ServiceNow Certified Application Developer (CAD)

Last checked October 22, 2026 against the official ServiceNow exam page.

1. Question 1Security and Restricting Access

   A sensitive field on a table must be readable only by users with the security_admin role. Which mechanism enforces this at the platform level?

   1. AA table-level read ACL that grants the security_admin role and denies all other users
   2. BA field-level read ACL on the sensitive field, which requires the security_admin role
   3. CA data policy that displays a warning on the form whenever a non-admin user opens the record
   4. DA client script that hides the field from users who do not hold the security_admin role
   Show answer and explanationHide answer

   Correct answer: D

   A field-level read ACL enforces the restriction on the server for that specific field, so it applies to every access path. A table-level ACL controls the whole record, not one field. A client script can be bypassed through the API, and a data policy warns but does not restrict.

2. Question 2Designing and Creating an Application

   A developer must add a custom triage field to the Incident table so that it appears on the incident form in the Now Experience UI. Which approach is correct?

   1. ACreate a new table that extends Incident for every form, and move all incidents into it
   2. BCreate a field in the Incident table dictionary, then add it to the incident form layout
   3. CAdd the field to the Task table only, so that it is inherited without any form changes
   4. DCreate an HTML snippet that displays the field value and paste it into each incident form
   Show answer and explanationHide answer

   Correct answer: B

   Adding the field to the table dictionary creates the data element, and placing it on the form layout makes it visible to users. Creating a new table for every form moves records and breaks the standard model. Adding a field to Task does not place it on the incident form without a layout change, and an HTML snippet displays nothing in the data model.

3. Question 3Application Automation

   A business rule must set the assignment group whenever the priority of an incident changes to 1. Which business rule timing and trigger fit best?

   1. AA client-side script on the form that runs when the user clicks the save button
   2. BA before business rule on update, with a condition that checks the priority change
   3. CA UI action button that the agent must click whenever a priority 1 incident arrives
   4. DA scheduled job that runs every hour and checks all incidents for priority 1
   Show answer and explanationHide answer

   Correct answer: B

   A before business rule on update runs on the server before the record is written, so the assignment group is set in the same transaction and cannot be skipped by the user. A client script can be bypassed, and an hourly job or a manual button delays the change and depends on people.

4. Question 4Application User Interface

   Members of a support group need the default list of active incidents assigned to their group, saved so that everyone in the group sees it. Which configuration fits?

   1. AA read-only section on the incident form that displays the group's open incidents
   2. BA client script that deletes inactive incidents from the list each time it is opened
   3. CA shared list filter or saved filter on the incident list, made available to the group
   4. DAn update set that removes closed incidents from the table in the production instance
   Show answer and explanationHide answer

   Correct answer: C

   A saved filter shared with the group gives every member the same default view of active incidents assigned to their group. A read-only section shows one record, not a list. Client scripts that delete records are unsafe, and update sets move configuration rather than filter a list.

5. Question 5Working with External Data

   A team receives a CSV file of vendor records each week and must load it into a ServiceNow table, with values mapped to the correct fields. Which feature does this?

   1. AAn ACL, which restricts which users can read or write the vendor table
   2. BA UI policy, which changes field visibility and mandatory status on the form
   3. CA service catalog variable set, which collects values from users through a request form
   4. DImport set and transform map, which stage the file and map its columns to target fields
   Show answer and explanationHide answer

   Correct answer: D

   An import set stages the CSV rows, and a transform map maps the source columns to target fields and fields to the destination table. UI policies, variable sets and ACLs do not load data from files.