ServiceNow Certified Implementation Specialist – Service Provider (CIS-SP) — Questions and Answers

Question 1: In a Salesforce CI/CD pipeline, what is the primary purpose of running automated tests in a validation deployment (check-only)?

To verify all tests pass and coverage meets thresholds before committing changes to an org, without actually deploying (Correct answer)
To deploy metadata to production without requiring manual approval
To refresh sandbox data before running integration tests
To identify which metadata components have changed since the last deployment

Correct answer: To verify all tests pass and coverage meets thresholds before committing changes to an org, without actually deploying

Check-only deployments validate that tests pass and coverage requirements are met without making any changes to the target org.

Question 2: What does 'continuous delivery' differ from 'continuous deployment' in a Salesforce context?

They are identical terms used interchangeably in the Salesforce ecosystem.
Continuous delivery deploys automatically; continuous deployment requires manual approval.
Continuous delivery applies to sandboxes only; continuous deployment applies to production.
Continuous delivery requires a manual approval gate before production; continuous deployment pushes automatically once tests pass. (Correct answer)

Correct answer: Continuous delivery requires a manual approval gate before production; continuous deployment pushes automatically once tests pass.

Continuous delivery keeps the release pipeline production-ready with a human approval step, while continuous deployment removes that gate and deploys automatically.

Question 3: Which data structure supports O(1) average-case insertion, deletion, and lookup?

Binary Search Tree
Hash Table (Correct answer)
Sorted Array
Linked List

Correct answer: Hash Table

Hash tables achieve O(1) average-case performance for insert, delete, and lookup via direct index calculation.

Question 4: Which sorting algorithm is generally most efficient for large, nearly-sorted datasets?

Quick Sort
Bubble Sort
Insertion Sort (Correct answer)
Selection Sort

Correct answer: Insertion Sort

Insertion Sort performs close to O(n) on nearly-sorted data because few elements need to be moved.

Question 5: Which OSI layer is responsible for end-to-end error detection and flow control between hosts?

Transport Layer (Layer 4) (Correct answer)
Network Layer (Layer 3)
Session Layer (Layer 5)
Data Link Layer (Layer 2)

Correct answer: Transport Layer (Layer 4)

The Transport Layer (Layer 4) handles end-to-end communication, flow control, and error detection using protocols like TCP.

Question 6: Which professional service provider specializes in ensuring compliance with regulations such as GDPR?

Legal and Compliance Services (Correct answer)
Financial Advisors
Cloud Service Providers
Marketing Agencies

Correct answer: Legal and Compliance Services

Legal and Compliance Services specialize in helping organizations navigate complex regulatory landscapes, such as GDPR (General Data Protection Regulation). These providers offer expertise in legal frameworks, data privacy laws, and compliance requirements, ensuring businesses adhere to regulations and avoid penalties. Their role is critical in managing legal and reputational risks.

Question 7: In Salesforce, what happens to a roll-up summary field when the child records associated with a master record are deleted?

The field recalculates automatically (Correct answer)
The field reverts to zero without recalculation
The field is locked and shows an error
The field retains the last calculated value

Correct answer: The field recalculates automatically

Roll-up summary fields automatically recalculate when child records are deleted, always reflecting the current state.

Question 8: Which Salesforce compliance program certification demonstrates that a Service Provider's implementation practices meet cloud security standards relevant to US federal agencies?

ISO 27001
PCI DSS
FedRAMP (Correct answer)
SOC 2 Type II

Correct answer: FedRAMP

FedRAMP (Federal Risk and Authorization Management Program) is the US government standard for cloud service security, required for federal agency engagements.

Question 9: What is the DRY principle in programming?

Dont Repeat Yourself — avoid code duplication (Correct answer)
Document, Review, Yield
Delete Redundant Yields
Debug and Run Yearly

Correct answer: Dont Repeat Yourself — avoid code duplication

DRY means every piece of knowledge should have a single, unambiguous representation in a system, reducing redundancy.

Question 10: Which Salesforce feature allows an administrator to automatically assign incoming cases to the appropriate queue or agent based on predefined criteria?

Assignment Rules (Correct answer)
Entitlement Processes
Escalation Rules
Auto-Response Rules

Correct answer: Assignment Rules

Case Assignment Rules evaluate criteria on newly created or edited cases and route them to a specified queue or user based on matching conditions.

Question 11: What is the purpose of the OSI model?

To replace all networking equipment
To provide a standard framework for understanding network communications (Correct answer)
To monitor network performance only
To encrypt all network traffic

Correct answer: To provide a standard framework for understanding network communications

The OSI model provides a conceptual framework with seven layers that standardizes network communication functions.

Question 12: A solution architect must expose Salesforce data to a mobile app with strict latency requirements. Which approach provides the best performance while keeping data secure?

Composite REST API with field-level query (Correct answer)
SOAP API with full object retrieval
Bulk API 2.0 for real-time reads
Direct database connection via JDBC

Correct answer: Composite REST API with field-level query

The Composite REST API reduces round trips and allows field-level filtering, minimizing payload size and latency.

Question 13: Which Salesforce feature enables multiple business processes to be defined on a single object with different picklist values and page layouts?

Record Types (Correct answer)
Compact Layouts
Validation Rules
Page Layouts

Correct answer: Record Types

Record Types allow administrators to define different business processes, picklist values, and page layouts for different groups of users on the same object.

Question 14: A company needs to prove that their Salesforce implementation's security controls are operating effectively for a SOC 2 audit. Which Salesforce tool provides exportable evidence of user activity?

All of the above depending on the control being evidenced (Correct answer)
Setup Audit Trail CSV export
Shield Event Monitoring logs
Login History export

Correct answer: All of the above depending on the control being evidenced

SOC 2 audits require evidence across multiple control types; Event Monitoring covers usage events, Setup Audit Trail covers configuration changes, and Login History covers access events.

Question 15: What is the maximum number of active scratch orgs a Salesforce DX project can have by default with a Developer Edition org?

5 (Correct answer)
10
25
50

Correct answer: 5

Developer Edition orgs allow up to 5 active scratch orgs at a time by default, while Enterprise orgs receive a higher limit.

Question 16: Which Salesforce feature allows admins to define reusable data sets that can be packaged and deployed across orgs without using custom objects?

Custom Metadata Types (Correct answer)
Static Resources
Custom Settings
Named Credentials

Correct answer: Custom Metadata Types

Custom Metadata Types are packageable, deployable configuration records that can be deployed via change sets or packages across orgs.

Question 17: A Salesforce Connected App uses certificate-based authentication. Where must the certificate be registered?

In the Connected App's Digital Certificate field in Salesforce Setup (Correct answer)
On the client's VPN server
In the Salesforce org's DNS settings
On the client's local browser

Correct answer: In the Connected App's Digital Certificate field in Salesforce Setup

For JWT bearer token flows, the X.509 certificate must be uploaded to the Connected App configuration in Salesforce Setup.

Question 18: When would a developer choose a Set over a List in an Apex bulkification pattern?

When duplicate IDs must be preserved
When order of processing matters
When collecting unique parent IDs for a single SOQL query (Correct answer)
When index-based access is required

Correct answer: When collecting unique parent IDs for a single SOQL query

Sets eliminate duplicate IDs automatically, making them ideal for collecting parent record IDs before a single batched SOQL query.

Question 19: A Salesforce Service Provider stores client org credentials in a shared team password manager. Which security compliance standard MOST directly governs the protection of these privileged credentials?

NIST SP 800-53 for cloud-only systems
WCAG 2.1 — Web Accessibility Guidelines
ISO/IEC 27001 — Information Security Management (Correct answer)
CAN-SPAM

Correct answer: ISO/IEC 27001 — Information Security Management

ISO/IEC 27001 is the internationally recognized standard for information security management, including controls for privileged access and credential management.

Question 20: Which sorting algorithm has the best average-case time complexity?

Selection Sort with O(n^2)
Merge Sort with O(n log n) (Correct answer)
Insertion Sort with O(n^2)
Bubble Sort with O(n^2)

Correct answer: Merge Sort with O(n log n)

Merge Sort consistently achieves O(n log n) time complexity using a divide-and-conquer approach.

Question 21: What does enabling 'Require Secure Connections (HTTPS)' in Session Settings enforce?

API calls must include a session token
All sessions must use HTTPS rather than HTTP (Correct answer)
Users must use MFA on every login
Login is restricted to corporate IP ranges

Correct answer: All sessions must use HTTPS rather than HTTP

This setting forces all Salesforce sessions to use HTTPS, preventing data from being transmitted over unencrypted HTTP connections.

Question 22: What is the security risk of using the Username-Password OAuth flow in a Connected App?

User credentials are transmitted to the application, increasing credential exposure risk (Correct answer)
Refresh tokens cannot be issued, requiring frequent re-authentication
It bypasses field-level security checks
It exposes the client secret in the URL

Correct answer: User credentials are transmitted to the application, increasing credential exposure risk

The Username-Password flow requires the app to handle user credentials directly, creating a risk that credentials are stored or logged insecurely by the app.

Question 23: What security best practice should be applied when a Salesforce admin creates a new integration user for an external system?

Enable MFA and provide credentials to the integration vendor
Reuse an existing active user's credentials to simplify management
Assign the System Administrator profile for broad access
Create a dedicated profile with only required permissions, no UI login, and generate a named credential (Correct answer)

Correct answer: Create a dedicated profile with only required permissions, no UI login, and generate a named credential

Integration users should have a minimal-permission profile, be configured for API-only access, and use named credentials to avoid embedding credentials in code.

Question 24: Which Salesforce feature allows service providers to enforce data residency requirements by storing specific records in designated geographic regions?

External Objects pointing to regional databases
Salesforce Shield Event Monitoring with geo-filters
Custom metadata routing via Apex callouts
Salesforce Hyperforce with local region deployment (Correct answer)

Correct answer: Salesforce Hyperforce with local region deployment

Salesforce Hyperforce's public cloud infrastructure allows customers to choose specific geographic regions for data storage, meeting data residency requirements.

Question 25: Which field type in Salesforce automatically maintains a historical log of changes made to its value?

Field History Tracking enabled field (Correct answer)
Encrypted Field
Formula Field
Text Area (Long)

Correct answer: Field History Tracking enabled field

When Field History Tracking is enabled on a field, Salesforce automatically logs changes including old value, new value, date, and user.

Question 26: A customer wants to use Salesforce as the system of record for products while allowing regional teams to add custom attributes. Which data modeling approach best supports this without schema explosion?

Use a key-value Custom Object (Product_Attribute__c) related to Product2 (Correct answer)
Store attributes as JSON in a Long Text Area field
Create region-specific child Product objects via Master-Detail
Add hundreds of optional custom fields to the Product object

Correct answer: Use a key-value Custom Object (Product_Attribute__c) related to Product2

A related attribute object (Entity-Attribute-Value pattern) keeps the core schema clean while supporting unlimited regional customization.

Question 27: When implementing a FIFO queue pattern in Apex without a native Queue class, which List methods are used to enqueue and dequeue?

add(0,x) and remove(size-1)
push() and pop()
add() and remove(0) (Correct answer)
insert() and delete()

Correct answer: add() and remove(0)

add() appends to the end (enqueue) and remove(0) removes the first element (dequeue), implementing FIFO behavior.

Question 28: What does the 'Before Insert' trigger context in Salesforce allow a developer to do that 'After Insert' does not?

Modify field values on the new record without an additional DML (Correct answer)
Access related object records
Query the inserted record by ID
Send outbound messages

Correct answer: Modify field values on the new record without an additional DML

Before Insert triggers fire before the record is saved, allowing field value modifications without consuming an extra DML statement.

Question 29: When using Salesforce SOQL, what clause is used to filter query results based on a related object's field?

WHERE with dot notation (Correct answer)
INCLUDES
JOIN
HAVING

Correct answer: WHERE with dot notation

SOQL uses dot notation in the WHERE clause (e.g., Account.Name = 'Acme') to filter on related object fields.

Question 30: What is the role of a code of ethics in the SP profession?

To restrict professional freedom
To create legal liability
To standardize pricing for services
To guide professional behavior and protect the public interest (Correct answer)

Correct answer: To guide professional behavior and protect the public interest

A code of ethics establishes expectations for professional conduct and serves as a guide for ethical decision-making.

Question 31: When performing an upsert operation with Data Loader, which field on the target object must be designated as the External ID?

The standard Salesforce record ID field
Any auto-number field
Any field explicitly marked as External ID (Correct answer)
Any text field marked as Unique

Correct answer: Any field explicitly marked as External ID

Upsert operations require a field explicitly configured as an External ID in Salesforce field settings to match and update existing records.

Question 32: What is the recommended approach to avoid SOQL queries inside for loops in Apex triggers?

Use a @future method for each record
Replace SOQL with SOSL inside loops
Bulkify by collecting IDs first and querying once outside the loop (Correct answer)
Use lazy loading inside each iteration

Correct answer: Bulkify by collecting IDs first and querying once outside the loop

Bulkification involves collecting all needed IDs before the loop and issuing a single SOQL query, avoiding governor limit violations.

Question 33: In SOSL (Salesforce Object Search Language), which keyword is used to specify which objects and fields to search?

IN
FROM
SELECT
RETURNING (Correct answer)

Correct answer: RETURNING

The RETURNING keyword in SOSL specifies which objects and fields should be included in the search results.

Question 34: What is the purpose of Salesforce Shield Platform Encryption?

Encrypt data at rest in Salesforce databases (Correct answer)
Enforce field-level security on reports
Mask sensitive data in Apex debug logs
Encrypt data in transit between browser and server

Correct answer: Encrypt data at rest in Salesforce databases

Shield Platform Encryption encrypts data at rest in Salesforce, protecting sensitive fields stored in the database.

Question 35: Which Apex Map method safely returns null instead of throwing an exception when a key is not found?

get(key) (Correct answer)
find(key)
fetch(key)
retrieve(key)

Correct answer: get(key)

Map.get(key) returns null if the key does not exist, avoiding a NullPointerException when handled properly.

Question 36: When a Salesforce org hits its data storage limit, which action provides an immediate reduction without data loss?

Archive records to a Heroku Postgres database using Salesforce Connect
Run a mass deletion of old task and event records from the Recycle Bin
Move attachments to Salesforce Files (Content) to use file storage instead (Correct answer)
Delete all chatter feed items and email message records

Correct answer: Move attachments to Salesforce Files (Content) to use file storage instead

Converting Attachments to Salesforce Files moves them from data storage (limited) to file storage (separate, larger allocation), immediately freeing data storage.

Question 37: What is a hash collision?

When a hash table runs out of memory
When a hash function returns null
When two different keys produce the same hash value (Correct answer)
When two hash tables are merged

Correct answer: When two different keys produce the same hash value

A hash collision occurs when different inputs map to the same index in a hash table, requiring collision resolution.

Question 38: A Salesforce partner wants to ensure their Lightning Web Component renders correctly in all Experience Cloud templates. What is the key configuration requirement?

Configure a Custom Metadata record to map LWC names to community template slots
Add isExposed: true and define targets in the component's meta XML (Correct answer)
Register the LWC as a Visualforce component override for community pages
Deploy the LWC to a Salesforce CDN endpoint before use in communities

Correct answer: Add isExposed: true and define targets in the component's meta XML

Setting isExposed: true and specifying community-compatible targets in the .js-meta.xml file makes an LWC available in Experience Builder.

Question 39: Which Salesforce collection type maintains insertion order and allows duplicate values?

Set
Map
Queue
List (Correct answer)

Correct answer: List

List in Apex maintains insertion order and permits duplicate elements, unlike Set which is unordered and unique.

Question 40: A partner's customer reports that their Apex trigger is causing a 'System.LimitException: Too many SOQL queries: 101' error. What is the root cause and fix?

The trigger is missing a try-catch block to handle the SOQL exception gracefully
The trigger runs in a loop calling SOQL inside a for-each; move SOQL outside the loop to bulkify (Correct answer)
The org has exceeded its daily API limit; request a temporary limit increase
SOQL queries in triggers count double; rewrite the logic using Apex Batch

Correct answer: The trigger runs in a loop calling SOQL inside a for-each; move SOQL outside the loop to bulkify

Placing SOQL queries inside loops multiplies queries per record and quickly exceeds the 100 SOQL query governor limit; bulkifying by moving queries outside loops is the fix.

Question 41: What is the purpose of a junction object in Salesforce data modeling?

To replace lookup fields with formula fields
To roll up values from child to parent
To enforce field-level security between two objects
To create a many-to-many relationship between two objects (Correct answer)

Correct answer: To create a many-to-many relationship between two objects

A junction object has two master-detail relationships pointing to different parent objects, enabling many-to-many data relationships.

Question 42: What is the purpose of a queue data structure?

To sort elements automatically
To process elements in First-In-First-Out (FIFO) order (Correct answer)
To enable random access to elements
To store elements in sorted order

Correct answer: To process elements in First-In-First-Out (FIFO) order

Queues process elements in FIFO order, like a line at a store — first to arrive is first to be served.

Question 43: What is typically required to maintain SP certification?

Retaking the full certification exam annually
Completing continuing education credits and meeting renewal requirements (Correct answer)
Nothing once initial certification is obtained
Paying fees without any additional requirements

Correct answer: Completing continuing education credits and meeting renewal requirements

Most certifications require ongoing professional development to ensure practitioners stay current in their field.

Question 44: What governor limit concern arises when using recursive Apex methods to traverse deep data hierarchies in Salesforce?

SOQL query limit
CPU time limit
Heap size limit
Stack depth limit (Correct answer)

Correct answer: Stack depth limit

Salesforce enforces a maximum stack depth, and deep recursion can cause a stack overflow runtime exception.

Question 45: What is the time complexity of binary search on a sorted List of n elements?

O(1)
O(n)
O(log n) (Correct answer)
O(n log n)

Correct answer: O(log n)

Binary search halves the search space with each comparison, resulting in O(log n) time complexity.

ServiceNow Certified Implementation Specialist – Service Provider (CIS-SP)

The ServiceNow CIS-SP certification validates expertise in implementing and configuring domain-separated ServiceNow environments for multi-tenant service provider deployments. It covers domain architecture, data and process separation, foundational data management, and cross-application domain support.

Questions

60 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds