CSA Access Control Rules (ACLs) 3 — Questions and Answers
Question 1: Which of the following ACL operations would you use to prevent users from deleting records in the Incident table?
- write
- delete (Correct answer)
- execute
- create
Correct answer: delete
The 'delete' operation ACL controls whether users can remove records from a table.
Question 2: How does ACL inheritance work when a child table extends a parent table in ServiceNow?
- Child tables inherit all ACLs from the parent table automatically (Correct answer)
- ACLs must be explicitly copied to child tables
- Child tables only inherit read ACLs from parent tables
- Inheritance is disabled by default and must be enabled per ACL
Correct answer: Child tables inherit all ACLs from the parent table automatically
In ServiceNow, ACLs defined on a parent table are automatically inherited by all child (extended) tables unless overridden.
Question 3: What is the correct order of ACL evaluation specificity from most specific to least specific?
- Field → Table → * (global) (Correct answer)
- Table → Field → * (global)
- * (global) → Table → Field
- Field → * (global) → Table
Correct answer: Field → Table → * (global)
ServiceNow evaluates ACLs from most specific (field-level) to least specific (table-level to global wildcard), applying the most specific matching rule.
Question 4: An ACL has a role condition set to 'itil' and a script that checks if the record's state equals 1. When does access get granted?
- When the user has the itil role OR the script returns true
- When the user has the itil role AND the script returns true (Correct answer)
- When the user has the itil role only; the script is secondary
- When the script returns true only; the role is optional
Correct answer: When the user has the itil role AND the script returns true
All conditions in an ACL (roles, conditions, and scripts) must pass simultaneously — they are evaluated with AND logic, not OR.
Question 5: Which system property controls whether ServiceNow logs ACL denials for debugging purposes?
- glide.security.log.denials (Correct answer)
- com.glide.acl.debug
- glide.acl.track_failures
- security.access.debug_mode
Correct answer: glide.security.log.denials
The system property 'glide.security.log.denials' enables logging of ACL denial events, which appear in the system log for troubleshooting.
Question 6: What is the purpose of the 'contains' condition type in an ACL's condition builder?
- Checks if a reference field contains a specific value anywhere in its hierarchy
- Verifies that a list field includes a particular choice value (Correct answer)
- Tests if a string field has a substring match
- Validates that a field value exists in a specified table
Correct answer: Verifies that a list field includes a particular choice value
The 'contains' condition in ACL builders is used to check whether a list-type field (like a role list or category list) includes a specific value.
Question 7: Which role is required by default to create or modify ACL rules in a production ServiceNow instance?
- itil
- security_admin (Correct answer)
- admin
- acl_manager
Correct answer: security_admin
The 'security_admin' role is required to create or modify ACL rules, and must be explicitly elevated even for users with the admin role.
CSA Access Control Rules (ACLs) 3
Which of the following ACL operations would you use to prevent users from deleting records in the Incident table?