CSA - ServiceNow System Administrator Access Control Rules (ACLs) Questions and Answers 1 — Questions and Answers
Question 1: A user has the 'itil' role. There are two 'write' ACLs for the Incident table: 1. An ACL for `incident.short_description` that requires the 'incident_manager' role. 2. An ACL for `incident.*` that requires the 'itil' role. Which statement correctly describes the user's ability to write to the 'short_description' field?
- The user can write to the field because the `incident.*` ACL grants them access.
- The user cannot write to the field because the more specific `incident.short_description` ACL restricts access. (Correct answer)
- The user can write to the field because 'itil' is a more fundamental role than 'incident_manager'.
- The system will merge the permissions, allowing the user to write to the field.
Correct answer: The user cannot write to the field because the more specific `incident.short_description` ACL restricts access.
ServiceNow evaluates ACLs from the most specific to the most general. The rule for `incident.short_description` is more specific than the wildcard `incident.*` rule. Since the user lacks the 'incident_manager' role, the specific rule denies access, and the broader rule is not evaluated for this particular field.
Question 2: An administrator needs to prevent a specific role from editing incidents that are in a 'Closed' state. The ACL should only be evaluated for existing records. Which ACL configuration would achieve this?
- Operation: `create`, Condition: State is not Closed
- Operation: `read`, Script: `current.state != 'closed';`
- Operation: `write`, Condition: State is not Closed (Correct answer)
- Operation: `delete`, Condition: Active is false
Correct answer: Operation: `write`, Condition: State is not Closed
A 'write' operation ACL controls the ability to update existing records. By setting a condition 'State is not Closed', the rule will only grant write access to records that are not in the 'Closed' state, effectively making them read-only when closed.
Question 3: What is the primary function of an Access Control List (ACL) in the ServiceNow platform?
- To define business logic for task assignments and approvals.
- To configure the layout and design of forms and lists for different users.
- To create and manage automated workflows for service catalog requests.
- To secure records and fields against unauthorized create, read, write, and delete operations. (Correct answer)
Correct answer: To secure records and fields against unauthorized create, read, write, and delete operations.
The core purpose of ACLs is to act as security rules that restrict access to data. They define what data users can Create, Read, Write, and Delete (CRUD) in ServiceNow tables and fields, ensuring data confidentiality and integrity.
Question 4: Which of the following BEST describes the purpose of a wildcard ACL rule, such as `cmdb_ci.*`?
- It applies to all fields on the table, overriding any more specific field-level ACLs.
- It secures access only to custom fields on the table, ignoring out-of-the-box fields.
- It provides a baseline security rule for all fields on a table that do not have their own specific field-level ACLs. (Correct answer)
- It grants access to all tables that extend the `cmdb_ci` table.
Correct answer: It provides a baseline security rule for all fields on a table that do not have their own specific field-level ACLs.
A wildcard ACL (`table.*`) serves as a default security rule for all fields on that table. However, if a more specific ACL exists for a particular field (e.g., `cmdb_ci.name`), the specific ACL takes precedence for that field, and the wildcard ACL is not evaluated for that operation.
Question 5: An administrator is writing an ACL script to check if a user belongs to the 'cab_delegates' group. Which GlideSystem (gs) method should be used in the script to determine the current user's group membership?
- gs.hasRole('cab_delegates')
- gs.getUser().isMemberOf('cab_delegates') (Correct answer)
- current.user.isMemberOf('cab_delegates')
- gs.userInGroup('cab_delegates')
Correct answer: gs.getUser().isMemberOf('cab_delegates')
The `gs.getUser()` method returns the user object of the currently logged-in user. This user object has the `isMemberOf()` method, which can be used to check for membership in a specific group. `gs.hasRole()` checks for roles, not groups.
Question 6: For a user to have read access to a specific field on a record, what combination of ACLs must be passed?
- The user must pass a table-level 'read' ACL OR a field-level 'read' ACL.
- The user must only pass a field-level 'read' ACL for that specific field.
- The user must pass both a table-level 'read' ACL AND a field-level 'read' ACL. (Correct answer)
- The user must only pass a table-level 'read' ACL for that record's table.
Correct answer: The user must pass both a table-level 'read' ACL AND a field-level 'read' ACL.
ServiceNow's security model requires users to pass access checks at both the record/table level and the field level. A user must have permission to read the record (from a table-level ACL like `incident`) and also have permission to read the specific field (from a field-level ACL like `incident.short_description` or `incident.*`).
CSA - ServiceNow System Administrator Access Control Rules (ACLs) Questions and Answers 1
A user has the 'itil' role.
There are two 'write' ACLs for the Incident table:
1.
An ACL for `incident.short_description` that requires the 'incident_manager' role.
2.
An ACL for `incident.*` that requires the 'itil' role.
Which statement correctly describes the user's ability to write to the 'short_description' field?