Courseiva
Application Rules, ACL and NotificationsmediumMultiple ChoiceObjective-mapped

SNOW-CSA Application Rules, ACL and Notifications Practice Question

Your company uses ServiceNow for IT Service Management. The 'incident' table has a custom 'create' ACL that restricts creation of incidents to users with the 'snc_internal' role. However, external users with the 'snc_external' role should also be able to create incidents via a portal. The portal uses a REST message that authenticates as a specific integration user. The integration user has the 'snc_internal' role. Despite the REST API call being successful, external users report that they cannot submit incidents through the portal. The system logs show that the REST API call returns a success, but the incident record is not created. What is the most likely cause?

⚠ Common exam trap

It's easy for candidates to assume the ACL is evaluated against the authenticated integration user (the REST message's credentials) rather than the end-user who triggered the portal action, leading them to overlook the role mismatch between the portal user and the ACL requirement.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The ACL is evaluated against the portal user, who lacks the 'snc_internal' role.

ServiceNow ACLs are evaluated against the user who initiated the request, not the integration user making the REST API call. In this scenario, the portal widget executes under the context of the portal user (who lacks 'snc_internal'), so the 'create' ACL on the 'incident' table checks that user's roles, not the integration user's roles. Even though the REST message authenticates as an integration user with 'snc_internal', the system logs a success for the API call itself, but the ACL evaluation fails silently when the record creation is attempted, resulting in no incident record being created.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The integration user's session has expired during the request.

    Why it's wrong here

    Wrong: The REST call is successful, indicating authentication is fine.

  • The portal widget is using a different table name in the API call.

    Why it's wrong here

    Wrong: The API call returns success, so table name is correct.

  • The ACL is evaluated against the portal user, who lacks the 'snc_internal' role.

    Why this is correct

    Correct: In portal, the user's session is used for ACL checks.

  • The REST API endpoint is mapped to the wrong table.

    Why it's wrong here

    Wrong: The API call is successful, so mapping is correct.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

One of 504 original SNOW-CSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.