Database Management and Platform Security
About 30% of the CSA exam — see all 6 domains.
What this domain covers
- Data Schema
- Application/Access Control
- Importing Data
- CMDB and CSDM
- Security Center
- Shared Responsibility Model
What it covers: the data schema, access control (ACLs), importing data, the CMDB/CSDM, the Security Center, and the shared responsibility model. Spend the most time here.
Data schema:
- Data is stored in tables; each row is a record, each column a field. Every table has a unique sys_id per record.
- Table extension (inheritance): a child table inherits all fields of its parent and adds its own. Example: Incident, Problem, and Change all extend Task. In the CMDB, Configuration Item [cmdb_ci] is the base class for IT CI classes; Base Configuration Item [cmdb] is the core class above it, used for non-IT CIs.
- Field types matter: String, Choice, Reference, Date/Time, True/False, Journal, etc. A Reference field points to a record on another table; dot-walking lets you traverse from a reference to fields on the related record (e.g.,
caller_id.email).
Access control (security):
- Roles are containers of permissions assigned to users (directly or via groups).
admin,itil, etc. - Access Control Rules (ACLs) secure operations on tables/fields. An ACL is evaluated on table.field for an operation (read, write, create, delete). To grant access, the user must pass the required roles AND the condition AND the script, but within the required-roles list the logic is OR (holding any one listed role satisfies the role check; an empty role list passes that check). For field access ServiceNow uses a two-gate model: the table (row) ACL is evaluated first (if it fails, all fields are denied), and only if it passes is the field ACL evaluated; the user must pass both. (The phrase "most specific to most general" describes how candidate rules are matched to one object within a gate, not the table-then-field sequence.)
- Contextual security: ACLs are the foundation. A user who fails every matching ACL is denied. If no ACL matches at all, the system grants access; this is rare, because default wildcard (*) rules protect record operations, and setting glide.sm.default_mode to deny makes objects with no ACLs (or only wildcard ACLs) denied. Zurich also has Deny-Unless ACLs, which deny access unless their conditions pass.
Importing data: the standard path is Import Set → Transform Map → target table.
- An Import Set is a staging table that temporarily holds incoming rows (from Excel/CSV/JDBC/web service).
- A Transform Map defines how staging columns map to target table fields, including coalesce (a field used to match existing records so imports update rather than duplicate) and field maps.
- Data sources define where the data comes from for scheduled/automated imports.
CMDB and CSDM:
- The CMDB stores Configuration Items (CIs) and their relationships. IT CI classes extend cmdb_ci; non-IT CIs sit under Base Configuration Item [cmdb].
- CSDM (Common Service Data Model) is the standard, prescriptive framework for how to structure service and CI data in the CMDB.
Security Center gives a centralized view of the instance's security posture. The Shared Responsibility Model clarifies what ServiceNow secures (the platform/infrastructure) versus what the customer secures (their configuration, data, access, and integrations).
Sample questions from this domain
Three of the 90 in this domain, with the reasoning. The full set is in the question bank.
Incident, Problem, and Change Request all share fields such as Number, State, and Assigned to. What is the underlying reason these fields are common to all three?
- A. They all extend the cmdb_ci table
- B. They all extend the Task table ✓
- C. They all extend the Case table
- D. They all extend sys_metadata
Why: Incident, Problem, and Change Request extend the Task (task) table through table inheritance, so they inherit Task's fields such as Number, State, and Assigned to. Case is the Customer Service table, which itself extends Task; Incident, Problem, and Change do not extend it. cmdb_ci is the parent of IT configuration item classes, not of process records. sys_metadata underlies application files and configuration records, not task-based process tables.
A field on a form is a reference field pointing to the Caller (User) record. The admin wants to display the caller's email on the form without copying the value. What technique retrieves the email from the referenced User record?
- A. Coalescing
- B. Inheritance
- C. Dot-walking ✓
- D. Display value
Why: Dot-walking traverses a reference field to reach fields on the related record, for example caller_id.email, so the email is shown without being copied. Coalescing is the import-set match key that decides update versus insert. Inheritance (table extension) gives a child table its parent's fields but does not follow a reference to another record. The display value of the Caller reference is the user's name, not the email.
When a user requests a record operation, ServiceNow evaluates the matching Access Control rules (ACLs). If the user fails every matching ACL for that operation, what happens?
- A. Access is granted
- B. Access is denied ✓
- C. Access is audited
- D. Access is escalated
Why: If matching ACLs exist and the user fails all of them, the operation is denied. Within a single ACL, the user must meet all of its requirements (required role, condition, and script). Access is normally granted only in the rare case where no ACL matches the operation at all (unless glide.sm.default_mode is set to deny), which is not this scenario, and the base system ships default (wildcard) rules that protect record operations. ACL evaluation has no audit or monitoring mode that lets a failed operation through, and a failed check is not escalated to anyone for a decision.