SNOW-CSA Application Rules, ACL and Notifications Practice Question
A developer wants to create a Scripted REST API endpoint that returns data from a custom table. The endpoint must only be accessible to users with the 'api_user' role. Which of the following is the best practice to enforce this restriction?
⚠ Common exam trap
It's easy for candidates to confuse 'Requires authentication' with role-based access control, assuming that authentication alone is sufficient to restrict access to specific roles, when in fact a separate ACL is required to enforce the role check.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a read ACL on the custom table that requires the 'api_user' role.
The best practice for restricting access to a Scripted REST API endpoint in ServiceNow is to use an ACL (Access Control List) on the underlying table. When the endpoint is set to 'Requires authentication', the platform automatically evaluates table-level ACLs for each record operation. By defining a read ACL that requires the 'api_user' role, you enforce role-based access at the data layer, which is more secure and maintainable than checking roles in script.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a condition in the script that checks gs.hasRole('api_user') for each request.
Why it's wrong here
Wrong: This is per-script and not enforced at database level.
- ✗
Set the system property 'glide.service.catalog.enforce_acl' to true.
Why it's wrong here
Wrong: This property applies to service catalog, not REST APIs.
- ✗
Use a 'read' ACL on the table and set the endpoint to 'Requires authentication'.
Why it's wrong here
Wrong: Requires authentication only checks if logged in, not role.
- ✓
Define a read ACL on the custom table that requires the 'api_user' role.
Why this is correct
Correct: ACLs provide table-level security.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SNOW-CSA question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.