CSA Access Control Rules (ACLs) 2 — Questions and Answers
Question 1: Which ACL operation type controls whether a user can see a specific field on a form or list?
- execute
- read (Correct answer)
- write
- create
Correct answer: read
The 'read' operation in an ACL determines whether a user can view a field's value on forms and lists.
Question 2: What happens when multiple ACLs match the same record and operation in ServiceNow?
- All matching ACLs must pass for access to be granted
- The first matching ACL in priority order determines access
- Access is granted if any one matching ACL passes (Correct answer)
- The most restrictive ACL always wins regardless of order
Correct answer: Access is granted if any one matching ACL passes
ServiceNow grants access if any one of the matching ACLs evaluates to true, following an OR logic across multiple matching rules.
Question 3: In an ACL script condition, which variable refers to the current record being evaluated?
- current (Correct answer)
- record
- gr
- target
Correct answer: current
The 'current' variable in ACL scripts refers to the GlideRecord of the record currently being evaluated for access.
Question 4: Which ACL type would you configure to restrict REST API access to a specific ServiceNow table?
- UI Action ACL
- Record ACL with REST operation
- Table ACL (Correct answer)
- Field-level ACL
Correct answer: Table ACL
A Table-level ACL with the appropriate HTTP operation (GET, POST, etc.) controls REST API access to an entire table.
Question 5: What is the effect of setting an ACL's 'Requires role' field to a role that no active user possesses?
- The ACL is ignored and access defaults to granted
- All users are denied access controlled by that ACL (Correct answer)
- Only admin users can bypass the restriction
- The ACL is automatically deactivated
Correct answer: All users are denied access controlled by that ACL
If a required role is set but no user has it, all non-admin users will be denied the access controlled by that ACL.
Question 6: Which ServiceNow feature allows you to test ACL rules without actually changing user permissions?
- Security Policy Analyzer
- Access Control Simulator
- Impersonation (Correct answer)
- Role Inheritance Viewer
Correct answer: Impersonation
Impersonation allows admins to log in as another user to test exactly what that user can and cannot access under current ACL rules.
Question 7: What does the 'Advanced' checkbox on an ACL rule enable?
- Multi-table inheritance for the ACL
- A custom script condition field for complex logic (Correct answer)
- Automatic role hierarchy evaluation
- Field-level encryption support
Correct answer: A custom script condition field for complex logic
Checking 'Advanced' on an ACL reveals the script condition field, allowing administrators to write custom JavaScript logic for access evaluation.
CSA Access Control Rules (ACLs) 2
Which ACL operation type controls whether a user can see a specific field on a form or list?