nerdexam
ServiceNow

CSA · Question #65

Which one statement correctly describes Access Control rule evaluation?

The correct answer is C. If a row level rule and a field level rule exist, both rules must be true before an operation is. When both row-level and field-level Access Control Rules (ACLs) are applicable, both must evaluate to true for a user to gain access to perform an operation on that specific field.

Submitted by femi9· Apr 18, 2026Database Management and Platform Security

Question

Which one statement correctly describes Access Control rule evaluation?

Options

  • ATable access rules are evaluated from the general to the specific
  • BIf more than one rule applies to a record, the older rule is evaluated first
  • CIf a row level rule and a field level rule exist, both rules must be true before an operation is
  • DThe role with the most permissions evaluates the rules first.

How the community answered

(58 responses)
  • A
    5% (3)
  • B
    2% (1)
  • C
    90% (52)
  • D
    3% (2)

Why each option

When both row-level and field-level Access Control Rules (ACLs) are applicable, both must evaluate to true for a user to gain access to perform an operation on that specific field.

ATable access rules are evaluated from the general to the specific

Table access rules are evaluated from the most specific to the most general (e.g., field-level before table-level, and specific table before all tables), which is the opposite of general to specific.

BIf more than one rule applies to a record, the older rule is evaluated first

The evaluation order of ACLs is determined by their specificity (field, then record, then table) and type of access, not by their creation date or age.

CIf a row level rule and a field level rule exist, both rules must be true before an operation isCorrect

ServiceNow's Access Control evaluation logic dictates that for an operation to be permitted on a specific field, both the row-level ACLs (governing access to the entire record) and the field-level ACLs (governing access to that specific field) must independently evaluate to true. If either set of rules denies access, the operation is denied for that field.

DThe role with the most permissions evaluates the rules first.

Roles determine a user's permissions, but the evaluation order of ACLs themselves is based on the object (table/field) and type of access, not on the roles' permission levels.

Concept tested: Access Control Rule (ACL) evaluation order

Source: https://docs.servicenow.com/bundle/utah-platform-security/page/administer/contextual-security/concept/c_ACLRulesEvaluationOrder.html

Topics

#Access Control#ACL Evaluation#Platform Security#Row and Field Level Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CSA Practice