SNOW-CSA Application Rules, ACL and Notifications Practice Question
Your company uses ServiceNow for IT Service Management. The 'incident' table has a custom 'create' ACL that restricts creation of incidents to users with the 'snc_internal' role. However, external users with the 'snc_external' role should also be able to create incidents via a portal. The portal uses a REST message that authenticates as a specific integration user. The integration user has the 'snc_internal' role. Despite the REST API call being successful, external users report that they cannot submit incidents through the portal. The system logs show that the REST API call returns a success, but the incident record is not created. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume the ACL is evaluated against the authenticated integration user (the REST message's credentials) rather than the end-user who triggered the portal action, leading them to overlook the role mismatch between the portal user and the ACL requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is evaluated against the portal user, who lacks the 'snc_internal' role.
ServiceNow ACLs are evaluated against the user who initiated the request, not the integration user making the REST API call. In this scenario, the portal widget executes under the context of the portal user (who lacks 'snc_internal'), so the 'create' ACL on the 'incident' table checks that user's roles, not the integration user's roles. Even though the REST message authenticates as an integration user with 'snc_internal', the system logs a success for the API call itself, but the ACL evaluation fails silently when the record creation is attempted, resulting in no incident record being created.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The integration user's session has expired during the request.
Why it's wrong here
Wrong: The REST call is successful, indicating authentication is fine.
- ✗
The portal widget is using a different table name in the API call.
Why it's wrong here
Wrong: The API call returns success, so table name is correct.
- ✓
The ACL is evaluated against the portal user, who lacks the 'snc_internal' role.
Why this is correct
Correct: In portal, the user's session is used for ACL checks.
- ✗
The REST API endpoint is mapped to the wrong table.
Why it's wrong here
Wrong: The API call is successful, so mapping is correct.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original SNOW-CSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.