SNOW-CSA Application Rules, ACL and Notifications Practice Question
A system administrator needs to allow users with the 'incident_manager' role to delete incidents only if the incident state is 'New' or 'Work in Progress'. They create an ACL with the following conditions: type='record', operation='delete', name='incident', condition: gs.hasRole('incident_manager') && current.state == 1 || current.state == 2. After testing, users with the role can delete incidents in any state. What is the most likely cause?
⚠ Common exam trap
ServiceNow often tests operator precedence in ACL conditions, tricking candidates into overlooking that `&&` binds tighter than `||`, which causes the role check to apply only to the first state condition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The condition lacks parentheses to group the state checks.
The condition `gs.hasRole('incident_manager') && current.state == 1 || current.state == 2` is evaluated by JavaScript operator precedence, where `&&` binds tighter than `||`. This means it is parsed as `(gs.hasRole('incident_manager') && current.state == 1) || current.state == 2`. Consequently, any user (even without the role) can delete incidents in state 2 (Work in Progress), and users with the role can delete incidents in any state because the role check only applies to state 1. Adding parentheses—`gs.hasRole('incident_manager') && (current.state == 1 || current.state == 2)`—fixes the logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL is set on the 'incident' table but should be on the 'task' table.
Why it's wrong here
The ACL is correctly on the incident table; incident extends task, but delete ACL on incident is appropriate.
- ✓
The condition lacks parentheses to group the state checks.
Why this is correct
Without parentheses, the OR binds weaker than AND, allowing state 2 to bypass role check.
- ✗
The ACL should be created using the condition builder instead of script.
Why it's wrong here
The condition builder also allows scripting; the issue is the logic, not the method.
- ✗
The condition does not check for the 'incident_manager' role.
Why it's wrong here
It does check for the role, but operator precedence causes the logic flaw.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SNOW-CSA question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.