SNOW-CSA Application Rules, ACL and Notifications Practice Question
A ServiceNow administrator deployed an Access Control Rule (ACL) to restrict access to the 'u_employee_salary' field on the 'u_employee' table. The ACL is defined as type 'field', with condition 'current.roles.contains("admin")', and 'read' and 'write' operations set to 'requires role'. After activating the ACL, non-admin users with the 'employee' role can still see the 'u_employee_salary' field on forms and lists. The administrator has verified that the 'employee' role does not have any other ACLs granting access to this field. Which of the following is the most likely cause of the issue?
⚠ Common exam trap
Test-takers frequently assume the ACL logic (condition or role requirement) is flawed, when in reality the ACL is simply not being applied due to a table/field name mismatch, which is a common oversight in ACL troubleshooting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is applied to the wrong table or the field name is misspelled.
The most likely cause is that the ACL is applied to the wrong table or the field name is misspelled. If the ACL's table or field name does not exactly match the target field, the ACL will not enforce on that field, allowing non-admin users to see it. The administrator verified no other ACLs grant access, so a mismatch in the ACL definition is the primary suspect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A higher-priority ACL with the same name is overriding this ACL.
Why it's wrong here
The administrator verified that no other ACLs grant access, so this is unlikely.
- ✓
The ACL is applied to the wrong table or the field name is misspelled.
Why this is correct
If the ACL does not match the exact table or field name, it will not be enforced, allowing default access.
- ✗
The ACL is missing a script condition that returns false for non-admin users.
Why it's wrong here
The 'requires role' setting is sufficient; a script condition is not necessary for this use case.
- ✗
The ACL is of type 'record' instead of 'field'.
Why it's wrong here
The ACL type is explicitly stated as 'field' in the scenario, so this is not the issue.
Visual reference
Go deeper
Related to this question
About these practice questions
This SNOW-CSA question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.