ServiceNow CSA · Domain 5 of 6

ServiceNow CSA Domain 5: Database Management and Platform Security

The heaviest domain on the exam, covering the data model and how it is protected. Expect table extension and the dictionary, access control rules and roles, importing data with transform maps, the CMDB and CSDM, and platform security responsibilities.

Exam weight
30%
Official objectives
6
Estimated questions estimate
~18
Suggested study time estimate
20–30 hrs

About 18 min read Reviewed October 2026

Overview

Database Management and Platform Security covers how data is structured, loaded, related and protected. The data schema half explains tables, fields and the dictionary, how child tables extend base tables such as Task and Configuration Item, and how reference fields create relationships you can dot-walk. Importing data covers data sources, import set staging tables, transform maps and coalesce. The CMDB and CSDM objective covers configuration item classes, relationships, how the CMDB is populated and kept free of duplicates, and the Common Service Data Model that organises services.

The security half covers application and access control: users, groups and roles, access control rules (ACLs) at table and field level, and how they are evaluated. Security Center gives administrators a view of the instance's security posture, and the Shared Responsibility Model divides security duties between ServiceNow and the customer. The domain underpins every other domain, because every list, form, catalog item and flow reads and writes these tables under these rules.

How it's tested

Expect outcome-to-cause scenarios: an import produced duplicates, a user can open a record but not edit one field, a field added to a parent table appears on child forms. Also expect classification items, such as which CSDM service type fits a description or which party owns a security duty. Read the stem for the exact operation, table and field involved before judging the options.

  • Explain the access result

    A user's roles and the ACLs in place are described, and you predict or explain whether they can read, write, create or delete a record or field.

  • Fix the import

    An import or transform behaves wrongly (duplicates, skipped rows, wrong references) and you choose the transform map or coalesce change that fixes it.

  • Classify the model

    A table relationship, CI class, CSDM service type or security duty is described and you choose the correct category.

Reasoning it through

A user with the itil role can open incidents but cannot edit the Short description field, while colleagues can. The table-level write ACL on incident passes, so the record opens. A field-level ACL on incident.short_description requiring a role the user lacks blocks the write. Since both table and field ACLs must pass, the answer is the field-level ACL, not the table rule or a UI policy.

Objectives 6

Official objectives from the ServiceNow outline, in outline order.

5.1 Data SchemaTables, fields, the dictionary and table extension.
What it means
Every record lives in a table defined in the system dictionary, which also defines each field's type, length, default and attributes. Tables can extend a parent table and inherit its fields, as Incident, Problem and Change extend Task and server classes extend Configuration Item.
What to understand
Reference fields store the sys_id of a record in another table, which creates one-to-many relationships and allows dot-walking to related fields; many-to-many relationships use a separate relationship table. A dictionary override lets a child table change an inherited field's default, mandatory setting or reference qualifier without affecting the parent. Custom tables in the global scope get a u_ prefix, and the Schema map shows extensions and references visually.
How it shows up
A question asks why a new field on Task appears on incident and change forms, or how to make an inherited field mandatory only on Incident.
Common confusion
Changing the parent table's field to meet a child-only need, when a dictionary override is the targeted tool.
5.2 Application/Access ControlUsers, groups, roles and access control rules.
What it means
Access is granted through roles, ideally assigned to groups so users inherit them through membership. Access control rules (ACLs) protect operations such as read, write, create and delete on tables and fields, and each rule can require roles, a condition and a script.
What to understand
To access a field a user must pass both the table-level and the field-level rules. Rules are matched from most specific to most general (incident before task before the wildcard), and for an allow rule to pass, its role, condition and script requirements must all be met. Editing ACLs needs the elevated security_admin role, and Deny-Unless rules, where used, are checked before Allow-If rules.
How it shows up
A user can see a record but not a field, or can read but not write, and you identify which rule level is responsible.
Common confusion
Assigning roles directly to users instead of groups, or using UI policies as a security control when only ACLs enforce access on the server.
5.3 Importing DataData sources, import sets, transform maps and coalesce.
What it means
Imports load data from a data source (such as a file, JDBC connection or REST endpoint) into an import set staging table, then a transform map copies and converts the staged rows into a target table using field maps and optional transform scripts.
What to understand
Coalesce marks one or more field maps as the match key: if an existing target record matches, it is updated; if not, a new record is inserted; with several coalesce fields, all must match. Without any coalesce field every row inserts a new record. Import set rows record their outcome (inserted, updated, ignored, skipped or error) for troubleshooting.
How it shows up
A recurring import keeps creating duplicate records, and you choose to set coalesce on a unique identifier field.
Common confusion
Thinking the import set table is the final destination, or that coalesce on several fields matches if any one field matches.
5.4 CMDB and CSDMConfiguration items, relationships and the Common Service Data Model.
What it means
The Configuration Management Database stores configuration items (CIs) in classes that extend the base Configuration Item table, and relationships between them such as Runs on or Depends on. The Common Service Data Model (CSDM) is ServiceNow's standard for how services, applications and offerings are represented in the CMDB.
What to understand
CIs are populated by Discovery, Service Graph Connectors and imports, and the Identification and Reconciliation Engine (IRE) matches incoming data to existing CIs to prevent duplicates. In CSDM, a business application describes software as the organisation owns it, an application service is a deployed instance of it, a technical service is offered by IT to other teams, and a business service is consumed by the business. Adoption is phased in stages from Foundation through Crawl, Walk, Run and Fly.
How it shows up
A description of a service is given (an email platform consumed by all employees, or the production stack of an HR app) and you classify it in CSDM.
Common confusion
Confusing a business application, which is a portfolio record, with an application service, which is a running deployment made of CIs.
5.5 Security CenterMonitoring and improving the instance's security posture.
What it means
Security Center is a platform application that gives administrators one place to view the instance's security posture, including how its security settings compare with recommended hardening configurations and security metrics over time.
What to understand
It highlights settings that do not meet recommended values, tracks changes to them, and surfaces metrics such as administrative access and authentication activity so drift is noticed. Remediating the findings is the customer's job, which ties it to the Shared Responsibility Model.
How it shows up
An administrator needs to check whether the instance's security settings meet recommended hardening values, and you choose Security Center.
Common confusion
Treating Security Center as an ACL editor or as a feature that automatically fixes every finding.
5.6 Shared Responsibility ModelWhat ServiceNow secures and what the customer secures.
What it means
The Shared Responsibility Model divides security duties: ServiceNow secures the cloud infrastructure, data centers, network and platform software it operates, while the customer secures how the instance is configured and used.
What to understand
Customer duties include managing users, groups and roles, authentication settings such as single sign-on and multifactor authentication, access control rules, data classification, hardening settings and applying upgrades and patches in a timely way. ServiceNow's duties include physical security, infrastructure, hosting operations and making secure platform releases available.
How it shows up
A list of security tasks is given and you identify which belongs to the customer, such as reviewing admin role assignments.
Common confusion
Assuming that because ServiceNow hosts the instance it also manages customer users, roles and ACLs.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Table extension

    A child table inherits all fields of its parent and adds its own, as Incident extends Task.

    Remember
    Records in a child table also appear when querying the parent table, identified by their class.
    Tested as
    Explains shared fields, shared ACL inheritance and parent-level reporting.
    Trap
    Adding the same field to each child instead of the parent.

  • Dictionary override

    Lets a child table change an inherited field's properties, such as default value, mandatory setting or reference qualifier.

    Remember
    The parent and other children keep the original behaviour.
    Tested as
    The answer for a child-only change to an inherited field.
    Trap
    Editing the field on the parent, which changes every child.

  • Reference field and dot-walking

    A reference stores the sys_id of a related record, and dot-walking follows it to reach that record's fields.

    Remember
    Caller.Department reaches the department of the caller without copying data.
    Tested as
    Used in form layouts, filters, reports and scripts.
    Trap
    Creating duplicate fields instead of dot-walking.

  • ACL requirements

    An allow rule grants access only when its required roles, condition and script all pass.

    Remember
    Table-level and field-level rules must both be passed to access a field.
    Tested as
    Central to every access outcome question.
    Trap
    Thinking a matching role alone is enough when a condition also applies.

  • ACL matching order

    Rules are matched from the most specific object to the most general: the table, then its parent tables, then the wildcard.

    Remember
    For fields the order runs from table.field through parent.field to *.field, then table.* rules.
    Tested as
    Explains why a specific rule on incident takes effect before a rule on task.
    Trap
    Assuming rules on the parent override more specific child rules.

  • security_admin

    An elevated role required to create or change ACLs and other security settings.

    Remember
    It must be elevated in the session before use.
    Tested as
    Explains why an admin cannot save an ACL.
    Trap
    Thinking the admin role alone can edit ACLs.

  • Roles through groups

    Assigning roles to groups lets users inherit them by membership.

    Remember
    Removing a user from the group removes the inherited roles.
    Tested as
    The recommended practice in user administration questions.
    Trap
    Granting roles to individuals, which is hard to audit and maintain.

  • Import set and transform map

    The import set table stages raw data, and the transform map defines how staged fields map to the target table.

    Remember
    The order is load data, create or reuse the transform map, run the transform.
    Tested as
    Most import questions follow this pipeline.
    Trap
    Treating the staging table as the final destination.

  • Coalesce

    Marks field maps used to match incoming rows to existing target records.

    Remember
    Match means update, no match means insert, no coalesce means always insert; multiple coalesce fields must all match.
    Tested as
    The fix for duplicates created by repeated imports.
    Trap
    Choosing a non-unique field such as name as the coalesce key.

  • Configuration item class

    A CMDB table, such as Server or Application, that extends the base Configuration Item table.

    Remember
    Classes inherit fields and can be managed in CI Class Manager.
    Tested as
    Appears when choosing where a type of CI belongs.
    Trap
    Storing different CI types in one generic class.

  • Identification and Reconciliation Engine

    Matches incoming CI data to existing CIs and decides which data source may update which attributes.

    Remember
    It prevents duplicate CIs when several sources populate the CMDB.
    Tested as
    The answer to duplicate CIs from multiple sources.
    Trap
    Using import coalesce alone for CMDB data from many sources.

  • CSDM service types

    Business service (consumed by the business), technical service (offered by IT to IT), application service (a deployed instance of an application) and business application (the software as a portfolio item).

    Remember
    Application services are made of running CIs; business applications are not deployed infrastructure.
    Tested as
    Classification items use these exact names.
    Trap
    Calling the production HR app stack a business application.

  • Security Center

    An application that shows the instance's security posture against recommended hardening settings and tracks security metrics.

    Remember
    It identifies issues; the customer decides and applies the remediation.
    Tested as
    The answer for reviewing security configuration compliance.
    Trap
    Expecting it to edit ACLs or fix findings automatically.

  • Shared Responsibility Model

    ServiceNow secures infrastructure and the platform it operates; customers secure their configuration, users, access and data handling.

    Remember
    User, role, authentication and ACL management are always customer duties.
    Tested as
    Classification of security tasks by owner.
    Trap
    Assigning customer configuration duties to ServiceNow because it hosts the instance.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Business application vs. application service vs. technical service vs. business service

ConceptMeaningKey differenceCommon trap
Business application The software as the organisation owns and manages it Portfolio record, not running infrastructure Using it to represent a specific production deployment
Application service A deployed, running instance of an application Made of CIs such as servers and databases Confusing it with the business application
Technical service A service IT provides to other IT teams, such as hosting or database services Consumed inside IT Using it for services employees request directly
Business service A service consumed by the business, such as email for employees Consumed by business users or customers Mapping internal IT platforms here

Coalesce outcomes in a transform

ConceptMeaningKey differenceCommon trap
Coalesce field matches a record An existing target record has the same key value The record is updated Expecting a new record
Coalesce field has no match No target record has that key A new record is inserted Expecting the row to be skipped
No coalesce fields No match key is defined Every row inserts, causing duplicates on re-import Blaming the data source for duplicates

ACL vs. UI policy vs. dictionary setting

ConceptMeaningKey differenceCommon trap
ACL Server-side rule on operations for tables and fields Enforces security across all interfaces and APIs Replacing it with a form-level control
UI policy Client-side form behaviour Changes the form only; not a security control Treating read-only on a form as protected data
Dictionary mandatory or read-only Field property set in the dictionary Applies to the field wherever the form shows it, but is not role-based security Using it to restrict access for some roles

ServiceNow vs. customer responsibilities

ConceptMeaningKey differenceCommon trap
ServiceNow Data centers, infrastructure, hosting operations, secure platform releases Secures the cloud the instance runs on Expecting it to manage customer users or ACLs
Customer Users, roles, authentication, ACLs, data classification, hardening, timely upgrades Secures how the instance is configured and used Assuming hosting covers configuration security

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. UI policy as security

    What candidates pick
    Make a field read-only with a UI policy to stop non-managers changing it.
    Why it looks right
    The field becomes uneditable on the form.
    Why it's wrong
    UI policies run in the browser and do not protect data through lists, imports or APIs; an ACL enforces the restriction on the server.

    Clue to watch for The requirement uses words like 'secure', 'prevent' or 'only users with role X'.

  2. Table ACL is enough

    What candidates pick
    A user who passes the table-level write ACL can write every field.
    Why it looks right
    The record is editable, so its fields seem editable too.
    Why it's wrong
    Field-level ACLs are evaluated separately, and failing one blocks that field even when the table rule passes.

    Clue to watch for The user can edit the record except for one field.

  3. Any coalesce field matches

    What candidates pick
    With coalesce on email and employee number, a row matching only email updates the record.
    Why it looks right
    Matching on either key seems helpful.
    Why it's wrong
    When several fields are set to coalesce, all of them must match for an update; otherwise a new record is inserted.

    Clue to watch for More than one field map is marked coalesce.

  4. Edit the parent field

    What candidates pick
    Make the Task field mandatory so Incident requires it.
    Why it looks right
    It achieves the Incident requirement in one step.
    Why it's wrong
    Every table extending Task would now require it; a dictionary override on Incident limits the change.

    Clue to watch for Only one child table needs different behaviour.

  5. ServiceNow manages access

    What candidates pick
    ServiceNow is responsible for reviewing who holds the admin role.
    Why it looks right
    ServiceNow hosts and operates the instance.
    Why it's wrong
    Under the Shared Responsibility Model, user and role management is the customer's responsibility.

    Clue to watch for The task concerns users, roles, ACLs or authentication settings.

  6. Business application for a deployment

    What candidates pick
    Record the production servers of the payroll app as a business application.
    Why it looks right
    Payroll is a business application in everyday language.
    Why it's wrong
    In CSDM, the deployed stack is an application service; the business application is the portfolio record of the software.

    Clue to watch for The description mentions environments, servers or a running instance.

  7. Admin edits ACLs

    What candidates pick
    The admin cannot save an ACL, so grant a further admin role.
    Why it looks right
    More privilege seems to be the fix.
    Why it's wrong
    ACL changes need the security_admin role, which the admin must elevate to in the session.

    Clue to watch for An admin is blocked while editing security rules.

Answer framework

Use these steps to reason through data, import and security questions in this domain.

  1. Identify the table, its parent tables and the exact field involved, since inheritance and overrides depend on where a field is defined.
  2. For access outcomes, check the operation, then the table-level rule, then the field-level rule, and confirm roles, condition and script all pass.
  3. For imports, trace data source, import set, transform map and target, then check which fields coalesce and whether all of them match.
  4. For CMDB questions, decide whether the item is a CI class, a relationship or a CSDM service type, and remember the IRE prevents duplicates across sources.
  5. For security duties, ask who operates the thing: infrastructure belongs to ServiceNow, while configuration, users and access belong to the customer, monitored through Security Center.

Practice question

Each week an administrator imports a spreadsheet of employees into the User table. The transform map maps Employee ID to the user's Employee number field, but every import creates new user records instead of updating existing ones. What change will fix this?

Want more like this? The ServiceNow CSA practice test has questions for every domain.

Checklist

0 of 15

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the largest share of your time, and study it in the outline's order, because each objective builds on the one before. Start with the data schema: open the Schema map for Incident, follow its extension to Task, add a field to Task, and use a dictionary override on Incident. Dot-walk from Caller to Department in a list.

Next, practise access control in a Personal Developer Instance. Elevate to security_admin, create a table-level and a field-level ACL on a test table, and impersonate users with different roles to see each outcome. Then import a small spreadsheet twice, first without coalesce and then with it, and read the import set row states.

Candidates underestimate CSDM and the two security objectives because they are less hands-on. Make a one-page table of CSDM service types with an example of each, open Security Center to see its findings, and list five customer and five ServiceNow responsibilities.

Afterwards, move to Data Migration and Integration, which builds on these tables with business rules and update sets, then take a timed practice set weighted toward this domain.

FAQ

Why is this the most important domain?

It carries 30% of the exam, the largest weight, and its concepts (tables, ACLs, imports) are assumed in questions from other domains as well.

What is the most commonly misunderstood ACL rule?

That a user needs to pass both the table-level and the field-level rule to access a field, and that each rule's roles, condition and script must all pass. Many candidates stop at the table rule.

What does coalesce do in a transform map?

It defines the match key. A matching target record is updated, an unmatched row creates a new record, and when several fields coalesce all must match.

How deep does CSDM go on the CSA?

Expect to recognise the main service types and the purpose of CSDM, and to classify a described service. Detailed CSDM implementation planning belongs to more advanced certifications.

Is Security Center new to the exam?

It appears in the current CSA objectives alongside the Shared Responsibility Model. Know what it shows and that the customer acts on its findings.

How many questions come from this domain?

At 30% of a 60-question exam, plan for about eighteen. ServiceNow does not publish per-domain counts, so treat this as an estimate.

Should I study the CMDB in depth if I do not work with it?

Learn the essentials well: CI classes, relationships, population methods, the IRE and CSDM service types. These are tested even for administrators who rarely touch configuration management.

Other CRM & Business Applications certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered table extension, ACL evaluation, coalesce, the CMDB and CSDM, and platform security duties. Test whether you can predict access and import outcomes under exam timing.

Take the ServiceNow CSA practice test Check your ServiceNow CSA readiness

Keep going