ServiceNow Certified Application Developer (CAD) Practice Exam

What the ServiceNow Certified Application Developer (CAD) exam covers

• Application Design and Development Concepts64 questions
• Security and Restricting Access164 questions
• Application User Experience100 questions
• Working with Data in ServiceNow164 questions
• Automating Applications for Collaboration and Productivity164 questions
• Managing Applications184 questions

Free CAD practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 840.

1. Question 1Automating Applications for Collaboration and Productivity

   A developer needs to auto-populate the Short Description field with a formatted value derived from other fields on the same record before the record is written to the database. Which Business Rule type should run this logic?

   • ABeforeCorrect
   • BAfter
   • CAsync
   • DDisplay
   ✓ Correct answer: A

   The correct choice is a before Business Rule because it executes on the server after form submission but before the database write is committed, so any changes it makes to current fields are saved as part of that same transaction with no second write needed. This timing is the platform's mechanism for computed or formatted values that must exist in the row as it is saved, which is exactly what deriving a formatted Short Description from other fields requires. Whenever a rule needs to alter current before the row hits the database, before is the type to reach for.

   Why the other options are wrong

   • BAn after Business Rule runs once the record already has a sys_id and has been committed to the database, so making this same change there would require an explicit second update call rather than modifying the record being saved.
   • CAn async Business Rule queues its logic to run on a separate background thread and is not guaranteed to finish before the user sees the record, so it cannot reliably format a field before the save completes.
   • DA display Business Rule runs before the form renders and writes only to g_scratchpad for the client; it never alters the record actually being written to the database.
2. Question 2Automating Applications for Collaboration and Productivity

   A developer wants to build reusable automation logic that accepts input values, runs through a sequence of steps and flow logic, and returns output values, but must never be triggered directly by a record event and can only be invoked as a step from within another flow. Which Flow Designer artifact should the developer create?

   • ASubflowCorrect
   • BAction
   • CFlow
   • DScheduled Job
   ✓ Correct answer: A

   A Subflow is correct because it is reusable, defines its own inputs and outputs, supports flow logic such as branching and loops, and is invoked only as a step from within a parent flow, never triggered directly by a record event. The key concept is that Subflows are built like flows internally but deliberately omit a trigger of their own, which is exactly what makes them callable from anywhere rather than firing independently. The requirement explicitly rules out direct record-event triggering and calls for multi-step logic with its own input/output contract, which matches a Subflow precisely and rules out a Flow, which requires its own trigger. Takeaway: a Subflow is a triggerless, multi-step, callable unit meant to be invoked from a parent flow.

   Why the other options are wrong

   • BAn Action is a single reusable operation and is not designed to host multi-step flow logic such as branching and loops on its own.
   • CA Flow requires its own trigger and is fired directly by that trigger, not something another flow calls as a step.
   • DThere is no Flow Designer artifact called a Scheduled Job; scheduling is a trigger type, not a callable reusable unit.
3. Question 3Working with Data in ServiceNow

   Within a single addQuery/addOrCondition chain, which statement is true?

   • AIt ORs across every condition in the entire query, regardless of chaining
   • BIt replaces the addQuery condition it is chained from
   • CIt ORs an extra condition into the same addQuery group it was chained fromCorrect
   • DIt only supports the equals operator
   ✓ Correct answer: C

   AddOrCondition adds an alternative condition that is ORed specifically within the group formed by the addQuery call it is chained onto; any other, separately added addQuery calls remain ANDed with that whole group rather than being pulled into the OR. Remember: grouping in GlideRecord queries is determined entirely by chaining position.

   Why the other options are wrong

   • AThe OR effect stays local to the group formed by the addQuery it is chained onto; it does not spread across the entire query.
   • BaddOrCondition adds an alternative condition alongside the original; it does not remove or replace the addQuery it is chained from.
   • DaddOrCondition accepts the same range of operators as addQuery, including '!=', '>', and CONTAINS, not only equals.
4. Question 4Working with Data in ServiceNowSelect all that apply

   Which TWO of the following are file formats natively supported by a Data Source without any custom parsing script? (Choose TWO)

   • ACSVCorrect
   • BA Business Rule log export
   • CAn ATF test result
   • DExcel (XLSX)Correct
   • EA GlideAggregate result set
   ✓ Correct answer: A, D

   CSV and Excel, alongside XML, JSON, and JDBC, are the built-in Data Source types ServiceNow ships with; the platform already knows how to split rows and columns from these formats into a staging table the moment a Data Source is created and pointed at a file, with no custom parsing script required from the developer. This matters practically because it means a developer configuring a new import for a spreadsheet or comma-separated file can rely entirely on standard configuration fields, such as Header Row or Sheet Number, rather than writing code to read the file.

   Why the other options are wrong

   • BThere is no such thing as a Business Rule log export format; Business Rule execution logs are not a Data Source input type.
   • CATF automated test results are not a supported Data Source input format; ATF is a testing framework, unrelated to import sets.
   • EA GlideAggregate result set is an in-script construct produced by a query, not a file format a Data Source can read as input.
5. Question 5Application Design and Development ConceptsSelect all that apply

   Which TWO statements correctly describe cross-scope access controls in ServiceNow? (Choose TWO)

   • AA Cross-scope Privilege can grant one app access to another scope's artifactCorrect
   • BAccessible from all scopes alone guarantees write access everywhere
   • CCross-scope Privileges are only needed for Public artifacts
   • DGlobal scope needs a privilege to reach any scoped table
   • EProtection policy decides read/invoke versus modify accessCorrect
   ✓ Correct answer: A, E

   Two statements correctly describe cross-scope access: a Cross-scope Privilege record can grant one application explicit access to another scope's artifact when default protection would otherwise block it, and protection policy is what decides whether that access, once granted or already open, is read/invoke only or also allows modification, spanning Public, Protected, and Private. These two mechanisms work together, Accessible from and Cross-scope Privilege records open the door for specific applications, while the protection policy defines how far that access extends. Privilege opens access; protection policy shapes what that access allows.

   Why the other options are wrong

   • BAccessible from all application scopes only enables reachability; it does not by itself guarantee write access, which still depends on protection policy.
   • CCross-scope Privilege records are most useful for Protected and Private artifacts that would otherwise be blocked; Public artifacts are already open by default and rarely need one.
   • DGlobal scope has broad reach by default and is not governed the same restrictive way as scope-to-scope access between two custom applications.
6. Question 6Managing Applications

   An administrator on a target instance wants to add a custom scoped application that another team already published internally. Where should they look?

   • ASystem Applications, to install the app from the Application RepositoryCorrect
   • BSystem Update Sets, under Retrieved Update Sets, to import the application's changes
   • CStudio's Source Control menu, to pull the application from its Git repository
   • DThe instance's system logs, to search for the application's installation record
   ✓ Correct answer: A

   The correct path is System Applications, since that module is where an instance browses the Application Repository and installs apps that another team has already published for org-wide use. The Application Repository exists specifically to let one team publish a finished application so any other instance in the organization can pull it down and install it, which is exactly the situation described. Remember that publish-to-repository, install-from-System-Applications is the standard internal distribution flow.

   Why the other options are wrong

   • BRetrieved Update Sets import a batch of individual configuration changes captured on another instance, not a whole packaged application pulled from the internal repository.
   • CStudio's Source Control menu links the app to an external Git host for version history; it does not list or install apps published to the internal Application Repository.
   • DSystem logs only record platform events and errors; they have no install action and are not where published applications are found.
7. Question 7Managing Applications

   Where would a developer configure a Test Suite to automatically run every Sunday at 2 AM?

   • AIn the Update Set properties
   • BIn the Test Suite's scheduled run configurationCorrect
   • CIn the Application Files explorer in Studio
   • DIn the Business Rule condition builder
   ✓ Correct answer: B

   The scheduling settings live directly on the Test Suite itself, where a developer defines the recurrence, such as weekly on Sunday at a specific time, along with other run parameters like which user context to run under. Whenever a scenario asks 'where' to schedule a recurring test run, it points to this Suite-level scheduling configuration.

   Why the other options are wrong

   • AUpdate Set properties control what configuration is captured, they have no scheduling function for test runs.
   • CThe Application Files explorer in Studio lists an application's artifacts, it does not schedule anything.
   • DThe Business Rule condition builder determines when a Business Rule fires on a record, it is unrelated to Test Suite scheduling.
8. Question 8Security and Restricting AccessSelect all that apply

   A single table-level read ACL exists on x_acme_project with no field specified. A separate field-level ACL exists on x_acme_project.budget for operation read, requiring the x_acme_finance role. A user without x_acme_finance, but who passes the table-level read ACL, opens a project record. Which two statements about this scenario are correct? (Choose TWO)

   • AThe record fails to load entirely because the two ACLs conflict with each other
   • BThe budget field is hidden or blanked for this user because the more specific field-level ACL governs that fieldCorrect
   • CThe field-level ACL is ignored since a table-level read ACL already exists on the table
   • DAll fields other than budget remain governed by the table-level read ACL the user already passedCorrect
   • EThe user sees budget normally because the table-level ACL already grants access to the whole record
   ✓ Correct answer: B, D

   The field-level read ACL on x_acme_project.budget is more specific than the plain table-level read ACL, so it takes over governing that one column specifically - since this user lacks x_acme_finance, the budget field is hidden or blanked for them. Every other field on the record is not covered by any more specific ACL, so those fields remain governed by the table-level read ACL the user already passed.

   Why the other options are wrong

   • ATwo ACLs matching the same record at different specificities do not cause it to fail to load; the more specific one simply applies to its own field.
   • CA field-level ACL is never disabled just because a table-level ACL already exists on the same table; it takes precedence for its own field regardless.
   • EPassing the table-level ACL is not sufficient for a field that has its own separate, unsatisfied field-level ACL; specificity wins for that column.
9. Question 9Security and Restricting Access

   A developer calls gs.getUser() inside a Business Rule. What type of object does this return?

   • AA GlideRecord for sys_user
   • BA plain sys_id string
   • CA GlideAggregate of user counts
   • DA GlideUser object for the session userCorrect
   ✓ Correct answer: D

   Gs.getUser() returns a GlideUser object exposing convenience methods such as getID(), getName(), and hasRole() for the currently logged-in user, distinct from a raw sys_user GlideRecord or a plain sys_id string. The concept tested is recognizing GlideUser as its own API surface layered on top of, but separate from, the session user's underlying record. Takeaway: use gs.getUser() when convenience methods are needed, and query sys_user directly only when the full record itself is required.

   Why the other options are wrong

   • AA raw sys_user GlideRecord would need to be queried separately using new GlideRecord('sys_user').
   • BA plain string is returned by gs.getUserID(), not gs.getUser().
   • CGlideAggregate is used for aggregate queries like counts and sums, unrelated to session user information.
10. Question 10Application User Experience

    On the Service Catalog, a developer needs the Business Justification variable to become mandatory when Request Type equals Exception. Which tool applies here?

    • AA Catalog UI Policy onlyCorrect
    • BA regular table UI Policy
    • CA Client Script on sc_task
    • DA Data Policy on Requested Item
    ✓ Correct answer: A

    A Catalog UI Policy is correct because Business Justification and Request Type are catalog variables defined on the catalog item, not dictionary fields on a table, and only a Catalog UI Policy's condition builder can evaluate variable values and apply an action like Mandatory to another variable. The key concept is that catalog variables and table dictionary fields are governed by two parallel but distinct mechanisms, regular UI Policies for tables and Catalog UI Policies for catalog forms, and picking the wrong one simply will not find the fields to configure. This fits the scenario because the entire interaction happens on the request form the requester fills out before an item is even created, which is catalog territory. Remember: variables call for a Catalog UI Policy, dictionary fields call for a regular one.

    Why the other options are wrong

    • BA regular table UI Policy targets dictionary fields; it cannot see or evaluate catalog variables like Business Justification.
    • Csc_task is the fulfillment task created after approval, not the catalog request form the requester actually fills out.
    • DData Policies enforce rules on table records server-side; they do not govern catalog variable behavior on a request form.

Who this ServiceNow Certified Application Developer (CAD) practice exam is for

This practice set is for anyone preparing for the ServiceNow Certified Application Developer (CAD) exam at the intermediate level - from first-time candidates building a foundation to experienced ServiceNow practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this ServiceNow Certified Application Developer (CAD) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real ServiceNow Certified Application Developer (CAD) exam.

Related ServiceNow resources

• ServiceNow Certified Application Developer (CAD) study guideKey concepts
• ServiceNow practice examsAll ServiceNow
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• ServiceNow Certified System Administrator (CSA) practice examRelated

ServiceNow Certified Application Developer (CAD) practice exam FAQ