A system administrator notices that users in the 'itil' role can see the 'cost' field on the 'cmdb_ci_server' table, but the requirement is to hide it from all except users with the 'cmdb_admin' role. The administrator has already created an ACL with 'read' operation, type 'record', condition 'current.cost' (no script) and granted 'no access' to all roles. However, the field is still visible. What is missing?
Field ACLs control read/write access to individual fields.
Why this answer
A 'record' ACL controls access to the entire record, but the requirement is to hide a specific field ('cost') from certain roles. To control visibility at the field level, the ACL type must be 'field', not 'record'. A 'record' ACL determines whether a user can see or interact with the whole record, while a 'field' ACL governs access to individual fields.
Since the 'cost' field is still visible, the existing 'record' ACL is not applied to the field itself, allowing the 'itil' role to see it via default field-level access.
Exam trap
The trap here is that candidates often confuse 'record' ACLs with 'field' ACLs, assuming a record ACL with a condition on a field will hide that field, when in reality only a field ACL can control individual field visibility.
How to eliminate wrong answers
Option A is wrong because the condition 'current.cost' is a valid condition that checks if the field has a value; using a script is not required to hide a field, and the issue is the ACL type, not the condition format. Option B is wrong because 'mandatory' is a property for UI policies, not ACLs; ACLs do not have a 'mandatory' setting, and making an ACL mandatory would not change the type from record to field. Option C is wrong because removing the user from the 'itil' role would hide the field but does not address the root cause—the ACL is misconfigured as a record ACL instead of a field ACL, and the requirement is to hide the field from all except 'cmdb_admin', not to remove users from roles.