Application Rules, ACL and Notifications →mediumMultiple ChoiceObjective-mapped

SNOW-CSA Application Rules, ACL and Notifications Practice Question

Exhibit

sys_acl
  name: incident.read
  type: record
  operation: read
  condition: gs.hasRole('itil')
  script:
    answer = gs.getUser().getDepartmentID() == gs.getProperty('dept_hr_id');
  order: 100

Refer to the exhibit. A user with the itil role can read incidents only if their department matches the property 'dept_hr_id'. What happens if the script is removed?

⚠ Common exam trap

The exam often tests the misconception that removing a condition from an ACL removes all restrictions, when in fact only that specific condition is removed and other conditions (like role requirement) still apply.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

All itil users can read incidents.

The script in the ACL condition enforces the department match requirement. Removing the script removes that condition, leaving only the 'itil' role requirement. Since the ACL still requires the 'itil' role, all users with that role can read all incidents, regardless of department.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
No users can read incidents.
Why it's wrong here
Incorrect; condition allows itil users.
✓
All itil users can read incidents.
Why this is correct
Correct; the condition alone grants read to itil role.
✗
All users can read incidents.
Why it's wrong here
Incorrect; condition still restricts to itil role.
✗
Only itil users whose department matches can read incidents.
Why it's wrong here
Incorrect; without script, the department check is removed.

Visual reference

Go deeper

SNOW-CSA Application Rules, ACL and Notifications Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question