Security and Restricting Access
36 questions from the Security and Restricting Access domain of the ServiceNow Certified Application Developer (CAD) exam, each with its answer and an explanation. Read them through as revision, then sit the full practice exam to test yourself on them under multiple-choice conditions.
1.Which of the following methods are useful in Access Control scripts?
Answer
- gs.hasRole() and current.isNewRecord()
Access control scripts run on the server, so they use GlideSystem methods such as gs.hasRole() and GlideRecord methods on current such as isNewRecord(), which checks whether the record has not been saved yet. g_user is a client-side object.
2.When configuring an Access Control that has no condition or script, which one of the following statements is NOT true?
Answer
- table.id will grant access to a specific record on the table
Access control rules are named for a table (table.None), every field on a table (table.*) or one field (table.field). There is no table.id form for a single record; access to particular records is limited with a condition or a script.
3.How must Application Access be configured to prevent all other private application scopes from creating configuration records on an application's data tables?
Answer
- Set the Accessible from field value to This application scope only
Setting Accessible from to This application scope only limits the table to its own application, so no other scope can create records or configuration on it. Clearing Can create only stops other scopes from creating data records, and web service access is a separate setting.
4.In a Business Rule, which one of the following returns true if the currently logged in user has the admin role?
Answer
- gs.hasRole('admin')
Business rules run on the server, where gs.hasRole('admin') checks the logged-in user's roles. g_form exists only in the browser and has no role methods, and hasRoleExactly() is a g_user method, not a GlideSystem one.
5.When evaluating Access Controls, ServiceNow searches and evaluates:
Answer
- From the most specific match to the most generic match
ServiceNow looks for the most specific rule first, such as a rule for the exact table and field, and falls back to more generic rules, such as a parent table or the * wildcard, only when no more specific match exists.
6.Which method call returns true only if the currently logged in user has the catalog_admin role and in no other case?
Answer
- g_user.hasRoleExactly('catalog_admin')
g_user.hasRole() also returns true for users with the admin role, because admin passes every role check. g_user.hasRoleExactly() returns true only when the user actually has the named role. hasRoleOnly() doesn't exist, and hasRoleFromList() checks a list of roles with the same admin behavior as hasRole().
7.Which one of the following is true for a table with the "Allow configuration" Application Access option selected?
Answer
- Out of scope applications can create Business Rules for the table
Allow configuration lets applications in other scopes create configuration on the table, such as business rules, client scripts and UI actions. It doesn't let users change the application's own scripts or let other scopes add tables to it.
8.When creating new application files in a scoped application, cross scope access is turned on by default in which of the following?
Answer
- Table
A new table in a scoped application is accessible from all application scopes by default, with read access allowed. Script includes, workflows and REST messages are created as accessible from this application scope only.
9.Which Application Access configuration field(s) are NOT available if the Can read configuration field is NOT selected?
Answer
- Can create, Can update, and Can delete
Other scopes can't create, update or delete records they aren't allowed to read, so clearing Can read makes Can create, Can update and Can delete unavailable.
10._____ is similar to ACLs in that it allows you to restrict access to certain resources, but instead of restricting tables and records from users, it restricts application resources from other applications.
Answer
- Application Access Settings
Application access settings on tables and scripts decide what other application scopes can do with an application's resources, such as reading or changing a table or calling a script include. Access controls restrict users, and application roles are granted to users, not to other applications.
11.A table called x is created with 3 fields, x1, x2 and x3, and has these access controls: x.None read access control for users with the admin and itil roles; x.* read access control for users with the admin role; x.x3 read access control for users with the itil role. Which field or fields can a user with the itil role read?
Answer
- x3 only
The itil user passes the table rule x.None, so the records can be read. For x3 the most specific rule is x.x3, which allows itil. For x1 and x2 there is no field rule, so x.* applies, and it only allows admin. The user can therefore read only x3.
12.The access controls for a table may include a table.None rule or a table.* rule, but never both. True or False?
Answer
- FALSE
A table usually has both: table.None controls access to the records, and table.* controls access to the fields that don't have their own rule. A user must pass the record rule and then the field rule to see a field's value.
13.Are ACLs mandatory for privately scoped applications?
Answer
- False, but it is a best practice
An application's tables work without access controls, but their data is then not properly protected. ServiceNow offers to create a role and access controls when you create a table in a scoped application, and defining them is a best practice.
14.Does g_user.hasRole('x_foo_app_user') return true for a user with the admin role?
Answer
- Yes
hasRole() always returns true for users with the admin role, whatever role is passed in. Use g_user.hasRoleExactly() when an admin should only pass if they actually have the role.
15.While debugging security rules, what does the blue color code indicate?
Answer
- The ACL is already in the cache and does not need to be re-evaluated
In the security rule debug output, a blue result means the access control's outcome came from the cache, so it wasn't evaluated again. Green shows a rule that passed and red shows a rule that failed.
16.What is Runtime Access Tracking for an application?
Answer
- Allows administrators to manage script access to application resources by creating a list of script operations and targets that the system authorizes to run, with the options None, Tracking and Enforcing
Runtime access tracking controls which cross-scope operations an application's scripts may perform. Tracking records the operations and allows them, Enforcing blocks any operation an administrator hasn't authorized, and None turns tracking off.
17.For application access, there is a configuration called Allow access to this table via web services. Which of the following statements is true when this option is selected?
Answer
- The user performing the query via web services must have the correct permission to access the table's records
Allow access to this table via web services makes the table available to web service requests, both REST and SOAP, but it doesn't bypass security. The user making the request still has to pass the table's access controls to read or change its records.
18.Which of the following statements must evaluate to true to grant a user access to an application table's record? (a) Conditions configured in the access control must evaluate to true. (b) Scripts configured in the access control must evaluate to true. (c) The user has one of the roles specified in the required roles related list. (d) Other matching access controls for the record evaluate to true.
Answer
- a, b, c
An access control grants access only when its roles, condition and script all pass. Other matching access controls at the same level don't all have to pass: passing one of them is enough.
19.A custom application called XYZ has a table XYTable with this Application Access configuration: Accessible from: All application scopes; Can read: selected; Can delete: selected; Allow configuration: selected. Which of the following is true?
Answer
- An application developer working in another privately scoped application can write a business rule which successfully deletes all records from XYTable
Accessible from All application scopes with Can delete selected allows scripts in other scopes to delete the table's records, and Allow configuration lets them create business rules on it. A business rule in another scoped application can therefore delete XYTable's records.
20.By default, are any new table's records available for viewing by users?
Answer
- No, a user will not be able to see the table's records unless they satisfy the ACLs on the table
Access to a table's records is governed by its access controls, so a user can see the records only after passing the table's read rules, such as having a required role.
21.Which check box is selected in an ACL's configuration to display the Script field?
Answer
- Advanced
Selecting Advanced on an access control shows the Script field, so the rule can use a script as well as roles and a condition. There is no Script check box.
22.Records are created in the Application Cross-Scope Access table when the Runtime Access Tracking setting is set to:
Answer
- Tracking/Enforcing
With Tracking or Enforcing, the cross-scope operations an application's scripts perform are recorded in the Application Cross-Scope Access table, where they can be allowed or denied. With None, nothing is recorded.
23.Which certificate-based authentication methods can be enabled so that users can log in to the Service Portal?
Answers
- Common Access Card (CAC)
- Personal Identity Verification (PIV)
Certificate-based authentication lets users log in to the Service Portal with a smart card, such as a Common Access Card (CAC) or a Personal Identity Verification (PIV) card. The other card types are not supported methods.
24.Select the correct order of evaluation for an ACL.
Answer
- 1) Roles, 2) Conditions, 3) Scripts
An access control checks its required roles first, then its condition, and then its script. All three must pass for the rule to grant access.
25.Which role is required to create and access baselines in a ServiceNow instance?
Answer
- ecmdb_admin role is required to create and access baselines.
Creating and viewing CMDB baselines, which are snapshots of CIs used to compare later changes, requires the ecmdb_admin role. The cmdb_admin role on its own is not the role for baselines.
26.Does ServiceNow provide a way to debug ACLs?
Answer
- Yes. You can debug issues with ACL using Enable ACL debug option from left navigation pane.
Yes. Debugging for security rules can be turned on from the navigator, and it then shows which access controls were evaluated for each record and field and whether they passed or failed.
27.Choose the correct ACL evaluation process from the below options.
Answer
- An ACL rule only grants access if condition evaluates true, script evaluates true, user has a required role (or list is empty), and for Record ACLs both table-level and field-level rules must evaluate true
An access control grants access only when its condition and script evaluate to true and the user has one of its required roles, or the rule has no roles. To access a field on a record, the user must also pass both the table-level and the field-level rules.
28.How do you remove the Remember me check box from the login page?
Answer
- You can set the property "glide.ui.forgetme" to "true"
Setting the glide.ui.forgetme system property to true removes the Remember me check box from the login page.
29.How do you make the script conditions of Access Control rules apply to a table's reference fields?
Answer
- Add glide.sys_reference_row_check to the System properties and set to true.
Adding the glide.sys_reference_row_check system property and setting it to true makes the script conditions of access control rules also apply to a table's reference fields.
30.Choose the best answer that describes the difference between the record-level None and the wildcard * in ACLs.
Answer
- Table.* is a field level ACL which gives access to all fields on that table. Table.none is a row level ACL which allows you to access records.
Table.None is a row-level rule that controls access to the table's records, and Table.* is a field-level rule that applies to every field without its own rule. A user must pass both, so with Table.None for admin and itil and Table.* for admin only, itil users can't read the fields.
31.Which roles are required to follow up on a request (RITM)?
Answers
- sn_request_itil
- itil
- sn_request_write
The itil role gives fulfillers access to requests and requested items, and sn_request_itil and sn_request_write let users work on and update request records, which following up requires. ritm_write is not a role, catalog is for managing the catalog itself, and sn_request_admin is for administration.
32.What is the difference between audit sets and history sets?
Answer
- The History Set [sys_history_set] table identifies which particular records from an audited table have historical information. The History [sys_history_line] table stores the actual changes to field values that occurred.
The History Set [sys_history_set] table identifies the records from an audited table that have history, and the History [sys_history_line] table holds the individual field changes for each of them. The other options mix up what these tables hold.
33.In what order are ServiceNow Access Controls evaluated?
Answer
- table, field
Access controls are evaluated for the table first and then for the field. A user who fails the table rule can't access the record at all, so field rules are only checked after the table rule passes.
34.An application has a table named MyTable with three fields: field1, field2 and field3. MyTable.None has a READ access control for the admin and itil roles, and MyTable.field3 has a READ access control for the admin role only. Which fields can a user with the itil role read?
Answer
- field1, field2
The itil user passes the MyTable.None rule, so they can read the records. field3 has its own rule that only allows admin, so it stays hidden from itil, while field1 and field2 have no field rules restricting them. The user can therefore read field1 and field2.
35.Which of the following modules enables security rule debugging?
Answer
- System Security > Debugging > Debug Security Rules
Security rule debugging is turned on with the Debug Security Rules module under System Security > Debugging. It then shows which access controls were evaluated on each page and whether they passed.
36.Which one of the following database operations cannot be controlled with Application Access?
Answer
- Query
Application access has separate settings for whether other scopes can create, update and delete a table's records. Query is not one of the operations it controls.