SNOW-CAD Core Application Development Practice Question
Which THREE of the following statements are true about ACLs? (Choose three.)
⚠ Common exam trap
Candidates often misunderstand that if no ACL is defined for a table, all users have read access by default. Also, ACLs are not 'enforced on server-side scripts' but on the underlying database operations. Condition scripts on table ACLs do allow record-level restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An ACL with 'require_role' set to true will only be checked after the user has at least one role in the ACL's role list.
The 'require_role' attribute on an ACL record means the ACL rule is only evaluated after the system confirms the user has at least one of the roles listed in the ACL's role list. Option B is correct: by default, if no explicit ACL is defined for a table, the default ACL grants read access to all users. Option C is incorrect: ACLs are evaluated in a deterministic order based on type and the 'order' field, not the script condition. Option D is incorrect: ACLs are enforced on data access operations (e.g., GlideRecord queries), but they are not directly 'enforced on server-side scripts'—scripts can bypass ACLs if run with elevated privileges. Option E is correct: condition scripts on table ACLs can restrict access to specific records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An ACL with 'require_role' set to true will only be checked after the user has at least one role in the ACL's role list.
Why this is correct
Correct: 'require_role' ensures the ACL is only evaluated if the user has at least one of the listed roles, preventing unnecessary script execution.
- ✓
If no ACL is defined for a table, all users have access to all records.
Why this is correct
Correct: When no ACL is defined for a table, the system applies a default ACL that grants read access to all users.
- ✗
ACLs are evaluated in a deterministic order based on the type (record, field, etc.) and the script condition.
Why it's wrong here
Incorrect: ACL evaluation order is based on type and the 'order' field, not the script condition.
- ✗
ACLs can be enforced on server-side scripts.
Why it's wrong here
Incorrect: ACLs are enforced on database operations (e.g., GlideRecord), not directly on server-side scripts. Scripts can be written to bypass ACLs using sys_security context.
- ✓
ACLs can be used to restrict access to specific records using condition scripts.
Why this is correct
Correct: Condition scripts on table ACLs can limit which records users can see or modify.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SNOW-CAD question from scratch — 481 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CAD practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CAD exam.