ServiceNow CSA Exam - Topic 4 Question 106 Discussion

In ServiceNow, Access Control rules (ACLs) are used to restrict or grant access to data. Each Access Control rule consists of:

Table-level (Row-Level) ACLs -- Control access to the entire record (row).

Field-level ACLs -- Control access to specific fields within a record.

Access Control Rule Evaluation Process:

Access Control rules are evaluated in a specific order to determine whether a user has the necessary permissions to perform an action (Read, Write, Create, Delete, etc.).

If both a row-level and a field-level ACL exist for the same table, BOTH must evaluate to 'true' before access is granted.

The system checks conditions, scripts, and roles defined in the ACLs to decide whether the user meets the access requirements.

Why is Option C Correct?

If both a row-level rule and a field-level rule exist, both must evaluate to 'true' for a user to perform an action.

Row-Level ACLs check if a user can access the record itself.

Field-Level ACLs check if a user can access specific fields within that record.

If a user fails either ACL check, access is denied.

Why Are the Other Options Incorrect?

A. 'Rules are evaluated using roles. The role with the most permissions evaluates the rules first.'

Access Control rules are not evaluated based on roles with the most permissions.

Roles are just one factor in ACL evaluation, along with conditions and scripts.

B. 'If more than one rule applies to a row, the older rule is evaluated first.'

ServiceNow does not prioritize ACL rules based on their creation date.

Instead, ACLs follow a structured evaluation order (general-to-specific).

D. 'Rules are evaluated from the general to the specific, so a table rule must be active to continue.'

This is partially true but misleading.

ServiceNow evaluates ACLs from specific to general (Field Table).

However, a table-level rule does NOT need to be active for a field-level ACL to be evaluated.

Reference from Certified System Administrator (CSA) Documentation:

ServiceNow Docs -- Access Control Rules (ACLs) Evaluation ServiceNow ACL Evaluation Documentation

'If a field-level rule and a row-level rule exist, both must evaluate to true for the operation to be allowed.'

Conclusion:

The correct answer is C. If a row-level rule and a field-level rule exist, both rules must be true before an operation is allowed. Understanding ACL rule evaluation is critical for managing security in ServiceNow, ensuring that users have the appropriate access while maintaining data integrity.