- A
ACLs can include conditions that must be met for access.
Conditions can be added to ACLs.
- B
ACLs are evaluated on the client side.
Why wrong: ACLs are evaluated server-side.
- C
ACLs are only applicable to system tables.
Why wrong: ACLs can be applied to custom tables as well.
- D
ACLs can control read and write access to records.
ACLs define permissions for operations.
- E
ACLs can be scoped to a specific application.
ACLs can be defined within an application scope.
Question 425 of 500
ACL Conditions, Scoping, and Roles in ServiceNow
This SNOW-CAD practice question tests your understanding of core application development. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE of the following are true about ACLs (Access Control Lists)? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ACLs can include conditions that must be met for access.
ACLs (Access Control Lists) in ServiceNow are used to enforce security by specifying conditions that must be met for a user to access a record, field, or script. Option A is correct because an ACL defines a condition (typically a script or a set of conditions) that evaluates to true or false, and only when the condition is met is access granted or denied. This is the core mechanism of ServiceNow's role-based and condition-based access control.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ACLs can include conditions that must be met for access.
Why this is correct
Conditions can be added to ACLs.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
ACLs are evaluated on the client side.
Why it's wrong here
ACLs are evaluated server-side.
- ✗
ACLs are only applicable to system tables.
Why it's wrong here
ACLs can be applied to custom tables as well.
- ✓
ACLs can control read and write access to records.
Why this is correct
ACLs define permissions for operations.
Related concept
Read the scenario before looking for a memorised answer.
- ✓
ACLs can be scoped to a specific application.
Why this is correct
ACLs can be defined within an application scope.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ServiceNow often tests the misconception that ACLs are client-side or only apply to system tables, but in ServiceNow, ACLs are server-side and apply to all tables, including custom and scoped application tables.
Detailed technical explanation
How to think about this question
ServiceNow ACLs are stored in the 'sys_security_acl' table and are evaluated in a specific order: first by type (record, field, script), then by order (numeric priority). Each ACL contains a condition script that runs server-side using GlideRecord and gs.getUser() to check user roles, groups, or custom logic. A common subtlety is that if no ACL matches a given operation, access is denied by default (implicit deny), which can lead to unexpected access issues if ACLs are not properly scoped.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
Visual reference
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Core Application Development — study guide chapter
Learn the concepts, then practise the questions
- →
Core Application Development practice questions
Targeted practice on this topic area only
- →
All SNOW-CAD questions
500 questions across all exam domains
- →
ServiceNow Certified Application Developer CAD study guide
Full concept coverage aligned to exam objectives
- →
SNOW-CAD practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SNOW-CAD practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Working with Data practice questions
Practise SNOW-CAD questions linked to Working with Data.
Platform Features and Integration practice questions
Practise SNOW-CAD questions linked to Platform Features and Integration.
Integrating and managing application data practice questions
Practise SNOW-CAD questions linked to Integrating and managing application data.
Automating application logic with business rules and scripts practice questions
Practise SNOW-CAD questions linked to Automating application logic with business rules and scripts.
Application development using ServiceNow Studio practice questions
Practise SNOW-CAD questions linked to Application development using ServiceNow Studio.
Creating and customizing tables and data practice questions
Practise SNOW-CAD questions linked to Creating and customizing tables and data.
Designing interfaces and user experiences practice questions
Practise SNOW-CAD questions linked to Designing interfaces and user experiences.
Core Application Development practice questions
Practise SNOW-CAD questions linked to Core Application Development.
User Interface Development practice questions
Practise SNOW-CAD questions linked to User Interface Development.
SNOW-CAD fundamentals practice questions
Practise SNOW-CAD questions linked to SNOW-CAD fundamentals.
SNOW-CAD scenario practice questions
Practise SNOW-CAD questions linked to SNOW-CAD scenario.
SNOW-CAD troubleshooting practice questions
Practise SNOW-CAD questions linked to SNOW-CAD troubleshooting.
Practice this exam
Start a free SNOW-CAD practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SNOW-CAD question test?
Core Application Development — This question tests Core Application Development — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: ACLs can include conditions that must be met for access. — ACLs (Access Control Lists) in ServiceNow are used to enforce security by specifying conditions that must be met for a user to access a record, field, or script. Option A is correct because an ACL defines a condition (typically a script or a set of conditions) that evaluates to true or false, and only when the condition is met is access granted or denied. This is the core mechanism of ServiceNow's role-based and condition-based access control.
What should I do if I get this SNOW-CAD question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SNOW-CAD
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following statements are true about ACLs? (Choose three.)
hard- ✓ A.An ACL with 'require_role' set to true will only be checked after the user has at least one role in the ACL's role list.
- ✓ B.If no ACL is defined for a table, all users have access to all records.
- C.ACLs are evaluated in a deterministic order based on the type (record, field, etc.) and the script condition.
- D.ACLs can be enforced on server-side scripts.
- ✓ E.ACLs can be used to restrict access to specific records using condition scripts.
Why A: Option A is correct: the 'require_role' attribute on an ACL record means the ACL rule is only evaluated after the system confirms the user has at least one of the roles listed in the ACL's role list. Option B is correct: by default, if no explicit ACL is defined for a table, the default ACL grants read access to all users. Option C is incorrect: ACLs are evaluated in a deterministic order based on type and the 'order' field, not the script condition. Option D is incorrect: ACLs are enforced on data access operations (e.g., GlideRecord queries), but they are not directly 'enforced on server-side scripts'—scripts can bypass ACLs if run with elevated privileges. Option E is correct: condition scripts on table ACLs can restrict access to specific records.
Variation 2. The ACL above is on the 'incident' table. A user with role 'itil' tries to update an incident record. What will happen?
medium- A.The user will be prompted for credentials.
- B.The user will be allowed because the condition is ignored for write operations.
- C.The user will be allowed because the script sets answer = true.
- ✓ D.The user will be denied because the condition fails.
Why D: The ACL (Access Control Rule) on the 'incident' table has a condition that must evaluate to true for the user to be granted access. In this case, the condition fails for a user with role 'itil' attempting to update the record, so the script does not set answer = true, resulting in a denial of the operation. Option D is correct because the condition failing means the ACL denies the write operation.
Variation 3. This ACL is configured to control read access on the 'incident' table. Under what condition will a user be allowed to read an incident record?
hard- A.If the user is from the company specified, regardless of the assigned_to field.
- B.If the user is from the company specified in the property and the incident is assigned to the user.
- ✓ C.If the user is from the company specified and the incident is assigned to the user's manager.
- D.If the user's manager is from the company specified and the incident is assigned to the user.
Why C: Option C is correct because the ACL condition checks that the user's company matches the company specified in the property, and the incident record's assigned_to field equals the user's manager. This is a common pattern in ServiceNow where read access is granted based on a relationship (manager) rather than direct assignment, ensuring that managers can view incidents assigned to their direct reports.
Keep practising
More SNOW-CAD practice questions
- A company has a custom table 'u_training_course' with a reference field to 'sys_user' named 'u_instructor'. The requirem…
- A company has a custom table 'u_asset' with a reference field 'u_location' pointing to 'cmn_location'. When a user chang…
- A developer needs to create a new application scope. Which of the following is a best practice when defining the scope?
- A company has a custom table 'u_incident_task' that extends 'task'. The developer wants to add a field 'u_approval' that…
- Which TWO of the following are types of UI Policies? (Choose two.)
- The ACL above is on the 'incident' table. A user with role 'itil' tries to update an incident record. What will happen?
Last reviewed: Jun 30, 2026
This SNOW-CAD practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CAD exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.