Question 128 of 500

Designing interfaces and user experiences →hardMultiple ChoiceObjective-mapped

Quick Answer

The correct answer is that client-side $http calls bypass server-side ACLs, creating a security risk in Service Portal. This occurs because $http executes in the browser, sending REST API requests directly from the user’s session without passing through the server-side script evaluation that enforces ACLs via spUtil or GlideRecord. On the ServiceNow Certified Application Developer CAD exam, this scenario tests your understanding of how client-side REST calls can expose data that would otherwise be filtered by server-side ACLs, even though the user’s session credentials are still validated. A common trap is assuming that any REST API call respects all ACLs equally; in reality, client-side $http bypasses the granular record-level and field-level checks applied during server-side processing. Remember the mnemonic: “Client-side $http skips server-side checks—use spUtil to protect the necks.”

SNOW-CAD Designing interfaces and user experiences Practice Question

This SNOW-CAD practice question tests your understanding of designing interfaces and user experiences. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Exhibit

// Widget Client Controller
function($scope, $http) {
    $http.get('/api/now/table/incident?sysparm_limit=10').then(function(response){
        $scope.data = response.data.result;
    });
}

Refer to the exhibit. What security risk is present in this implementation?

Question 1hardmultiple choice

Full question →

Exhibit

// Widget Client Controller
function($scope, $http) {
    $http.get('/api/now/table/incident?sysparm_limit=10').then(function(response){
        $scope.data = response.data.result;
    });
}

A
The request exposes internal API credentials
Why wrong: Incorrect: Credentials are not exposed in client-side code.
B
The endpoint does not require authentication
Why wrong: Incorrect: The endpoint uses session authentication.
C
The client exposes the widget to XSS attacks
Why wrong: Incorrect: This is not inherent to the $http call.
D
The data is not subject to the same ACLs as server-side calls
Correct: Client-side REST calls may have different ACL behavior than server GlideRecord queries.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The data is not subject to the same ACLs as server-side calls

Using client-side $http calls bypasses the server-side ACL evaluation that occurs when using spUtil or server scripts. Client-side REST API calls still respect ACLs based on the user's session, but they may expose sensitive data that goes through different security checks. However, a more critical risk is that the endpoint might be susceptible to CSRF if not protected. In the context of Service Portal, the recommended approach is to use spUtil.get or a server script to ensure proper data access control. Option D highlights the risk of inconsistent ACL enforcement.

Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The request exposes internal API credentials
Why it's wrong here
Incorrect: Credentials are not exposed in client-side code.
✗
The endpoint does not require authentication
Why it's wrong here
Incorrect: The endpoint uses session authentication.
✗
The client exposes the widget to XSS attacks
Why it's wrong here
Incorrect: This is not inherent to the $http call.
✓
The data is not subject to the same ACLs as server-side calls
Why this is correct
Correct: Client-side REST calls may have different ACL behavior than server GlideRecord queries.
Related concept
Standard ACLs match source addresses.

Common exam traps

Common exam trap: ACLs stop at the first match

ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.

Detailed technical explanation

How to think about this question

ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.

KKey Concepts to Remember

Standard ACLs match source addresses.
Extended ACLs can match source, destination, protocol and ports.
The first matching ACL entry is used.
There is usually an implicit deny at the end.

TExam Day Tips

Check inbound versus outbound direction.
Read the ACL from top to bottom.
Look for a broader permit or deny above the intended line.

Key takeaway

ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Real-world example

How this comes up in practice

A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.

What to study next

Got this wrong? Here's your next step.

Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related SNOW-CAD ACL questions on filtering logic and placement.

Related SNOW-CAD practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Working with Data practice questions

Practise SNOW-CAD questions linked to Working with Data.

Platform Features and Integration practice questions

Practise SNOW-CAD questions linked to Platform Features and Integration.

Integrating and managing application data practice questions

Practise SNOW-CAD questions linked to Integrating and managing application data.

Automating application logic with business rules and scripts practice questions

Practise SNOW-CAD questions linked to Automating application logic with business rules and scripts.

Application development using ServiceNow Studio practice questions

Practise SNOW-CAD questions linked to Application development using ServiceNow Studio.

Creating and customizing tables and data practice questions

Practise SNOW-CAD questions linked to Creating and customizing tables and data.

Designing interfaces and user experiences practice questions

Practise SNOW-CAD questions linked to Designing interfaces and user experiences.

Core Application Development practice questions

Practise SNOW-CAD questions linked to Core Application Development.

User Interface Development practice questions

Practise SNOW-CAD questions linked to User Interface Development.

SNOW-CAD fundamentals practice questions

Practise SNOW-CAD questions linked to SNOW-CAD fundamentals.

SNOW-CAD scenario practice questions

Practise SNOW-CAD questions linked to SNOW-CAD scenario.

SNOW-CAD troubleshooting practice questions

Practise SNOW-CAD questions linked to SNOW-CAD troubleshooting.

Practice this exam

Start a free SNOW-CAD practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SNOW-CAD practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SNOW-CAD question test?

Designing interfaces and user experiences — This question tests Designing interfaces and user experiences — Standard ACLs match source addresses..

What is the correct answer to this question?

The correct answer is: The data is not subject to the same ACLs as server-side calls — Using client-side $http calls bypasses the server-side ACL evaluation that occurs when using spUtil or server scripts. Client-side REST API calls still respect ACLs based on the user's session, but they may expose sensitive data that goes through different security checks. However, a more critical risk is that the endpoint might be susceptible to CSRF if not protected. In the context of Service Portal, the recommended approach is to use spUtil.get or a server script to ensure proper data access control. Option D highlights the risk of inconsistent ACL enforcement.

What should I do if I get this SNOW-CAD question wrong?

What is the key concept behind this question?

Standard ACLs match source addresses.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jun 24, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SNOW-CAD practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CAD exam.