SCAIP Saviynt Certified Advanced IGA Professional (Level 200) Questions and Answers

In Saviynt EIC,Duplicate Identity Management (DIM)supports multiple mechanisms to detect duplicate identities across the identity lifecycle, makingOption D (All of the above)the correct answer.

Firstly, duplicate identities can be detectedduring user import (Option A)when data is ingested from authoritative sources like HR systems. Saviynt can apply matching rules and prevent or flag duplicates at the ingestion stage. Secondly, duplicates can be identified by executing theDuplicate Identity Detection Job (Option B), which is a detective control that scans existing identities in the repository and identifies potential duplicates based on configured correlation rules such as email, username, or employee ID.

Additionally, duplicates may also be identifiedduring manual updates in the Identity Repository (Option C)when administrators modify user attributes. If updated values match existing identities based on defined criteria, Saviynt can flag potential duplicates.

These multiple detection points ensure both proactive and reactive duplicate management, helping maintain identity data accuracy and preventing access risks associated with duplicate identities.

In Saviynt EIC, theservice account name generationis controlled through configuration-driven mechanisms to ensure consistency, automation, and compliance with naming standards.

Option A is correct because administrators can define naming conventions at theEndpoint level using the Service Account Name Rule. This allows dynamic generation of account names based on attributes such as application name, environment, or other identifiers, ensuring standardized naming across systems.

Option D is also correct since in many connector-based integrations, theCreate Account JSONconfiguration plays a role in provisioning. The account name can be derived or constructed within this JSON payload based on defined mappings and logic, especially for REST or custom connectors.

Option B is incorrect because service account creation in Saviynt is typically controlled and standardized; manual entry of account names is generally restricted or governed to avoid inconsistencies. Option C is incorrect because Global Configurations do not directly define service account naming rules in standard implementations.

Thus, the correct answers areEndpoint-based naming rules and Connection-level JSON configuration, ensuring automated and consistent service account naming.

In Saviynt EIC, job scheduling is managed through theJob Control Panel, which provides flexible options to define when and how jobs such asUser Importare executed. The correct options for scheduling areCRON expressionandbuilt-in schedule options, makingA and Bcorrect.

Option A (CRON expression in Job trigger)allows administrators to define precise scheduling using CRON syntax. For example, scheduling a job at exactly 9 AM every day can be achieved using a CRON expression, offering high flexibility and control.

Option B (Schedule option - Hourly, Weekly, Daily, Minutes)provides a user-friendly way to configure job schedules without writing CRON expressions. Administrators can simply select “Daily” and specify 9 AM, making it easier for standard scheduling needs.

OptionC (Global configuration)is not used for scheduling jobs. OptionD (Externalconfig.properties file)is used for system-level configurations, not job scheduling.

Thus, Saviynt supports both CRON-based and UI-based scheduling mechanisms for job execution.

In Saviynt EIC, identity data transformation and normalization during ingestion from authoritative sources like Workday are handled at theimport stage, specifically usingIMPORTUSERJSON. This JSON configuration governs how user data is fetched, parsed, and mapped into the Saviynt Identity Repository.

To meet the requirement of combining first name and last name into a full name and ensuring near real-time reflection of updates, aninline preprocessor within IMPORTUSERJSONis used. This allows administrators to apply transformation logic—such as concatenation, formatting, or conditional mapping—directly during the import process before the data is persisted in Saviynt.

OptionA (USERUPDATEJSON)andB (MODIFYUSERDATAJSON)are used for post-import updates or provisioning-related user modifications, not for initial transformation during ingestion. These do not meet the requirement of transforming data before it is stored in the Identity Repository.

OptionDis incorrect because Saviynt explicitly supports inline preprocessors in IMPORTUSERJSON for such use cases.

Thus, configuring an inline preprocessor inIMPORTUSERJSONis the correct and recommended approach for identity data normalization during import.

The correct answer is A . Saviynt documentation describes two major ServiceNow integration models: ServiceNow as a Managed Application and ServiceNow as a Ticketing System . The managed application model is used for application-style integration, including reconciliation or import and provisioning or deprovisioning activities. The ticketing system model is used when ServiceNow functions as the ITSM workflow and ticket platform connected to Saviynt request processing. This distinction is repeatedly emphasized in the ServiceNow integration overview documentation.

Saviynt further notes that integration with ServiceNow is required to perform reconciliation, provisioning, and deprovisioning tasks, and separately documents ServiceNow as a ticketing system for request-related use cases. That means the two modes are complementary but not identical. Option D is therefore wrong because the modes serve different architectural purposes. Options B and C are incorrect because branding, analytics-only usage, SAV-role-only usage, and password-sync-only behavior do not describe the documented ServiceNow integration patterns. For Level 200 exam preparation, this is a high-value distinction: choose Managed Application when ServiceNow is the governed target system, and Ticketing System when ServiceNow is the ITSM workflow engine around Saviynt processes

In Saviynt REST connector configuration,acctEntMappingsis used to define how account-entitlement relationships are extracted and mapped from the target system response. This configuration is critical when importing entitlements associated with accounts, such as groups, roles, or permissions.

The required parameters for configuring acctEntMappings includelistPath, idPath, and keyField.listPath (Option A)specifies the JSON path where the entitlement list is located within the API response. This allows Saviynt to identify the array or collection containing entitlement data.idPath (Option B)defines the unique identifier for each entitlement within that list, ensuring proper tracking and mapping.keyField (Option C)is used to associate the entitlement back to the account, effectively linking account and entitlement records.

OptionD (accountID)is not a valid parameter within acctEntMappings configuration. While account identifiers are important in overall mapping, acctEntMappings specifically uses keyField instead of accountID to establish relationships.

Thus, the correct parameters required for acctEntMappings are listPath, idPath, and keyField, as per Saviynt REST connector configuration standards.

In Saviynt EIC, schema-based account import jobs rely heavily on theSAV file, which acts as the schema definition for interpreting incoming data. The error message“Schema definition file not found and No SAV file found”specifically indicates that Saviynt is unable to locate or process the required SAV file.

Option Ais correct because the SAV file must be placed in the designatedFile Directory → SAV files location. If the file is missing from this directory, the system cannot read the schema definition, resulting in job failure.

Option Dis also correct because even if the SAV file is present, anincorrectly formatted or corrupted SAV filewill prevent Saviynt from parsing it properly, leading to the same error.

OptionBis incorrect since SAV files are not expected in the Data files directory. OptionCis unrelated to this specific error, as missing CSV files would generate a different error related to missing data, not schema definition.

Thus, the issue is specifically tied to missing or invalid SAV schema files.

In Saviynt EIC, handling special characters such as accents in user attributes (e.g., names used for email generation) is typically addressed usingRules, specificallyUser Update Rules or Technical Rules. Therefore,Option D (Rules)is the correct answer.

Rules allow administrators to apply transformation logic to user attributes during identity processing. For example, accent characters can be normalized or replaced (e.g., converting “é” to “e”) before generating email addresses. This ensures that generated emails conform to system or organizational standards and avoid issues with downstream systems that may not support special characters.

Datasets (Option B)are primarily used for data retrieval and reporting, not transformation.Roles (Option C)are related to access control and do not influence attribute formatting.API (Option A)could theoretically be used externally, but it is not the standard or recommended approach within Saviynt for solving this problem.

Thus, Rules provide the most effective and native way to sanitize and standardize user data, ensuring consistent and valid email generation.

In Saviynt EIC, retrieving reports such as users and their assigned SAV roles can be achieved through multipleanalytics and reporting mechanisms.

Option A is correct because administrators can createAnalytics using SQL queriesand configure them tosend results via email as attachments, which is useful for scheduled reporting and automated distribution.

Option B is also valid since Analytics allows administrators toexport query results into CSV or Excel formats, enabling offline analysis, auditing, and sharing with stakeholders.

Option C is correct becauseData Analyzerprovides a direct interface to execute SQL queries on the Saviynt database, allowing administrators to quickly retrieve required data without creating a formal analytics job.

Option D (Using enhanced query) is not a standard or recognized reporting method within Saviynt for this use case. While advanced queries can be written, “enhanced query” is not a defined feature or module for report extraction.

Thus, the correct answers areA, B, and C, which represent the primary supported methods for reporting in Saviynt.

In Saviynt EIC, workflows are internally represented inXML format, which defines the sequence of approval steps, conditions, and actions. The“Show XML”option is specifically designed to allow administrators toview the underlying XML structure of a workflow. However, this view is provided in aread-only mode, meaning administrators can inspect the configuration but cannot directly modify it from this option.

This feature is particularly useful fordebugging, auditing, and understanding workflow logic, especially in complex approval processes involving multiple steps and conditions. It helps administrators verify how a workflow is constructed without risking accidental changes to the configuration.

Option C is incorrect because editing workflow XML is not typically done directly through the “Show XML” view in Saviynt UI; modifications are handled through workflow configuration screens or controlled import/export processes. Option A is unrelated since Saviynt workflows are XML-based, not JSON-based. Option B is also incorrect because version history is managed separately and not through the Show XML option.

Thus, the correct purpose of “Show XML” is toview workflow configuration safely in read-only format.

In Saviynt EIC REST connector configuration,ImportAccountEntJSONis used to define how account and entitlement data are imported (reconciled) from a target system. This JSON structure includes several predefined and supported parameters that control how accounts, entitlements, and their ownership relationships are processed.

accountParams (Option C)is a valid parameter and is used to map account-level attributes such as account name, status, and identifiers.entitlementParams (Option B)is also valid and defines how entitlement data (groups, roles, permissions) are fetched and mapped.accountOwnerParams (Option A)is another valid parameter used to define account ownership mapping, helping assign owners to accounts during reconciliation.

However,entOwnerParams (Option D)is NOT a valid parameter in the ImportAccountEntJSON structure. The correct naming convention for entitlement ownership (if applicable) does not use "entOwnerParams" in Saviynt REST connector configuration. Saviynt follows strict parameter naming standards, and incorrect parameter names will not be recognized or processed by the connector.

Thus, Option D is the correct answer, as it represents an invalid configuration parameter in the context of ImportAccountEntJSON.

The correct answer is A. Transfer Ownership . Saviynt documentation on User Update Rules explains that the purpose of Transfer Ownership is to change ownership, and specifically notes that service accounts can be reassigned to the OwnerOnTerminate user when the current owner is terminated. The documentation further states that when the current service account owner is terminated, a user update rule with the action Transfer Ownership is triggered so that service account ownership is moved appropriately. This directly matches the scenario in the question.

This is also consistent with Saviynt’s service account model, where every service account must have at least one designated owner who is authorized to manage it. Because ownership is required, Saviynt provides lifecycle controls to preserve accountable ownership when a human owner leaves the organization. The remaining options are unrelated. Run Role Mining belongs to analytics and role engineering, Launch Campaign belongs to certification processes, and Disable SMTP is an email configuration concept. For Level 200 understanding, the key takeaway is that automatic service account ownership continuity is handled through a User Update Rule using the Transfer Ownership action, often combined with OwnerOnTerminate configuration.

Setting up anEmergency Access Role (EAR)request in Saviynt EIC requires multiple coordinated configurations across different components of the system. Option A is correct because emergency access roles must be configured at therole level, where parameters such as emergency access flag, duration, justification requirement, and elevated privileges are defined.

Option C is also necessary becauseSAV Role Configurationscontrol which users (such as administrators or requesters) have the ability to request or manage emergency access roles. Without proper SAV role permissions, users cannot initiate or approve EAR requests.

Option D is equally important becauseworkflows defined under Global Configurationsgovern the approval process, escalation paths, and auditing requirements for emergency access. These workflows ensure that emergency access is properly controlled, reviewed, and revoked after use.

Since all these configurations collectively enable emergency access functionality in Saviynt, the correct answer isAll the above. This aligns with Saviynt best practices for implementing secure, auditable, and compliant emergency access management.

In Saviynt EIC, generating anAuthorization Tokenfor API access is performed using theHTTP POST method. This is aligned with standard REST API authentication practices, where sensitive information such as credentials (username, password, client ID, or client secret) is securely transmitted in the request body rather than in the URL.

Saviynt provides API endpoints (such as/ECM/api/login) that require aPOST requestcontaining authentication details in JSON format. Upon successful authentication, the system returns asession token or authorization token, which is then used in subsequent API calls (typically passed in headers likeAuthorizationortoken).

Option A (PUT) and Option B (GET) are not suitable for authentication token generation. GET exposes parameters in the URL and is not secure for credential transmission, while PUT is typically used for updating resources. Option D (GIVE) is not a valid HTTP method.

Therefore, POST is the correct and secure method used in Saviynt APIs forauthentication and token generation, ensuring compliance with RESTful and security best practices.

In Saviynt EIC, automation of campaigns based on identity changes is typically achieved usingUser Update Rules. These rules monitor changes in user attributes (such as department, role, manager, or status) and can trigger predefined actions when conditions are met.

Option A is correct because aUser Update Rule can be configured to trigger a campaignwhen specific attribute changes are detected. This allows organizations to automatically initiate certification campaigns when critical identity attributes change, ensuring continuous compliance and governance without manual intervention.

Option B is incorrect because connection attributes are primarily used for provisioning and integration logic, not for triggering campaigns. Option C is partially valid in a general sense, but scheduled campaigns do not dynamically react to attribute changes—they run on predefined schedules regardless of changes. Option D is incorrect because Saviynt supports automation through rules.

Thus,User Update Rules provide an event-driven mechanismto launch campaigns based on real-time user attribute changes, making Option A the correct answer.