CSA Access Control Rules (ACLs) 5

Question 1

Which ServiceNow module allows administrators to view all ACL rules configured in the instance?

Accepted Answer

System Security > Access Control List

Answer

System Policy > Security Rules

Answer

User Administration > ACL Manager

Answer

System Properties > Security Controls

Question 2

A user with the 'admin' role is denied access by an ACL. What is the most likely reason?

Accepted Answer

ACL denials for admins occur only in scoped applications

Answer

Admin roles never bypass ACLs in ServiceNow

Answer

The instance has security_admin elevation required for that resource

Answer

The ACL has explicitly denied the admin role in its script

Question 3

What is the purpose of the '*' (wildcard) table name in an ACL rule?

Accepted Answer

It creates a global fallback ACL that applies when no specific table ACL matches

Answer

It applies the ACL to all tables in a specific application scope

Answer

It copies the ACL rule to all tables automatically

Answer

It marks the ACL as a template for creating other rules

Question 4

What does the 'Active' checkbox on an ACL rule control?

Accepted Answer

Whether the ACL is included in access evaluation for the specified table and operation

Answer

Whether the ACL is visible to other administrators

Answer

Whether the ACL generates audit log entries

Answer

Whether the ACL rule can be modified without the security_admin role

Question 5

How should an administrator grant a specific user access to a table record without modifying roles or creating broad ACL rules?

Accepted Answer

Create a user-specific ACL with the user's sys_id in the script condition

Answer

Use the 'Explicit Roles' feature on the record

Answer

Add the user to a group that has access

Answer

Use the Record Permissions plugin's per-record access feature

Question 6

Which of the following best describes the difference between an ACL 'condition' and an ACL 'script' in ServiceNow?

Accepted Answer

Conditions use filter syntax and evaluate field values; scripts use JavaScript for complex logic

Answer

Conditions apply to table ACLs; scripts apply to field ACLs only

Answer

Conditions are evaluated first and block script execution if they fail

Answer

There is no functional difference; they are alternative syntaxes for the same purpose

Question 7

What is the effect of enabling the 'Elevated privilege' option on an ACL rule?

Accepted Answer

The ACL grants access only to users who have explicitly elevated to the security_admin role

Answer

The ACL bypasses all script conditions and grants immediate access

Answer

The ACL applies only during scheduled maintenance windows

Answer

The ACL is evaluated before all other ACLs regardless of specificity