Pass CSA Exam Guide

In ServiceNow,Access Control Rules (ACLs)determine who cancreate, read, write, delete, or executerecords within a table. Each ACL rule evaluates three main permission requirements,all of which must be truefor the rule to apply. These requirements are:

TheConditions fieldin an ACL specifies predefined logic that must be met for the rule to apply.

Example: An ACL might specify that a record is only accessible if theStatefield is set to "Open".

Conditions areevaluated firstbefore checking roles or scripts.

ACLs can berestricted to users with specific roles.

If a user does not have the required role(s), the ACL denies access.

Example: Only users with the"itil"role can edit incidents.

If the ACL does not specify any role, all users may be eligible based on conditions and script evaluations.

ACL scripts provideadvanced conditional logicusingserver-side JavaScript.

Scripts allow complex rule evaluation, such as checking whether a user is the record’s creator.

Example: A script could restrict access to records wherecurrent.requested_for == gs.getUserID()(only allow users to see their own requests).

If a script is present in an ACL, it must returntruefor access to be granted.

Access control rules are only granted when all three evaluations return true.

Conditions act asfilters.

Roles definepermissions based on user roles.

Scripts allowadvanced access logic.

1. Conditions (A - Correct Answer)2. Roles (C - Correct Answer)3. Script (D - Correct Answer)Why "A. Conditions," "C. Roles," and "D. Script" are the Correct Answers?

B. Table – Incorrect

Access control appliesto specific tables, but defining a table itself is not one of the permission checks.

E. Table." – Incorrect

This is anincorrectly formatted optionand does not relate to access control evaluation.

F. Table.none – Incorrect

"Table.none" is not an evaluation factor in ACLs. Access control applies totable-level, field-level, and record-level, but "table.none" is not an access requirement.

Explanation of Incorrect Options:

ServiceNow Docs: Access Control Rules (ACLs) Overview

ServiceNow CSA Study Guide – Security and Access Control

ServiceNow Product Documentation: Evaluating ACLs and Permissions

References from Certified System Administrator (CSA) Documentation:

If a user reports that theycannot see certain modulesin theApplication Navigator, the best way to troubleshoot is toimpersonate the user. Impersonation allows an administrator to see exactly what the user seeswithout needing their password.

Click on your profile icon (top-right corner).

SelectImpersonate User.

Search for and select theuser’s name.

The instance will reload, and you will see the UI as the user experiences it.

Navigate to theApplication Navigatorand check for missing modules.

Once done, clickStop Impersonation.

Ensures security(no need to reset or look up passwords).

Speeds up troubleshootingby allowing admins to replicate user issues.

Helps verify role-based access permissions.

Steps to Impersonate a User in ServiceNow:Why is Impersonation Useful?

Incorrect Answer Choices Explanation:A. Look up their password, so you can login with their account

This is asecurity violationand not an acceptable practice.

B. Initiate a Connect Chat session

Chatting with the user can help gather information, but it does not allow you to see what they see.

C. Install the Bomgar plug-in

Bomgaris a remote support tool, but impersonation is thebuilt-inand recommended method for troubleshooting in ServiceNow.

E. Launch a NowChat window

NowChat is used forcustomer support and collaboration, not for verifying module visibility.

Impersonate Users in ServiceNow

User Roles and Permissions

Official CSA Documentation Reference:

InServiceNow, you can add additional fields to a form using either:

Form Layout(for quick field additions)

Form Designer(for a drag-and-drop UI approach)

Context Menu > Configure > Form Layout (B)

This allows administrators toadd or remove fieldsin a simplelist-based interface.

Used when only minor modifications are needed.

Context Menu > Configure > Form Design (C)

Opens theForm Designer, adrag-and-drop UI editorfor configuring forms.

Allows users torearrange fields, sections, and tabseasily.

A. Context Menu > Form > Layout(Incorrect)

The correct path isConfigure > Form Layout, not "Form > Layout."

D. Right-click on header > Add > Field(Incorrect)

Right-clicking the form headerdoes not provide an option to add fields directly.

E. Context Menu > Form > Designer(Incorrect)

The correct option isConfigure > Form Design, not "Form > Designer."

F. Right-click on header > Configure > UX Dashboard(Incorrect)

UX Dashboards areused for analytics and reporting, not form configuration.

Form Layout in

Form Designer

Correct Methods:Explanation of Incorrect Options:Official References from Certified System Administrator (CSA) Documentation:

AnUpdate Setin ServiceNow is a mechanism used tocapture configuration changes(such as UI policies, business rules, client scripts, and more) from one instance and move them to another. This ensures that customizations and modifications can be transferred across different ServiceNow instances efficiently.

The process ofretrieving an Update Setfrom another instance follows these key steps:

Verify Update Set is Complete

Before moving an Update Set, it must be marked asCompleteto ensure that all related changes are included.

Navigate toSystem Update Sets > Local Update Setsand confirm that the status is set toComplete.

If the status isIn Progress, the Update Set cannot be retrieved.

Retrieve Update Set

In thetarget instance, navigate toSystem Update Sets > Retrieved Update Sets.

Click"Retrieve Update Set"and provide the remote instance’s URL where the update set exists.

The system will fetch the Update Set from the source instance.

Preview Update Set

Before applying changes, ServiceNow provides apreview optionto check for potential errors or collisions with existing customizations.

Click"Preview Update Set"to initiate validation.

The preview will highlight any skipped records, collisions, or missing dependencies.

Commit Update Set

If the preview is successful (i.e., no critical errors), click"Commit Update Set"to apply the changes to the instance.

Once committed, the changes in the Update Set will be merged into the system's configuration.

"Commit" is the correct final step– after previewing, the Update Set must becommittedto take effect.

"Apply" is incorrect– ServiceNow does not use "Apply" in the Update Set process; instead, it uses "Commit."

"Test Connection" is not part of the Update Set retrieval process– it is relevant forMID Server connectivitybut not for Update Sets.

Why the Correct Answer is "D. Verify Update Set is Complete, Retrieve, Preview, Commit"Thus, the correct sequence is:

✔Verify Update Set is Complete → Retrieve → Preview → Commit

ServiceNow CSA Official Documentation– Update Set Management

ServiceNow Docs - Update Sets(Search for "Update Set Lifecycle")

ServiceNow Community Best Practices on Update Sets

ServiceNow Community(Search for "Best Practices for Update Sets")

ServiceNow Learning Portal - Admin Fundamentals

Available via ServiceNow Now Learning Platform(Look under "Instance Configuration" and "Update Sets")

References from Certified System Administrator (CSA) Documentation: