CSA exam Question Clarification

[sme4hire]

Im seeing this type of question on multiple study guides. I have looked into the eBooks and found discrepancies between them and my own PDI and other sources. 

The question:  

An administrator creates “customer_table_admin” and “customer_table_user” roles for the newly created "Customer Table”. Which ACL rule would grant access to all rows and all fields to both the customer_table_admin and customer_table_user roles?

A. customer.none

B. customer.all

C. customer.field

D. customer.*

My first selection was A: Customer.none based on my understanding of this during the RiseUp program and the differences between Customer.* and Customer.none. My understanding of these:

customer.* → grants access to all fields.

If the exam is asking for “all rows and all fields” in one rule, that’s a trick:

No single ACL covers both rows and fields at once.

In practice, you’d need both customer.None (for table-level) and customer.* (for all fields).

What I have noticed

If the wording is “all rows and all fields”, the safest exam answer is: customer.none

(because table-level ACL is what controls row-level record access, which is the foundation). 

The issue: when I research this further, people are suggesting the exact opposite so I am unclear. Any support and validation (proof) would be helpful. Semper Fi.

[GlideFather]

Hi @sme4hire 

correct answer is:

A. customer.none 

because customer.field gives access to that particular field (e.g. Number) and customer.* is a wild card that gives the access to ALL THE FIELDS THAT ARE NOT EXPLICITLY DEFINED (e.g. all except of number because it has the customer.number)

and customer.all doesn’t exist (unless there is a field called “All”) 😉

[GlideFather]

https://www.servicenow.com/docs/pt-BR/bundle/zurich-platform-security/page/administer/contextual-sec...

[Dr Atul G- LNG]

Hi @sme4hire 

Customer.none is right, which means full table access.

[Uncle Rob]

This is why studying from study guides and eBooks is the lowest value method.
You would have learned a lot more (and remember FAR longer) simply testing it in a PDI.