Application Rules, ACL and Notifications →hardMultiple ChoiceObjective-mapped

SNOW-CSA Application Rules, ACL and Notifications Practice Question

Exhibit

sys_security_acl table record:
name: incident.write
operation: write
type: record
condition: gs.hasRole('admin') || gs.getUser().getDepartmentId() == current.caller_id.department

Script debug output:
*** Script: gs.hasRole('admin') -> false
*** Script: gs.getUser().getDepartmentId() -> 'IT'
*** Script: current.caller_id.department -> 'Finance'

Refer to the exhibit. A user without the admin role attempts to update an incident record where the caller's department is 'Finance'. The user's department is 'IT'. What will happen?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The update is denied because the condition evaluates to false.

The condition checks if user has admin role (false) or user's department equals caller's department (IT != Finance). Both false, so ACL denies write.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The update is denied because the condition evaluates to false.
Why this is correct
Both parts of the OR condition are false, so ACL denies.
✗
The update is allowed because the user has the admin role.
Why it's wrong here
The debug shows gs.hasRole('admin') is false.
✗
The update is allowed because the user's department matches the caller's department.
Why it's wrong here
User department 'IT' does not match caller department 'Finance'.
✗
The update is denied because the ACL is misconfigured.
Why it's wrong here
The ACL is correctly configured; it denies based on condition.

Visual reference

Go deeper

SNOW-CSA Application Rules, ACL and Notifications Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question