ServiceNow CSA free question 9 / 10 · Domain 5: Database Management and Platform Security
An ACL has a required role, a data condition, and a script. What must a user do to gain access?
- Pass at least one of the conditions in the ACL
- Pass all of the conditions listed in the ACL
- Have the role; the other checks are then skipped
- Pass the script, which overrides the other checks
Show the answer and explanation
Answer: B
Why this is correct
The documentation says that to gain access to an object and operation, a user must pass all conditions listed in an access control. If an ACL specifies more than one condition, the user must meet all of them, and failing any one condition check prevents access.
Why the other options are wrong
"Pass at least one of the conditions in the ACL" … Within one ACL every listed condition must pass. Meeting just one of them is not enough.
"Have the role; the other checks are then skipped" … Holding the role satisfies only the role condition. The data condition and the script must still pass.
"Pass the script, which overrides the other checks" … The script is one of the conditions, not an override. All conditions are evaluated.
Key point
Inside one ACL the conditions combine with AND. For record ACLs, the matching table-level and field-level ACLs must both evaluate to true, while ACLs that match at the same point in the processing order need only one to pass.
Go to the ServiceNow CSA practice app (10 free questions; purchase unlocks all questions)