cloud and provide easy key management. Here's why:

Encryption Before Storage: Data is encrypted on the client-side (e.g., user's browser or device) before being sent to the cloud, ensuring that even if the cloud storage is compromised, the sensitive data remains protected.

Key Management: The encryption keys are managed by the client or a trusted key management system, providing greater control and flexibility.

Reduced Risk: Client-side encryption minimizes the risk of sensitive data being exposed in the cloud environment.

Why not the other options?

A. Edge Encryption: This is a broader term that can refer to various encryption techniques applied at the edge of the network.

B. Server-side Encryption: Data is encrypted on the server-side, which means the cloud provider has access to the encryption keys.

D. Database Encryption: This encrypts the entire database, but it doesn't provide the same level of control and key management as client-side encryption.

Security should be established before configuring interfaces or business logic in the ServiceNow application build process. This is known as "security by design."

Here's why:

Prevent Security Gaps: Building security into the application from the start helps prevent vulnerabilities and security gaps that can be exploited later.

Reduce Rework: Addressing security early avoids costly rework later if security issues are discovered after development is complete.

Enforce Best Practices: Starting with security ensures that security best practices are followed throughout the development process.

Why not the other options?

A. Only when issues are encountered during operations: This is a reactive approach that can lead to significant security risks.

B. After configuring all the application workspaces: Security should be integrated throughout the application, not just in specific workspaces.

C. After configuring all required integrations: Security should be considered before and during integration to ensure secure data exchange.

A core principle for data import in ServiceNow is to use authoritative sources. This means:

Trusted Data: Import data from sources that are known to be accurate, reliable, and up-to-date.

Data Integrity: Using authoritative sources ensures the integrity and quality of the data being imported into ServiceNow.

Reduced Errors: Relying on trusted sources minimizes the risk of importing incorrect or inconsistent data.

Why not the other options?

A. Import data first and validate later: This can lead to data quality issues and require significant cleanup efforts.

C. Use ServiceNow as a data proxy: ServiceNow is not designed to be a primary data store for external systems.

D. Schedule imports monthly: The frequency of imports depends on the specific data and its volatility.

Starting with the Washington DC release, ServiceNow is transitioning from Database Encryption to Cloud Encryption for protecting data at rest.

Cloud Encryption: This leverages the encryption capabilities of the underlying cloud infrastructure (e.g., AWS, Azure) to provide a more robust and scalable encryption solution.

Enhanced Security: Cloud Encryption offers improved key management and security features compared to the previous Database Encryption.

Simplified Management: It reduces the administrative overhead associated with managing encryption keys.

Non-functional testing focuses on how a system operates and meets user expectations in terms of qualities like:

Performance: Response times, load handling, scalability

Usability: Ease of use, user interface design

Security: Protection against unauthorized access and data breaches

Reliability: System stability and availability

Maintainability: Ease of making changes and updates

Why not the other options?

A. Specific behaviors and outputs of the system: This is the focus of functional testing, which verifies that the system does what it's supposed to do.  

C. The creation of records and setting field values: This is a specific functional aspect of the system.

D. Functional requirements outlined in the design document: These are tested during functional testing.

To control access to sensitive data at the field level, the system administrator should use Column Level Encryption (CLE).

Here's how CLE works:

Field-Level Encryption: CLE allows you to encrypt specific fields within a table, ensuring that only authorized users with the necessary decryption keys can access the data.

Granular Control: You can define different encryption keys for different fields or groups of fields, providing fine-grained control over data access.

Role-Based Access: You can grant access to decryption keys based on user roles, ensuring that only authorized personnel can view sensitive information.

Why not the other options?

A. PI1 Encryption: This is not a standard ServiceNow encryption feature.

C. Cloud Encryption: This is a broader term for encryption solutions provided by cloud providers, not a specific ServiceNow feature.

D. Full Disk Encryption (FDE): This encrypts the entire hard drive, not individual fields within the application.

The domains of technical architecture in ServiceNow encompass the key areas that ensure the platform's stability, security, and scalability. These include:

B. Security Management: This domain focuses on securing the ServiceNow instance, including access control, authentication, data encryption, and vulnerability management.

C. Environment Management: This domain deals with the management of the ServiceNow instances, including instance strategy, upgrades, patching, and performance monitoring.

D. Data Management: This domain covers aspects of data governance, data quality, data integration, and data security within the ServiceNow platform.

Why not the other options?

A. Risk Management: While important, risk management is a broader organizational concern that extends beyond technical architecture.

E. App Dev Management: Application development management is a specific area within the broader technical architecture, focusing on the development and deployment of applications on the platform.

Key considerations for data integrations in ServiceNow include:

B. Accessing and using only authorized data: Ensure that integrations only access and use data that is authorized and necessary for the integration's purpose. This is crucial for data security and privacy.

C. Fetching only clean and accurate data: Data quality is essential for successful integrations. Implement data validation and cleansing processes to ensure that only accurate and consistent data is transferred.

E. Maintaining a single source of truth: Whenever possible, identify a single authoritative source for each data element to avoid inconsistencies and conflicts.

Why not the other options?

A. Duplicating data across all systems: This can lead to data inconsistencies and increased storage costs.

D. Maximizing data transfer volume: The focus should be on transferring the necessary data efficiently, not maximizing volume.

Automated testing is ideal for scenarios involving repetitive tasks over extended periods. Here's why:  

Efficiency: Automated tests can execute tasks much faster than humans.  

Consistency: Automated tests perform the same steps precisely every time, eliminating human error.  

Endurance: Automated tests can run continuously for long durations without fatigue.

Regression Testing: Automated tests are excellent for regression testing, repeatedly checking that existing functionality hasn't been broken by new changes.  

Why not the other options?

B. Usability testing: Focuses on user experience and requires human observation.

C. Ad hoc testing: Informal, unplanned testing without specific test cases.  

D. Manual testing: Performed by humans, which can be time-consuming and prone to errors for repetitive tasks.  

Assigning data ownership by role is the most effective way to reduce complexity and maintenanceoverhead. Here's why:

Clear Responsibility: Roles are associated with specific responsibilities and functions within an organization. Assigning data ownership to a role ensures that someone is clearly accountable for the quality and accuracy of that data.

Reduced Overhead: When people change positions or leave the organization, the data ownership remains with the role, not the individual. This reduces the need to constantly update ownership assignments.

Consistency: Role-based ownership promotes consistency in data management practices and ensures that data is handled according to defined standards.

Why not the other options?

A. Assigning data ownership by location: This can create confusion and inconsistencies, especially in organizations with multiple locations or remote teams.

C. Assigning data ownership by attribute: This can be overly granular and difficult to manage, especially for large datasets.

D. Assigning data ownership by entity: This can lead to unclear ownership and potential conflicts if multiple entities are involved with the same data.

Usability testing is the type of testing that relies on human observation to assess the user-friendliness of a software product.  

In usability testing:

Real users interact with the software or product in a realistic setting.

Observers watch and record user behavior, noting any difficulties, frustrations, or areas of confusion.

Feedback is gathered from users to understand their experiences and identify areas for improvement.  

Why not the other options?

A. Smoke testing: A quick, preliminary test to ensure basic functionality is working.

C. Integration testing: Tests the interaction between different modules or components of a system.  

D. System testing: Tests the entire system as a whole.