ServiceNow Quiz on ACL Decision Types

Access Control Lists (ACLs) are fundamental to securing data. This question focuses on identifying the two decision types used in ACL rules and understanding how they control access.

---

❓ Quiz Question

Access Control List (ACL) rules allow you to specify the decision type, rule type, and operation that defines them.
What are the two decision types in ACL rules?

👉 Select 2 answers from the options below.

---

✅ Correct Answers

✔ Allow If
✔ Deny Unless

---

❌ Incorrect Options

• Deny Always

• Allow Once

• Restrict Access

---

🔍 Detailed Explanation

ACL rules define how and when access is granted or denied to secured objects. The decision type determines how the system interprets conditions in the rule.

There are exactly two decision types.

---

✔️ The Two ACL Decision Types

🟢 Allow If

• Grants access only if all conditions are met

• Commonly used to explicitly permit access

• Evaluated after deny rules

📌 Think of it as: “Allow access if this rule matches.”

---

🔴 Deny Unless

• Denies access unless all conditions are met

• Evaluated before Allow If rules

• Takes priority during ACL evaluation

📌 Think of it as: “Deny access unless this rule matches.”

---

⚠️ Important Evaluation Rule

Deny-Unless ACLs are evaluated before Allow-If ACLs.

This ensures that restrictive rules override permissive ones when conflicts exist.

---

❌ Why the Other Options Are Incorrect

🚫 Deny Always

• Not a valid ACL decision type

---

🚫 Allow Once

• Not a recognized access control behavior

---

🚫 Restrict Access

• A generic phrase, not an ACL decision type

---

🧠 Overall Explanation Summary

• ACLs use decision types to control access logic

• Only two decision types exist:

  • Allow If

  • Deny Unless

• Deny-Unless rules take priority

• Other options are distractors

---

🏁 Final Thoughts

For exams, remember:

If the question asks for ACL decision types, the answer is always “Allow If” and “Deny Unless.”

Nothing else qualifies.