CSA - ServiceNow System Administrator Access Control Rules (ACLs) Questions and Answers

Question 1

A user has the 'itil' role. There are two 'write' ACLs for the Incident table:
1. An ACL for `incident.short_description` that requires the 'incident_manager' role.
2. An ACL for `incident.*` that requires the 'itil' role.

Which statement correctly describes the user's ability to write to the 'short_description' field?

Accepted Answer

The user cannot write to the field because the more specific `incident.short_description` ACL restricts access.

Answer

The user can write to the field because the `incident.*` ACL grants them access.

Answer

The user can write to the field because 'itil' is a more fundamental role than 'incident_manager'.

Answer

The system will merge the permissions, allowing the user to write to the field.

Question 2

An administrator needs to prevent a specific role from editing incidents that are in a 'Closed' state. The ACL should only be evaluated for existing records. Which ACL configuration would achieve this?

Accepted Answer

Operation: `write`, Condition: State is not Closed

Answer

Operation: `create`, Condition: State is not Closed

Answer

Operation: `read`, Script: `current.state != 'closed';`

Answer

Operation: `delete`, Condition: Active is false

Question 3

What is the primary function of an Access Control List (ACL) in the ServiceNow platform?

Accepted Answer

To secure records and fields against unauthorized create, read, write, and delete operations.

Answer

To define business logic for task assignments and approvals.

Answer

To configure the layout and design of forms and lists for different users.

Answer

To create and manage automated workflows for service catalog requests.

Question 4

Which of the following BEST describes the purpose of a wildcard ACL rule, such as `cmdb_ci.*`?

Accepted Answer

It provides a baseline security rule for all fields on a table that do not have their own specific field-level ACLs.

Answer

It applies to all fields on the table, overriding any more specific field-level ACLs.

Answer

It secures access only to custom fields on the table, ignoring out-of-the-box fields.

Answer

It grants access to all tables that extend the `cmdb_ci` table.

Question 5

An administrator is writing an ACL script to check if a user belongs to the 'cab_delegates' group. Which GlideSystem (gs) method should be used in the script to determine the current user's group membership?

Accepted Answer

gs.getUser().isMemberOf('cab_delegates')

Answer

gs.hasRole('cab_delegates')

Answer

current.user.isMemberOf('cab_delegates')

Answer

gs.userInGroup('cab_delegates')

Question 6

For a user to have read access to a specific field on a record, what combination of ACLs must be passed?

Accepted Answer

The user must pass both a table-level 'read' ACL AND a field-level 'read' ACL.

Answer

The user must pass a table-level 'read' ACL OR a field-level 'read' ACL.

Answer

The user must only pass a field-level 'read' ACL for that specific field.

Answer

The user must only pass a table-level 'read' ACL for that record's table.