CSA Access Control Rules (ACLs) 4

Question 1

A field ACL exists for 'incident.caller_id' with the read operation. What does this ACL specifically control?

Accepted Answer

Whether the Caller ID field appears on the Incident form

Answer

Whether the user can update the Caller ID field

Answer

Whether the user can create an incident with a Caller ID

Answer

Whether the Caller ID field is indexed in the database

Question 2

What happens to a field protected by a write ACL that a user fails?

Accepted Answer

The field appears but is read-only for that user

Answer

The field is hidden from the form entirely

Answer

The field displays a permission denied message

Answer

The field is replaced with asterisks

Question 3

Which ACL name format would restrict access to the 'priority' field on the Problem table?

Accepted Answer

problem.priority

Answer

problem

Answer

*.priority

Answer

field.problem.priority

Question 4

What is the function of the 'gsftNavigation.openRecord' check in ACL scripts?

Accepted Answer

It is not a valid function in ACL scripts

Answer

It verifies if the navigation history allows record access

Answer

It checks if the record was opened from a navigation menu

Answer

It grants access if the user is using the Service Portal

Question 5

When troubleshooting ACL issues, what does the Security Debug plugin provide that standard logging does not?

Accepted Answer

Real-time display of which ACLs are being evaluated for each request

Answer

A visual flowchart of ACL evaluation

Answer

Automatic suggestions for fixing ACL misconfigurations

Answer

A comparison view of two users' access levels

Question 6

How does ServiceNow handle ACL evaluation for records returned in a GlideRecord query run in a background script?

Accepted Answer

ACLs are enforced based on the session user running the script

Answer

ACLs are always bypassed in background scripts

Answer

ACLs are evaluated but only for write operations

Answer

Background scripts run as admin and ignore all ACLs

Question 7

What is the recommended practice when an ACL needs to grant access based on the logged-in user's department matching the record's department?

Accepted Answer

Use an ACL script condition comparing gs.getUser().getDepartmentID() to current.department

Answer

Create separate ACLs for each possible department value

Answer

Use an ACL condition filter with a dynamic filter expression

Answer

Use a reference qualifier on the department field instead of an ACL