The answer is to create an ACL with a condition script that checks if the logged-in user is the manager of the record's employee, and to configure a UI Policy that sets the sensitive fields to read-only or invisible for non-managers. This combination works because field-level security sensitive data in ServiceNow requires both record-level access via ACLs and field-level visibility control via UI Policies; the ACL ensures only managers can access the record, while the UI Policy hides or locks the sensitive fields from other roles who might still see the record. On the ServiceNow Certified Application Developer CAD exam, this scenario tests your understanding that ACLs handle who can see the entire record, whereas UI Policies enforce granular field-level restrictions—a common trap is assuming an ACL alone is enough for field-level security. Remember the mnemonic: ACL for access, UI for visibility.
SNOW-CAD Designing interfaces and user experiences Practice Question
This SNOW-CAD practice question tests your understanding of designing interfaces and user experiences. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A developer is designing a custom application with a table that stores sensitive employee data. The requirement is that only managers can view records where they are the manager of the employee. Which two configurations are needed to implement this requirement?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a UI Policy to set fields to read-only or invisible for non-managers
Option A is correct because UI Policies can be configured to set fields as read-only or invisible based on conditions, such as the user's role or relationship to the record. This allows non-managers to see the record but prevents them from viewing sensitive fields, aligning with the requirement to restrict visibility at the field level.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Use a UI Policy to set fields to read-only or invisible for non-managers
Why this is correct
UI Policies can set field attributes like visible or read-only based on conditions.
Related concept
Read the scenario before looking for a memorised answer.
✓
Create an ACL with a condition script that checks if the logged-in user is the manager of the record's employee
Why this is correct
ACLs control read access based on conditions.
Related concept
Read the scenario before looking for a memorised answer.
✗
Create a new view that excludes sensitive fields
Why it's wrong here
Views don't enforce security; users could switch views.
✗
Create a Business Rule that deletes records if the user is not the manager
Why it's wrong here
Business rules run on server and delete records, but don't prevent viewing.
✗
Use a Client Script to hide fields if the user is not the manager
Why it's wrong here
Client scripts can be bypassed; server-side ACL is needed.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse client-side controls (UI Policies, Client Scripts) with server-side security (ACLs), assuming that hiding fields on the form is sufficient to protect sensitive data, when in fact ACLs are required to prevent data access via web services or direct database queries.
Detailed technical explanation
How to think about this question
Access control in ServiceNow is primarily enforced server-side via ACLs (Access Control Lists), which evaluate conditions like the 'manager' field against the logged-in user before any data is sent to the client. UI Policies complement ACLs by controlling field visibility and editability on the client, but they rely on the server-side ACL to prevent direct API or scripted access to the data. In a real-world scenario, a manager might need to view all fields of their direct reports, while non-managers should see only non-sensitive fields; combining an ACL with a condition script and a UI Policy ensures both server-side security and a clean user interface.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Designing interfaces and user experiences — This question tests Designing interfaces and user experiences — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use a UI Policy to set fields to read-only or invisible for non-managers — Option A is correct because UI Policies can be configured to set fields as read-only or invisible based on conditions, such as the user's role or relationship to the record. This allows non-managers to see the record but prevents them from viewing sensitive fields, aligning with the requirement to restrict visibility at the field level.
What should I do if I get this SNOW-CAD question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SNOW-CAD practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CAD exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.