SCAIP Saviynt Certified Advanced IGA Professional (Level 200) Questions and Answers

Statement A is correct becauseRole Miningin Saviynt analyzes user access patterns and identifies relationships between users who share similar entitlements. These patterns are then used to logically group access into roles, enabling efficient role-based access control (RBAC) implementation and reducing manual effort in role creation.

Statement B is incorrect because apercentage cut-off (e.g., 60%)in role mining means that entitlements common to at least 60% of users are considered for role creation—not 100%. The statement incorrectly interprets how threshold-based mining works.

Statement C is correct since access toDuplicate Identity Management (DIM)features is controlled viaSAV Role configurations. Administrators must grant appropriate permissions within SAV roles to allow users to view and manage duplicate identities in the system.

Statement D is incorrect because DIM supports merging not only user attributes but also associated accounts and access depending on configuration. It is not limited to attributes alone.

Thus, the correct answers areA and C.

In Saviynt EIC REST connector configuration,ConnectionJSONis the central configuration block where all connection-level properties are defined. This includes not only the base URL, authentication details, and headers, but also critical operational parameters such asconnection timeout settingsandprovisioning limits (such as throttling or API limits).

Provisioning activities like account creation, update, and deletion rely on stable connectivity to the target system. Therefore, timeout configurations (for example, connection timeout and read timeout) are defined inConnectionJSONto ensure that API calls do not hang indefinitely and can fail gracefully if the target system is unresponsive. Similarly, provisioning limits—such as maximum records processed or API throttling controls—are configured at this level to manage performance and avoid overloading external systems.

OptionA (ConfigJSON)is not a standard JSON used in REST connector configurations. OptionB (MODIFYUSERDATAJSON)is used specifically for user update operations. OptionD (StatusthresholdConfig)relates to job/status handling rather than connection parameters.

Thus, ConnectionJSON is the correct place for configuring provisioning limits and timeout settings in Saviynt REST connectors.

In Saviynt EIC, approval assignment for access requests is primarily controlled throughworkflow configurations, which are associated either at theendpoint level or security system level. Therefore, the first step in troubleshooting incorrect approver assignment is to validate whether the correct workflow is attached and properly configured at both levels (Options A and C). Workflows define approval logic such as manager, owner, or custom approvers, and misconfiguration here often leads to incorrect routing.

Option B is also correct becausedelegation settingscan override the intended approver. If a delegate is configured for an approver, the request may be routed to the delegate instead of the original approver, causing confusion if not validated.

Option D is incorrect because in Saviynt, approvers are typicallysystem-driven based on workflow rules, not manually selected by the requester in most standard configurations. The requester does not usually control approver assignment unless explicitly customized, making this option irrelevant for standard troubleshooting.

In Saviynt–ServiceNow integration using theSaviynt App for ServiceNow, therequest fulfillment location is flexible and depends on how the integration is configured. This is why Option C is correct.

Saviynt supports different integration patterns with ServiceNow. In one model,ServiceNow acts as the front-end request system, while Saviynt handles the fulfillment (provisioning, approvals, and access governance). In another model, ServiceNow can handle certain fulfillment steps depending on how workflows, APIs, and ticketing configurations are defined.

For example, if the integration is configured such that ServiceNow creates a request and passes it to Saviynt, thenSaviynt performs fulfillment. Alternatively, if certain fulfillment logic or orchestration is handled within ServiceNow workflows or ITSM processes, thenServiceNow may drive parts of the fulfillment process.

This flexibility allows organizations to align the integration with their operational model, whether centralized in Saviynt or distributed with ServiceNow. Therefore, fulfillment is not restricted to a single system and is determined byconfiguration and architectural design choices.

Saviynt’sRole MiningandDuplicate Identity Management (DIM)features are key components of Identity Analytics and Governance.

Option Ais correct because Role Mining analyzes user access patterns and identifies similarities across users. Based on these similarities, Saviynt suggests logical groupings of entitlements that can be converted into roles, improving role design and governance.

Option Bis also correct. Thepercentage cut-offin Role Mining defines the threshold for common access across users. A higher threshold (e.g., 60% or more) ensures that only frequently shared entitlements are considered. In practice, this drives mining toward highly consistent access patterns, often close to universally assigned (near 100%), ensuring stronger role accuracy.

Option Cis correct because access to DIM functionality is controlled throughSAV Roles. Administrators must explicitly grant permissions to view and manage duplicate identities.

Option Dis incorrect because DIM not only merges identity attributes but can also consolidate associated access (accounts and entitlements), ensuring a unified identity profile.

In Saviynt REST connector configurations, data transformation and manipulation during import (reconciliation) are handled using special keywords or placeholders within JSON mappings. Among the given options,#VALUE#is the correct parameter used to manipulate and transform incoming data from the target application.

The#VALUE#keyword represents the actual value retrieved from the API response and allows administrators to apply transformations such as concatenation, conditional logic, or formatting before storing the data in Saviynt. It is commonly used within accountParams or entitlementParams mappings to ensure that incoming data aligns with Saviynt schema requirements.

OptionA (#nextApiKeyField#)is used for pagination handling in REST APIs, helping to fetch subsequent pages of data, not for manipulation. OptionC (#CHAR#)is not a valid or commonly used parameter in Saviynt REST connectors. OptionD (#CONST#)is used to assign constant/static values but does not manipulate incoming API data dynamically.

Therefore,#VALUE#is the correct parameter used for data manipulation during import in REST connector configurations.

In Saviynt EIC,Password Policy precedence and enforcementdepend on where the policy is configured within the hierarchy of Security System and Connector.

Option A is correct because when password policies are defined at both levels, theSecurity System-level policy takes precedence. This ensures centralized governance and consistency across all endpoints under that security system.

Option B is also correct since Saviynt allows administrators to control password change permissions at a granular level using the“Change Password Access Query”at the endpoint. This enables restriction of password changes based on user attributes or conditions.

Option C is incorrect because connector-level policies do not override security system-level configurations when both are present.

Option D is correct because if no policy is defined at the security system level, theconnector-level password policy will be applied by default, ensuring that password rules are still enforced.

Thus, the correct answers areA, B, and D, reflecting Saviynt’s hierarchical and flexible password policy framework.

In Saviynt EIC, password management includes configurable notification mechanisms to securely communicate password changes or resets to users. When aHelpdesk performs a password reset, the appropriate configuration to notify the user is through theReset Password notification under Password Policy.

Option C is correct because Saviynt provides a dedicatedReset Password notification templatewithin password policy configurations. This ensures that whenever a password is reset (either by user self-service or by Helpdesk), the system triggers the configured email template to notify the user. This template can include secure messaging and instructions related to the new password or next steps.

Option A is incorrect because the system does not automatically share passwords without proper configuration. Option B applies tochange password scenarios initiated by users, not Helpdesk resets. Option D is not recommended, as User Update Rules are not designed specifically for password notification workflows.

Thus, configuring theReset Password notification under password policyis the correct and secure approach.

In Saviynt EIC, retrieving reports such as users and their assigned SAV roles can be achieved through multiple analytics and reporting mechanisms. The correct approaches areOptions A, B, and C, all of which leverage SQL-based analytics capabilities.

Option Ais correct because Saviynt allows administrators to create analytics using SQL queries and schedule them. The“Send Email As Attachment”feature enables automated report delivery, making it useful for periodic reporting and compliance requirements.

Option Bis also valid, as analytics results can be exported directly into formats like CSV or Excel, allowing further analysis or sharing outside the platform.

Option Cis correct because theData Analyzertool enables administrators to run SQL queries directly on the Saviynt database to retrieve real-time data for reporting and troubleshooting purposes.

Option D (Using enhanced query)is not considered a standard or distinct reporting mechanism in Saviynt for this use case.

Together, these methods provide flexible reporting options, supporting both real-time access and scheduled report distribution within Saviynt.

In Saviynt EIC, automation of campaigns based on identity changes is typically achieved usingUser Update Rules. These rules monitor changes in user attributes (such as department, role, manager, or status) and can trigger predefined actions when conditions are met.

Option A is correct because aUser Update Rule can be configured to trigger a campaignwhen specific attribute changes are detected. This allows organizations to automatically initiate certification campaigns when critical identity attributes change, ensuring continuous compliance and governance without manual intervention.

Option B is incorrect because connection attributes are primarily used for provisioning and integration logic, not for triggering campaigns. Option C is partially valid in a general sense, but scheduled campaigns do not dynamically react to attribute changes—they run on predefined schedules regardless of changes. Option D is incorrect because Saviynt supports automation through rules.

Thus,User Update Rules provide an event-driven mechanismto launch campaigns based on real-time user attribute changes, making Option A the correct answer.

Saviynt EIC provides multiple flexible integration options with ServiceNow to support different business and operational use cases. Therefore,Option D (All of the above)is correct.

ServiceNow as a Managed Application (Option A)allows Saviynt to treat ServiceNow like any other application, enabling account provisioning, deprovisioning, and access governance directly within ServiceNow using REST connectors.

ServiceNow as a Request Form (Option B)enables organizations to leverage ServiceNow’s front-end portal for access requests. Users can initiate requests in ServiceNow, which are then processed and fulfilled by Saviynt, ensuring seamless user experience while maintaining governance.

ServiceNow as a Ticketing System (ITSM) (Option C)is another key integration pattern where Saviynt generates tickets (incidents, requests, or tasks) in ServiceNow for approval workflows, provisioning actions, or tracking purposes. This ensures alignment with enterprise ITSM processes.

These multiple integration models provide flexibility, allowing organizations to choose the approach that best fits their operational and governance requirements.

In Saviynt EIC, theSOD (Segregation of Duties) Risk Evaluation Jobis used to identify conflicts in user access that violate defined SOD policies. To efficiently analyze and review these violations, Saviynt provides several filtering options.

Users (A)is a valid filter that allows administrators to view SOD violations specific to individual users or a group of users. This is helpful for targeted investigations or audits.

Security System (B)is also a valid filter, enabling administrators to narrow down violations based on specific applications or systems. This is useful when analyzing risks within a particular application landscape.

Ruleset (C)is another important filter, as SOD violations are evaluated based on predefined rule sets. Administrators can filter results based on specific rulesets to understand which policies are being violated.

Option D (User Account Evaluation) is not a standard filter in the SOD Risk Evaluation Job. It is more related to job execution scope rather than filtering results.

Thus, the correct answers areUsers, Security System, and Ruleset, which are the primary filters for analyzing SOD violations.

In Saviynt EIC’sDuplicate Identity Management (DIM), Global Configurations provide filtering mechanisms to identify potential duplicate identities efficiently. The two primary matching strategies used areCoarse MatchingandFine Matching, which together form the backbone of duplicate detection logic.

Coarse Matching (A)is used as an initial filtering mechanism. It applies broader criteria such as matching on common attributes like first name, last name, or email domain to quickly identify a pool of potential duplicate identities. This helps in reducing the dataset size before applying more detailed checks.

Fine Matching (C)is a more refined and precise comparison that evaluates stricter conditions such as exact matches on email ID, employee ID, or other unique identifiers. This step ensures higher accuracy in identifying true duplicates from the coarse match results.

Option B (Identity Matching) is not a standard configurable filter in DIM Global Configuration, and Option D (Merger Query) relates to post-identification actions rather than filtering criteria.

Thus, the correct answers areCoarse Matching and Fine Matching, which together enable effective duplicate identity detection.

In Saviynt EIC,Duplicate Identity Management (DIM)supports multiple mechanisms to detect duplicate identities across the identity lifecycle, makingOption D (All of the above)the correct answer.

Firstly, duplicate identities can be detectedduring user import (Option A)when data is ingested from authoritative sources like HR systems. Saviynt can apply matching rules and prevent or flag duplicates at the ingestion stage. Secondly, duplicates can be identified by executing theDuplicate Identity Detection Job (Option B), which is a detective control that scans existing identities in the repository and identifies potential duplicates based on configured correlation rules such as email, username, or employee ID.

Additionally, duplicates may also be identifiedduring manual updates in the Identity Repository (Option C)when administrators modify user attributes. If updated values match existing identities based on defined criteria, Saviynt can flag potential duplicates.

These multiple detection points ensure both proactive and reactive duplicate management, helping maintain identity data accuracy and preventing access risks associated with duplicate identities.

In Saviynt EIC REST connector configuration,ImportAccountEntJSONis used to define how account and entitlement data are imported (reconciled) from a target system. This JSON structure includes several predefined and supported parameters that control how accounts, entitlements, and their ownership relationships are processed.

accountParams (Option C)is a valid parameter and is used to map account-level attributes such as account name, status, and identifiers.entitlementParams (Option B)is also valid and defines how entitlement data (groups, roles, permissions) are fetched and mapped.accountOwnerParams (Option A)is another valid parameter used to define account ownership mapping, helping assign owners to accounts during reconciliation.

However,entOwnerParams (Option D)is NOT a valid parameter in the ImportAccountEntJSON structure. The correct naming convention for entitlement ownership (if applicable) does not use "entOwnerParams" in Saviynt REST connector configuration. Saviynt follows strict parameter naming standards, and incorrect parameter names will not be recognized or processed by the connector.

Thus, Option D is the correct answer, as it represents an invalid configuration parameter in the context of ImportAccountEntJSON.