Courseiva
Application Rules, ACL and NotificationsmediumMultiple ChoiceObjective-mapped

SNOW-CSA Application Rules, ACL and Notifications Practice Question

A company wants to allow managers to view all incidents, but only their own direct reports' incidents to be editable. Which ACL approach is most efficient?

⚠ Common exam trap

The trap here is that candidates often overcomplicate the solution by thinking they need separate ACLs or roles per manager, when a single scripted ACL condition can dynamically evaluate the manager–direct report relationship at runtime, which is both efficient and scalable.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Create a read ACL for managers and a write ACL with a script condition checking manager relationship.

It uses a read ACL to grant all managers view access to all incidents, and a separate write ACL with a script condition that dynamically checks whether the incident's assigned user is a direct report of the current manager. This approach is efficient as it avoids duplicating ACLs per manager or per group, leveraging a single script condition to enforce the manager–direct report relationship at runtime.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Create a read ACL for managers and a write ACL with a script condition checking manager relationship.

    Why this is correct

    A script condition dynamically checks the relationship, making it scalable.

  • Use a business rule to set a field indicating editable and use ACL on that field.

    Why it's wrong here

    This adds extra processing and complexity.

  • Use role-based ACLs and assign a separate role for each manager.

    Why it's wrong here

    Role management becomes cumbersome.

  • Create separate write ACLs for each manager's direct reports.

    Why it's wrong here

    Not scalable as the number of managers grows.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

One of 504 original SNOW-CSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.