How to pass the ServiceNow CAD exam in 2026
The Certified Application Developer exam tests scripting, security, scoped applications, and the development lifecycle on ServiceNow. This guide covers the Zurich domain weights, a 6-week study plan, and the scripting traps that catch experienced developers off guard.
What is CAD?
CAD stands for Certified Application Developer. It is ServiceNow's certification for people who build custom applications on the platform: writing business rules, client scripts, script includes, building scoped apps, managing security through ACLs, and working with the application lifecycle.
CSA (Certified System Administrator) is a prerequisite. You need CSA before you can register for CAD. That is because CAD assumes you already know platform fundamentals: tables, forms, lists, roles, update sets, and basic navigation. CAD builds on top of that with scripting, application security, and development best practices.
Where CSA asks "how do you configure the platform?", CAD asks "how do you build on it?" The questions require you to understand GlideRecord, GlideSystem, GlideAjax, client-server communication, and when to use each scripting pattern. If you have never written a business rule or client script, this exam will be hard.
For career positioning, CAD is the credential that separates administrators from developers. ServiceNow developer roles typically pay $110,000 to $145,000 depending on market and experience. The certification proves you can do more than configure out-of-the-box features.
Exam format and logistics
The CAD exam has approximately 60 questions. You get 90 minutes. The passing score is around 70%, though ServiceNow uses scaled scoring and does not publish the exact cutoff.
Questions are multiple-choice. Some have a single answer, others ask you to select two or three. The multi-select questions are where developers lose the most points because the platform has specific behaviors that differ from what a generic developer might expect. A JavaScript developer who has never worked on ServiceNow will get tripped up by scoping rules, GlideRecord behavior in scoped apps, and the difference between current and previous objects in business rules.
The exam runs on Pearson VUE. You can take it at a testing center or online with the OnVUE app. Online requires a webcam, a clear desk, and no second monitor.
All questions target the Zurich release. ServiceNow changes API behaviors and UI components between releases. If you studied from Xanadu documentation, some scripting answers will be wrong. Check the release selector on docs.servicenow.com before trusting a page.
The exam costs $450 for the first attempt. Retakes cost $225. There is no free first attempt for CAD.
Domain breakdown and weights
ServiceNow splits CAD into six domains. Three of them (Security, Working with Data, and Automating Applications) each carry 20% or more. Together with Managing Applications at 25%, those four domains account for 85% of the exam. The remaining 15% comes from User Experience and Design Concepts.
| Domain | What it covers | Weight |
|---|---|---|
| Managing Applications | Scoped applications, application scope isolation, update sets, Team Development, source control integration, application lifecycle, deployment | 25% |
| Security | ACLs (table, field, row level), roles, scripted ACL conditions, data policies, security properties, cross-scope access, script security | 20% |
| Working with Data | GlideRecord, GlideAggregate, GlideSystem, import sets, transform maps, data sources, reference fields, dot-walking, encoded queries | 20% |
| Automating Applications | Business rules, client scripts, UI policies, UI actions, script includes, Flow Designer, scheduled jobs, events, notifications, REST/SOAP APIs | 20% |
| User Experience | Service Portal, UI pages, UI macros, Jelly, Angular in Service Portal, widgets, CSS and HTML customization | 10% |
| Design Concepts | Application design patterns, prototyping, requirements gathering, platform capabilities assessment, when to build vs when to configure | 5% |
Managing Applications at 25% is the largest domain. Many developers focus on scripting and neglect this section. The questions test scoped application behavior: what happens when a script in one scope tries to access a table in another, how application files are tracked, and how the deployment pipeline works.
The three 20% domains (Security, Data, Automation) together account for 60% of the exam. If you are strong in scripting but weak on ACL evaluation order or scoped app security rules, you will lose points in two of those three domains simultaneously.
Design Concepts at 5% is too small to spend more than a few hours on. Read the material once and move on. The questions are conceptual and test common sense about when to build a custom app versus configuring existing features.
The CAD practice test on Udemy has 325 questions mapped to all six domains. Every question includes a per-option explanation with links to the official Zurich documentation. The course costs $9.99 with the referral link below.
A retake costs $225. Preparation costs less than a coffee.
Get the 325-question practice test ($9.99)6-week study plan
CAD requires more study time than CSA because the material is deeper. You need to understand not just what a feature does, but how it behaves under different scripting and security conditions. This plan assumes 8 to 10 hours per week.
If you passed CSA, you already know the basics. CAD goes deeper. Spend this week mastering GlideRecord: query(), get(), addQuery(), addEncodedQuery(), next(), getValue(), setValue(), insert(), update(), deleteRecord(). Practice writing GlideRecord scripts in background scripts on your PDI. Learn GlideSystem methods: gs.getUser(), gs.hasRole(), gs.addInfoMessage(), gs.log(). Understand the difference between current and previous objects in business rules.
This is core automation (20%). Study when each type runs: before vs after vs async vs display business rules. Build client scripts in your PDI: onChange, onLoad, onSubmit, onCellEdit. Understand the g_form API: getValue, setValue, setVisible, setMandatory, setReadOnly, addOption, clearOptions. Know the difference between a UI policy and a client script. Learn when to use script includes and GlideAjax for client-server communication. Build at least two working examples of each.
Security is 20% and the domain where experienced developers make the most mistakes. Study ACL evaluation order: how table, field, and row-level ACLs interact, what "requires role" does versus a script condition, and what happens when no ACL matches (default deny). Learn how security works in scoped applications: cross-scope access policies, application access settings, and the difference between "accessible from" and "caller access." Build a custom ACL in your PDI that restricts access to a table based on a user's department.
Managing Applications is 25% of the exam. Create a scoped application from scratch in your PDI. Add tables, forms, business rules, and ACLs inside the scope. Test what happens when you try to access global tables from within the scope. Study the application deployment process: how applications move between instances, the role of update sets versus application repository, and how Team Development handles conflicts. Understand source control integration concepts.
Cover Working with Data (20%): import sets, transform maps, coalesce fields, data sources, GlideAggregate for counts and sums. Then handle User Experience (10%): Service Portal basics, widget structure, Angular data binding in portal context. Wrap up Design Concepts (5%) in a single sitting. These three areas together fill the gaps left by the first four weeks.
Take at least two timed practice tests. 60 questions, 90 minutes, no pausing, no looking things up. After each test, review every wrong answer. Pay attention to which domain the wrong answers cluster in. If Security or Managing Applications scores below 75%, go back to those sections. Aim for 80%+ on practice tests to give yourself margin for exam-day stress.
Scripting patterns the exam tests
CAD assumes you can read and write ServiceNow JavaScript. The questions do not ask you to write code from scratch, but they show you code snippets and ask what the output will be, what the error is, or which alternative achieves the same result.
GlideRecord in scoped apps
In a scoped application, GlideRecord behavior changes. You cannot access tables from other scopes unless the application access settings allow it. The exam tests whether you know what happens when a scoped business rule tries to query a global table: does it fail silently, throw an error, or return an empty result set? (Answer: it depends on the cross-scope access policy for that table.)
current vs previous
In a business rule, "current" is the record being processed and "previous" is its state before the update. A common exam question shows a before-business-rule script that compares current.state to previous.state and asks when it fires. Know that "previous" is only populated on updates, not inserts. On an insert, previous fields are empty strings.
Client-side GlideRecord
GlideRecord calls from client scripts make synchronous server calls by default, which blocks the browser. The exam tests whether you know to use GlideAjax instead for asynchronous server lookups from the client side. If a question shows a client script using GlideRecord with a callback, understand that this is the asynchronous pattern and still has performance implications compared to GlideAjax through a script include.
Flow Designer vs workflow
ServiceNow is moving from legacy workflows to Flow Designer. The Zurich exam still tests both. Know the structural differences: Flow Designer uses actions and subflows, while legacy workflows use activities. Flow Designer supports IntegrationHub actions. The exam asks about triggers, conditions, and when Flow Designer is the right choice versus a business rule.
5 mistakes that fail developers
Treating CAD like a harder version of CSA. The exams test different skills. CSA is about configuring the platform. CAD is about building on it. Studying CSA material harder will not prepare you for CAD scripting questions. You need to write code in your PDI, not just read documentation.
Ignoring scoped application behavior. Managing Applications is 25% of the exam, the largest single domain. Developers who have only worked in the global scope get caught by questions about scope isolation, cross-scope access, and how application files are organized. Build a scoped app from scratch before exam day.
Memorizing GlideRecord methods without understanding execution context. The same GlideRecord call behaves differently in a before business rule, an after business rule, a scheduled job, and a scoped application. The exam tests whether you understand where your code runs and what it can access from that context.
Skipping ACL evaluation order. Many developers know how to create ACLs but cannot explain the evaluation sequence. The exam asks: if a table-level ACL grants access but a field-level ACL denies it, what happens? If no ACL exists for a table, what is the default behavior? If two ACLs match the same operation, which one wins? These are the questions where memorization fails and understanding succeeds.
Never building in a PDI. Reading about client scripts, business rules, and scoped apps is different from building them. The exam questions describe scenarios and ask "what happens next?" If you have built the scenario before, you know the answer from experience. If you have only read about it, you are guessing between two plausible options.
From CSA to CAD: what changes
If you passed CSA, you already understand the platform's structure. CAD adds three layers on top of that.
The first layer is scripting depth. CSA touches on client scripts and business rules at a surface level. CAD expects you to read code, predict output, identify bugs, and choose the right scripting approach for a given scenario.
The second layer is application architecture. CSA barely mentions scoped applications. CAD makes them 25% of the exam. You need to understand scope isolation, deployment pipelines, and how to structure an application that other developers can maintain.
The third layer is security from a developer perspective. CSA covers ACLs as a configuration topic. CAD tests ACLs as a scripting and architecture topic: when to use a scripted ACL condition versus a role-based one, how ACLs interact with scoped applications, and what security implications your code introduces.
The transition from CSA to CAD typically takes 6 to 8 weeks of focused study if you are actively developing on the platform. If your day job involves building business rules and client scripts, much of the CAD material will feel like formalizing what you already do. If your role is more admin-focused, expect to spend extra time on the scripting sections.
Try 15 free practice questions
The CAD course page has a 15-question free preview. Each question shows per-option explanations after you answer, with links to the relevant Zurich documentation. No email required, no paywall.
If you score above 75% on the free preview without studying, focus your remaining prep on Managing Applications (25%) and whichever 20% domain scored lowest. If you score below 50%, start from week 1 of the study plan above and give yourself the full six weeks.
For a broader view of where CAD fits in the ServiceNow certification ecosystem, see the certification decision guide and the 2026 landscape reference.
Where to go from here
The official reference is docs.servicenow.com, filtered to Zurich. Read the Application Development, Security, GlideRecord API, and Flow Designer sections. The API reference pages are dense but the exam pulls directly from them.
ServiceNow's Now Learning platform has a CAD learning path with labs. The labs are the most useful part because they put you in a real instance with guided exercises. If you do not have time for the full learning path, at least complete the labs.
For practice questions, the CAD practice test on Udemy has 325 questions with per-option explanations and Zurich source links. At $9.99, you are spending 4.4% of what a single retake costs.
The CAD exam costs $450. A retake costs $225. The entire 325-question practice test costs $9.99.
That covers all six domains with per-option explanations sourced from official Zurich documentation.
Get the 325-question practice test ($9.99)Get the certification roadmap
A one-page PDF showing every ServiceNow cert path, prerequisites, and recommended order. Free, no spam.