SNOW-CSA Application Rules, ACL and Notifications — 15 Questions

Question 1

A company has a custom table 'u_employee_data' with a before query business rule that sets 'u_department' to 'Engineering' when the current user is in the 'ITIL' role. After the business rule is activated, users in the 'ITIL' role report that when they query the table, they see only records with department 'Engineering'. However, the business rule is intended to set the default department for new records only. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The business rule is running on 'before query' instead of 'before insert'.. The business rule is configured to run on the 'before query' operation, which means it executes every time a query is made against the 'u_employee_data' table. This causes the condition to set the 'u_department' field to 'Engineering' for all records returned by the query, effectively filtering the result set to only those with that department. The intended behavior is to set the default department only when a new record is created, which requires the business rule to run on the 'before insert' operation instead.

Answer

The business rule should be set to 'async' to avoid affecting queries.

Answer

The business rule is set to run on the client side instead of server side.

Answer

The condition script uses 'gs.getUser().hasRole("ITIL")' incorrectly.

Question 2

An administrator creates a new ACL for the 'incident' table with type 'record', operation 'read', condition script 'current.assignment_group == gs.getUser().getMyGroups()', and requires role 'snc_internal'. A user with role 'snc_internal' who is a member of group 'Service Desk' can view incidents assigned to 'Service Desk' but cannot view incidents assigned to 'Network Support'. What is the most likely reason?

Accepted Answer

Another ACL with higher order denies read access to all incidents not matching the condition.. ACLs in ServiceNow are evaluated in order of their 'order' field, and the first matching ACL (either allowing or denying access) determines the outcome. If another ACL with a higher order (lower numeric value) denies read access to incidents not matching the condition, that deny rule will take precedence over the new ACL, preventing the user from viewing incidents assigned to 'Network Support' even though the new ACL would allow it. The user's role and group membership are satisfied, so the issue lies in ACL ordering and a conflicting deny rule.

Answer

The condition script uses 'current.assignment_group' which returns a sys_id, but 'gs.getUser().getMyGroups()' returns a list of group names.

Answer

The condition script should use 'current.assignment_group.isOneOf(gs.getUser().getMyGroups())' instead.

Answer

The user does not have the 'snc_internal' role.

Question 3

An administrator wants to send an email notification when a change request state changes to 'scheduled'. The notification should be sent to the change manager. Which two fields must be configured in the notification record?

Accepted Answer

"Who will receive" tab: add 'Change manager' role to 'Recipients'. Option C is correct because the 'Who will receive' tab is where the notification's target audience is defined, and adding the 'Change manager' role to the 'Recipients' list ensures the change manager receives the email. Option D is correct because the 'When to send' tab holds the trigger condition, and setting it to 'State changes to scheduled' fires the notification exactly when the change request transitions to the scheduled state. Option A is incorrect because registering an event is not a required field for this notification; the trigger is driven by the condition on the 'When to send' tab, not by a manually registered event. Option B is incorrect because selecting an email template, while useful for formatting the message body, is not one of the two mandatory fields needed to determine recipient and trigger for this scenario.

Answer

"Advanced" tab: register an event to trigger the notification

Answer

"Email template" tab: select an existing template

Question 4

A junior administrator configures the above business rule and ACL. When a user without any role opens an incident with category 'database' and state 1, the priority is set to 1 correctly. However, the user cannot view the incident record. What is the most likely reason?

Accepted Answer

The ACL requires a role (empty role list means no role requirement? Actually requires role checked, but no roles listed means any authenticated user, but unauthenticated? The user has no role, and condition fails because assignment group mismatch.. The correct option is C: the ACL requires a role and its condition fails because the assignment group does not match for this user's incident, so the record is not readable. In ServiceNow, an ACL with the 'requires role' check enabled but no roles listed still evaluates the condition, and if the condition (e.g., assignment group) is not satisfied, access is denied even for authenticated users. The user has no role, so no role-based bypass applies, and the category/state values only affected the business rule priority, not read access. Option A is wrong because ACL conditions on reference fields can use sys_id and do not inherently fail due to display values. Option B is wrong because ACL read checks are independent of business rule timing and occur when the record is queried. Option D is wrong because business rule order affects priority calculation, not record visibility.

Answer

The ACL condition uses sys_id of assignment group, but the field stores display value.

Answer

The business rule runs before insert, but the ACL check occurs after insert.

Answer

The business rule order (100) is too low and another rule overrides the priority.

Question 5

Which THREE statements about Access Control Lists (ACLs) are true? (Choose THREE.)

Accepted Answer

ACLs can be defined for tables, records, fields, and scripts.. Option A is correct because ACLs in ServiceNow can be defined at multiple levels — table, record (row), field (column), and script (client-callable scripts) — allowing granular control over each resource type. Option B is correct because ACLs support condition scripts (the Script field) that run server-side to dynamically grant or deny access based on custom logic, in addition to the condition builder. Option C is correct because when 'Requires role' is selected but no roles are added to the list, the ACL effectively restricts access to users holding the admin role, since admins bypass ACL role checks. Option D is not correct because an ACL can contain multiple roles in its role list, and access is granted if the user has any one of them. Option E is not correct because a script is optional; an ACL can rely solely on roles, conditions, or the default deny behavior without any script.

Answer

An ACL can only have one role specified.

Answer

An ACL must have a script to evaluate conditions.

Question 6

A company wants to block all update operations on the 'problem' table for users with only the 'itil' role, except for the user who created the record. Which ACL configuration should be used?

Accepted Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by != gs.getUserID()', and set 'Requires role' true.. It uses a condition script that denies write access to users with the 'itil' role when the current record's creator is not the logged-in user. The ACL type 'record' with operation 'write' and 'Requires role' checked ensures that only users with the 'itil' role are evaluated, and the condition script 'current.created_by != gs.getUserID()' returns true for users who did not create the record, thus blocking their update operations. This matches the requirement to block all updates except for the record creator.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.assignment_group == gs.getUser().getMyGroups()', and set 'Requires role' true.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script empty, and uncheck 'Requires role'.

Answer

Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by == gs.getUserID()', and set 'Requires role' true.

Question 7

A notification should be sent to the change manager when a change request is submitted. Which TWO fields must be configured? (Choose TWO.)

Accepted Answer

Set the condition 'State changes to new' in 'When to send' tab.. Option C is correct because the notification must fire at the moment the change request is submitted, which in ServiceNow corresponds to the change request record transitioning to the New state, so the condition 'State changes to new' must be set on the 'When to send' tab to trigger the notification. Option D is correct because the notification must be delivered to the change manager, so the 'Change manager' role must be added under 'Recipients' on the 'Who will receive' tab so that users holding that role receive the notification. Option A is not required because a notification record is active by default when created, so setting it to active is not a mandatory configuration step. Option B is not required because weight only controls the order in which multiple notifications are processed and does not affect whether or when this notification is sent. Option E is not required because a default email template is applied automatically if none is explicitly selected, so choosing an email template is optional rather than mandatory.

Answer

Set the notification to active.

Answer

Set a weight value.

Answer

Select an email template.

Question 8

You are a ServiceNow administrator for a large enterprise. The company has a custom application that uses a table 'u_asset_tracking' to track IT assets. The table has a before insert business rule that sets the 'u_assigned_to' field to the current user if the field is empty. Recently, the security team reported that some users are able to view asset records that they should not see. After investigation, you find that the 'u_asset_tracking' table has no ACLs defined, and the default table ACL allows read access to all authenticated users. The business rule is working correctly. You need to restrict read access so that users can only see records where 'u_assigned_to' is themselves or where they are in the same 'u_department' as the record's 'u_department'. You must ensure that the solution does not affect other tables. Which approach should you take?

Accepted Answer

Create a new ACL for the 'u_asset_tracking' table with type 'record', operation 'read', condition script 'current.u_assigned_to == gs.getUserID() || current.u_department == gs.getUser().getDepartment()', and set order to 0. Ensure 'Requires role' is unchecked.. It creates a record-level ACL with a condition script that enforces row-level security: users can only read records where they are the assigned user or share the same department. The order of 0 ensures this ACL is evaluated before the default table ACL, and leaving 'Requires role' unchecked allows the condition to grant access without requiring a specific role, thus restricting read access based solely on the condition.

Answer

Modify the default table ACL for the 'u_asset_tracking' table to require the 'asset_user' role.

Answer

Add a business rule to restrict read access by deleting records from the glide record set.

Answer

Create a new ACL for the 'u_asset_tracking' table with type 'record', operation 'read', condition script 'current.u_assigned_to == gs.getUserID()', and require the 'asset_user' role.

Question 9

A system administrator needs to allow users with the 'incident_manager' role to delete incidents only if the incident state is 'New' or 'Work in Progress'. They create an ACL with the following conditions: type='record', operation='delete', name='incident', condition: gs.hasRole('incident_manager') && current.state == 1 || current.state == 2. After testing, users with the role can delete incidents in any state. What is the most likely cause?

Accepted Answer

The condition lacks parentheses to group the state checks.. The condition `gs.hasRole('incident_manager') && current.state == 1 || current.state == 2` is evaluated by JavaScript operator precedence, where `&&` binds tighter than `||`. This means it is parsed as `(gs.hasRole('incident_manager') && current.state == 1) || current.state == 2`. Consequently, any user (even without the role) can delete incidents in state 2 (Work in Progress), and users with the role can delete incidents in any state because the role check only applies to state 1. Adding parentheses—`gs.hasRole('incident_manager') && (current.state == 1 || current.state == 2)`—fixes the logic.

Answer

The ACL is set on the 'incident' table but should be on the 'task' table.

Answer

The ACL should be created using the condition builder instead of script.

Answer

The condition does not check for the 'incident_manager' role.

Question 10

A system administrator needs to prevent users from deleting any records in the 'incident' table. Which method will achieve this most effectively?

Accepted Answer

Create an application ACL on the incident table with the 'delete' operation set to 'no access'. An Application ACL with the 'delete' operation set to 'no access' explicitly denies the delete operation on the 'incident' table, regardless of any other ACLs or user roles. This is the most effective method to prevent record deletion because it directly targets the delete operation at the table level, overriding any inherited or role-based permissions.

Answer

Create a write ACL on the incident table with condition 'false'

Answer

Create a read ACL on the incident table with condition 'false'

Answer

Set the incident table 'Update' access to 'none' in the table configuration

Question 11

A business rule is configured to run 'before' a record is updated. If the business rule sets a field value and then a subsequent 'after' business rule also updates the same field, what will be the final value stored in the database?

Accepted Answer

The value set by the 'after' business rule. In ServiceNow, business rules execute in a defined order: 'before' business rules run first, followed by 'after' business rules. When both a 'before' and an 'after' business rule update the same field, the 'after' business rule executes later in the transaction and its value overwrites the 'before' business rule's value. The final value stored in the database is therefore the one set by the 'after' business rule, because the database write occurs after all business rules have completed.

Answer

Both values are stored in a history field

Answer

The database rejects the second change

Answer

The value set by the 'before' business rule

Question 12

A notification is not sending emails to the intended recipients. The notification's 'Who will receive' tab is set to 'Event creator' and the event is triggered by a business rule. However, the email recipient list is empty. What is the most likely cause?

Accepted Answer

The event was created by a system account, not a real user. When a notification's 'Who will receive' tab is set to 'Event creator' and the event is triggered by a business rule, the system resolves the recipient by looking up the user who triggered the event. If the event was created by a system account (e.g., 'system' or 'guest'), that account has no valid email address, resulting in an empty recipient list. This is the most likely cause because the notification is otherwise correctly configured and active.

Answer

The notification is inactive

Answer

The email template is missing the recipient field

Answer

The system property 'glide.email.smtp.port' is set incorrectly

Question 13

An administrator wants to enforce that when the 'state' field of an incident is set to 'Resolved', the 'resolution_notes' field must be filled. Which approach should be used?

Accepted Answer

Create a UI Policy that sets the 'resolution_notes' field to mandatory when state is 'Resolved'. UI Policies run on the client side and can dynamically set field attributes like 'mandatory' based on conditions evaluated in real time as the user interacts with the form. When the 'state' field changes to 'Resolved', the UI Policy can immediately make the 'resolution_notes' field mandatory, ensuring the user cannot submit the form without filling it. This approach provides instant visual feedback and prevents submission without requiring a server round-trip.

Answer

Create a data policy with a condition on the state field

Answer

Create a data lookup condition on the incident table

Answer

Create a business rule that checks the condition and shows an error message

Question 14

A company has an advanced business rule running on the 'incident' table with condition 'current.state == 2' (In Progress). The business rule creates a new child incident and also updates a field on the parent. However, when a state changes from 1 to 2 via a sys_created_by script, the child incident is created but the parent field is not updated. What is the most likely reason?

Accepted Answer

The business rule runs 'before' and there is an uncaught script error that aborts the update. In a 'before' business rule, an uncaught script error aborts the entire database transaction, rolling back all changes that were part of that transaction. However, if the child incident was created via a separate mechanism (e.g., an asynchronous script action or a GlideRecord operation with its own commit), it might persist independently of the aborted transaction. The parent field update fails because it is part of the same transaction that is rolled back due to the error. The condition 'current.state == 2' is met, so the business rule runs, but the uncaught error prevents the parent update from being committed.

Answer

The business rule condition is not met

Answer

The child incident creation also fails

Answer

The business rule runs 'after' instead of 'before'

Question 15

A notification is configured to send an email when a new incident is created. The email template uses the field 'Short Description', but the email shows empty for that field. The template is correct. What is the most likely cause?

Accepted Answer

The 'Short Description' field is not populated at the time the notification is sent. The notification fires when the incident is created, but the 'Short Description' field may not yet be populated at that exact moment if the record is saved before the field is filled. Notifications are triggered by the database write operation, and if the field is empty at that time, the email template will render it as blank, even though the template itself is correct.

Answer

The notification is not set to fire on create

Answer

The email template has a syntax error

Answer

The 'Short Description' field is read-only on the form