SNOW-CSA Application Rules, ACL and Notifications Practice Question
A company wants to block all update operations on the 'problem' table for users with only the 'itil' role, except for the user who created the record. Which ACL configuration should be used?
⚠ Common exam trap
Many candidates confuse the condition logic, selecting Option D because they think 'current.created_by == gs.getUserID()' will allow only the creator, but in a deny ACL, a true condition blocks access, so Option D would block the creator instead of allowing them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by != gs.getUserID()', and set 'Requires role' true.
It uses a condition script that denies write access to users with the 'itil' role when the current record's creator is not the logged-in user. The ACL type 'record' with operation 'write' and 'Requires role' checked ensures that only users with the 'itil' role are evaluated, and the condition script 'current.created_by != gs.getUserID()' returns true for users who did not create the record, thus blocking their update operations. This matches the requirement to block all updates except for the record creator.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.assignment_group == gs.getUser().getMyGroups()', and set 'Requires role' true.
Why it's wrong here
This grants write based on group, not creator.
- ✗
Create an ACL with type 'record', operation 'write', role 'itil', condition script empty, and uncheck 'Requires role'.
Why it's wrong here
This would deny write to all itil users unconditionally.
- ✓
Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by != gs.getUserID()', and set 'Requires role' true.
Why this is correct
Denies write to itil users if they are not the creator.
- ✗
Create an ACL with type 'record', operation 'write', role 'itil', condition script 'current.created_by == gs.getUserID()', and set 'Requires role' true.
Why it's wrong here
This grants write only to creators, but other itil users are denied (good), but ACL order might cause issues; also need to ensure no other ACL grants write.
Visual reference
Go deeper
Related to this question
About these practice questions
This SNOW-CSA question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.