When evaluating Access Controls, ServiceNow searches and evaluates:
From the most specific match to the most generic match. This is the correct answer because ServiceNow follows a top-down approach when evaluating Access Control (ACL) rules, which are used to restrict the access to the data and functionality of the ServiceNow platform based on the user's roles and conditions. ServiceNow starts with the most specific match, which is the field-level ACL rule, then moves to the table-level ACL rule, and finally to the global or * ACL rule. ServiceNow grants access if any of the ACL rules evaluates to true, and denies access if all of the ACL rules evaluate to false.
The following are not correct descriptions of how ServiceNow searches and evaluates Access Controls:
Only for matches on the current table. This is not correct because ServiceNow does not only look for matches on the current table, but also on the parent tables and the global or * table. For example, if there is no ACL rule for the incident table, ServiceNow will look for an ACL rule for the task table, which is the parent table of the incident table, and then for the global or * table, which is the parent table of all tables.
Only for matches on the current field. This is not correct because ServiceNow does not only look for matches on the current field, but also on the table that contains the field and the global or * table. For example, if there is no ACL rule for the short_description field on the incident table, ServiceNow will look for an ACL rule for the incident table, and then for the global or * table.
From the most generic match to the most specific match. This is not correct because ServiceNow does not follow a bottom-up approach when evaluating Access Controls, but a top-down approach, as explained above. Reference: Access Control Rules, ACL Evaluation Order
https://developer.servicenow.com/dev.do#!/learn/learning-plans/paris/new_to_servicenow/app_store_learnv2_securingapps_paris_access_controls_evaluation_order

When creating a table in a privately-scoped application, four Access Controls are automatically created for the table. These Access Controls define the permissions for the four basic operations on the table: Create, Delete, Read, and Write. The Create operation allows the user to create new records on the table. The Delete operation allows the user to delete existing records on the table. The Read operation allows the user to view the records on the table. The Write operation allows the user to modify the records on the table. By default, these Access Controls grant access to the admin role and the application scope. You can modify or delete these Access Controls as needed.
The other options are not valid Access Controls for a table. Insert, Query, and Update are not operations, but methods of the GlideRecord class that are used to manipulate records on the server-side. They are not part of the Access Control rules.
Reference:
[Access Control rules]
Create a table in a scoped application
[GlideRecord methods]

Business Rule is server-side, so it uses GlideSystem API. gs.hasRoleExactly doesn't exist

https://developer.servicenow.com/dev.do#!/learn/learning-plans/tokyo/new_to_servicenow/app_store_learnv2_a