試験CSA-JPN トピック4 問題167 スレッド

InServiceNow,Access Control rules (ACLs)are used torestrict or grant accessto data. Each Access Control rule consists of:
Table-level (Row-Level) ACLs- Control access to the entire record (row).
Field-level ACLs- Control access to specific fields within a record.
Access Control rules are evaluated in a specific orderto determine whether a user has the necessary permissions to perform an action (Read, Write, Create, Delete, etc.).
If both a row-level and a field-level ACL exist for the same table, BOTH must evaluate to "true"before access is granted.
The system checks conditions, scripts, and roles defined in the ACLsto decide whether the user meets the access requirements.
Access Control Rule Evaluation Process:Why is Option C Correct?If both a row-level rule and a field-level rule exist, both must evaluate to "true" for a user to perform an action.
Row-Level ACLscheck if a user can access the record itself.
Field-Level ACLscheck if a user can access specific fields within that record.
If a user failseitherACL check, access is denied.
Why Are the Other Options Incorrect?A. "Rules are evaluated using roles. The role with the most permissions evaluates the rules first." Access Control rulesare not evaluated based on roles with the most permissions.
Roles are just one factorin ACL evaluation, along with conditions and scripts.
B: "If more than one rule applies to a row, the older rule is evaluated first." ServiceNow does not prioritize ACL rules based on their creation date.
Instead, ACLs follow a structured evaluation order (general-to-specific).
D: "Rules are evaluated from the general to the specific, so a table rule must be active to continue." This is partially true but misleading.
ServiceNow evaluates ACLs fromspecific to general(Field # Table).
However,a table-level rule does NOT need to be activefor a field-level ACL to be evaluated.
Reference from Certified System Administrator (CSA) Documentation:#ServiceNow Docs - Access Control Rules (ACLs) Evaluation
#ServiceNow ACL Evaluation Documentation
"If a field-level rule and a row-level rule exist,both must evaluate to truefor the operation to be allowed." Conclusion:The correct answer isC. If a row-level rule and a field-level rule exist, both rules must be true before an operation is allowed.
#Understanding ACL rule evaluation is critical for managing security in ServiceNow, ensuring that users have the appropriate access while maintaining data integrity.