ServiceNow CAD free question 3 / 10 · Domain 3: Security and Restricting Access
A read ACL in an incident application uses a required role, a condition on the assignment group, and a script that dot-walks to the department. A developer tuning performance wants to know the order in which these parts are evaluated within that single ACL. Which order is correct?
- The required role is evaluated first, then the condition, and then the script
- The condition is evaluated first, then the required role, and then the script
- The script is evaluated first, then the condition, and then the required role
- Table-level ACLs come before field-level ACLs; one ACL has no internal order
Show the answer and explanation
Answer: A
Why this is correct
The permission evaluation page lists the hierarchy evaluated within an ACL as Role, Security Attribute, Condition, and Script. This ACL uses no security attribute, so its role is checked first, then its condition, and the script last.
Why the other options are wrong
"The condition is evaluated first, then the required role, and then the script" … The condition does not come before the role. In the documented hierarchy the role is the first item evaluated within an ACL and the condition comes after it.
"The script is evaluated first, then the condition, and then the required role" … This reverses the documented hierarchy. The script is the last item evaluated within an ACL, after the role, the security attribute, and the condition.
"Table-level ACLs come before field-level ACLs; one ACL has no internal order" … Table-level and field-level ACLs are separate checks, but the documentation also gives an order within one ACL: role, security attribute, condition, script. Saying a single ACL has no order is wrong.
Why the order matters
Before a query runs, the instance checks only the user's roles against the field ACLs, because the records are not available yet; conditions and scripts that rely on record contents are evaluated in the post-query check. All parts of a matching ACL must evaluate to true for it to grant access.
Go to the ServiceNow CAD practice app (10 free questions; purchase unlocks all questions)