ACL Conditions, Scoping, and Roles in ServiceNow
Which THREE of the following are true about ACLs (Access Control Lists)? (Choose three.)
Quick Answer
This statement is true because ACLs, like other configurable artifacts in ServiceNow, are created inside an application scope, which means a rule can be defined so it governs access only for records, fields, or scripts belonging to that particular application rather than acting instance-wide. This matters because ACLs are the platform's core security mechanism: each one specifies a condition, often a script or a set of role checks, that must evaluate to true before a user is granted access to a record, field, or script. Being able to scope an ACL to a specific application lets developers keep security logic self-contained within the application it protects, which supports cleaner packaging and reduces the chance that a rule meant for one application accidentally affects data or processes elsewhere on the instance. When a question asks you to identify true statements about ACLs among several choices, treat ACL behavior as having multiple independent dimensions worth checking separately: where the rule lives (its scope), what condition or role it evaluates, and how it interacts with other ACLs on the same table and operation. A correct statement will accurately describe one of these mechanics, while an incorrect one usually overstates an ACL's reach or misdescribes how it is evaluated, so always verify each claim against the specific mechanic it is describing rather than assuming ACLs behave as a single uniform feature.
⚠ Common exam trap
ServiceNow often tests the misconception that ACLs are client-side or only apply to system tables, but in ServiceNow, ACLs are server-side and apply to all tables, including custom and scoped application tables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ACLs can include conditions that must be met for access.
ACLs (Access Control Lists) in ServiceNow are used to enforce security by specifying conditions that must be met for a user to access a record, field, or script. Option A is correct because an ACL defines a condition (typically a script or a set of conditions) that evaluates to true or false, and only when the condition is met is access granted or denied. This is the core mechanism of ServiceNow's role-based and condition-based access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ACLs can include conditions that must be met for access.
Why this is correct
Conditions can be added to ACLs.
- ✗
ACLs are evaluated on the client side.
Why it's wrong here
ACLs are evaluated server-side.
- ✗
ACLs are only applicable to system tables.
Why it's wrong here
ACLs can be applied to custom tables as well.
- ✓
ACLs can control read and write access to records.
Why this is correct
ACLs define permissions for operations.
- ✓
ACLs can be scoped to a specific application.
Why this is correct
ACLs can be defined within an application scope.
Visual reference
Go deeper
Related to this question
About these practice questions
This SNOW-CAD question is part of Courseiva's 481-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SNOW-CAD
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following statements are true about ACLs? (Choose three.)
hard- ✓ A.An ACL with 'require_role' set to true will only be checked after the user has at least one role in the ACL's role list.
- ✓ B.If no ACL is defined for a table, all users have access to all records.
- C.ACLs are evaluated in a deterministic order based on the type (record, field, etc.) and the script condition.
- D.ACLs can be enforced on server-side scripts.
- ✓ E.ACLs can be used to restrict access to specific records using condition scripts.
Why A: The 'require_role' attribute on an ACL record means the ACL rule is only evaluated after the system confirms the user has at least one of the roles listed in the ACL's role list. Option B is correct: by default, if no explicit ACL is defined for a table, the default ACL grants read access to all users. Option C is incorrect: ACLs are evaluated in a deterministic order based on type and the 'order' field, not the script condition. Option D is incorrect: ACLs are enforced on data access operations (e.g., GlideRecord queries), but they are not directly 'enforced on server-side scripts'—scripts can bypass ACLs if run with elevated privileges. Option E is correct: condition scripts on table ACLs can restrict access to specific records.
Variation 2. The ACL above is on the 'incident' table. A user with role 'itil' tries to update an incident record. What will happen?
medium- A.The user will be prompted for credentials.
- B.The user will be allowed because the condition is ignored for write operations.
- C.The user will be allowed because the script sets answer = true.
- ✓ D.The user will be denied because the condition fails.
Why D: The ACL (Access Control Rule) on the 'incident' table has a condition that must evaluate to true for the user to be granted access. In this case, the condition fails for a user with role 'itil' attempting to update the record, so the script does not set answer = true, resulting in a denial of the operation. Option D is correct because the condition failing means the ACL denies the write operation.
Variation 3. This ACL is configured to control read access on the 'incident' table. Under what condition will a user be allowed to read an incident record?
hard- A.If the user is from the company specified, regardless of the assigned_to field.
- B.If the user is from the company specified in the property and the incident is assigned to the user.
- ✓ C.If the user is from the company specified and the incident is assigned to the user's manager.
- D.If the user's manager is from the company specified and the incident is assigned to the user.
Why C: The ACL condition checks that the user's company matches the company specified in the property, and the incident record's assigned_to field equals the user's manager. This is a common pattern in ServiceNow where read access is granted based on a relationship (manager) rather than direct assignment, ensuring that managers can view incidents assigned to their direct reports.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CAD practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CAD exam.