Record-Level ACL for Group Restriction
A developer wants to restrict access to a specific record in the incident table so that only members of the 'ITIL' group can read it. Which type of ACL should be created?
Quick Answer
The correct answer is to create a record-level ACL with a condition that checks group membership. This is because ServiceNow ACL types are divided into table-level and record-level, and only a record-level ACL can evaluate conditions against a specific record’s data—such as checking whether the current user is a member of the 'ITIL' group—to restrict read access to that single incident. A table-level ACL would apply to all records in the table, not a specific one, making it too broad for this requirement. On the ServiceNow Certified Application Developer CAD exam, this scenario tests your understanding of how record-level ACLs enforce granular security by evaluating conditions like `gs.getUser().isMemberOf('ITIL')` against the user session. A common trap is confusing table-level with record-level ACLs; remember that if the requirement says “specific record,” you must use a record-level ACL. Memory tip: “Record-level for one record, table-level for the whole table.”
⚠ Common exam trap
Many exam-takers confuse UI policies (client-side) with ACLs (server-side) and think hiding the record in the UI is sufficient, but ServiceNow requires server-side ACLs to truly secure data from all access methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a record-level ACL with a condition that checks group membership.
A record-level ACL with a condition that checks group membership is the correct approach because it controls read access to the entire record based on the user's group membership. In ServiceNow, record-level ACLs evaluate conditions against the user's session and the record's data, and if the condition (e.g., 'member of ITIL group') is false, the record is hidden from the user entirely. This directly meets the requirement to restrict read access to a specific incident record for only the 'ITIL' group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a field-level ACL on the sys_id field.
Why it's wrong here
Field-level ACLs restrict access to specific fields, not the entire record.
- ✓
Create a record-level ACL with a condition that checks group membership.
Why this is correct
Record-level ACLs control read, write, delete on the entire record.
- ✗
Create a business rule to delete the record for unauthorized users.
Why it's wrong here
Business rules cannot prevent reading of data.
- ✗
Create a UI policy to hide the record.
Why it's wrong here
A UI policy controls form behaviour—visibility, mandatory fields, or read-only state—but it cannot enforce backend record-level read access. The stem requires restricting read permission to the ITIL group, which only an ACL with the correct type (record) and condition can achieve. UI policies are tempting because they can hide fields or entire forms from non-ITIL users, which appears to block access; however, they operate client-side and do not prevent direct record retrieval via REST API, scripts, or other channels, so the record remains readable outside the UI. A UI policy would be correct for hiding a field conditionally based on group membership, not for securing record-level read access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 481 original SNOW-CAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SNOW-CAD
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Match each ServiceNow access control rule (ACL) type to its function.
medium- ✓ A.Read ACL: Grants permission to view records.
- ✓ B.Write ACL: Grants permission to modify existing records.
- ✓ C.Create ACL: Grants permission to add new records.
- D.Delete ACL: Grants permission to run server-side scripts.
- E.Execute ACL: Grants permission to remove records.
Why A: ServiceNow ACL types define the operation being restricted. Read, Write, Create, Delete, and Execute are common. Correctly pair each ACL with its function: Read for viewing, Write for modifying, Create for adding, Delete for removing, Execute for running scripts. Common confusions involve swapping Delete and Execute.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CAD practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CAD exam.