Saviynt Certified Advanced IGA Professional (Level 200) SCAIP Exam Questions

Answer : A, B, C

Saviynt'sRole MiningandDuplicate Identity Management (DIM)features are key components of Identity Analytics and Governance.

Option Ais correct because Role Mining analyzes user access patterns and identifies similarities across users. Based on these similarities, Saviynt suggests logical groupings of entitlements that can be converted into roles, improving role design and governance.

Option Bis also correct. Thepercentage cut-offin Role Mining defines the threshold for common access across users. A higher threshold (e.g., 60% or more) ensures that only frequently shared entitlements are considered. In practice, this drives mining toward highly consistent access patterns, often close to universally assigned (near 100%), ensuring stronger role accuracy.

Option Cis correct because access to DIM functionality is controlled throughSAV Roles. Administrators must explicitly grant permissions to view and manage duplicate identities.

Option Dis incorrect because DIM not only merges identity attributes but can also consolidate associated access (accounts and entitlements), ensuring a unified identity profile.

Answer : B

The correct answer is B. REST Connector. Saviynt documentation explains that REST integration is intended for applications whose data and lifecycle actions are available through REST endpoints. It states that the REST integration enables organizations to gain visibility, manage the user lifecycle, and govern access for data available in the REST application or REST endpoint. That directly matches the question, which requires imports plus provisioning and deprovisioning for an API-driven target system.

Saviynt's REST connector documentation also notes that provisioning and deprovisioning are supported when the connection is configured correctly. This makes the REST connector the standard choice when the target system does not use an out-of-the-box native connector but does provide usable REST APIs. The other options do not fit the requirement. Active Directory Connector is specific to AD use cases, SMTP Configuration is only for email delivery, and Dataset Configuration is an administrative data-structuring feature rather than an application integration method. In Saviynt Level 200 terms, when an application is API-first and lifecycle actions must be automated, the REST connector is the appropriate design decision.

Answer : D

In Saviynt EIC, workflows are internally represented inXML format, which defines the sequence of approval steps, conditions, and actions. The''Show XML''option is specifically designed to allow administrators toview the underlying XML structure of a workflow. However, this view is provided in aread-only mode, meaning administrators can inspect the configuration but cannot directly modify it from this option.

This feature is particularly useful fordebugging, auditing, and understanding workflow logic, especially in complex approval processes involving multiple steps and conditions. It helps administrators verify how a workflow is constructed without risking accidental changes to the configuration.

Option C is incorrect because editing workflow XML is not typically done directly through the ''Show XML'' view in Saviynt UI; modifications are handled through workflow configuration screens or controlled import/export processes. Option A is unrelated since Saviynt workflows are XML-based, not JSON-based. Option B is also incorrect because version history is managed separately and not through the Show XML option.

Thus, the correct purpose of ''Show XML'' is toview workflow configuration safely in read-only format.

Answer : A

In Saviynt EIC, password management is highly configurable, allowing organizations to defineseparate password policies for different account types, including service accounts and regular user accounts. This requirement is achieved by creating a dedicated password policy specifically for service accounts and associating it appropriately within the system.

Option A is correct because Saviynt allows administrators to define aseparate Password Policy for Service Accountsand map it using thePolicy Rule Service Account field under the Security System configuration. This ensures that when service account operations such as password resets or provisioning occur, the system enforces the correct policy distinct from regular user accounts.

Option B is incorrect since Saviynt supports multiple password policies and does not restrict to a single policy. Option C is incorrect because simply selecting a checkbox in password policy configuration does not link it to service account usage. Option D is incorrect as Global Configurations do not directly assign password policies for service accounts at the execution level.

Thus, configuring and mapping the policy at theSecurity System levelensures correct enforcement for service accounts.

Answer : A, B, C

In Saviynt REST connector configuration,acctEntMappingsis used to define how account-entitlement relationships are extracted and mapped from the target system response. This configuration is critical when importing entitlements associated with accounts, such as groups, roles, or permissions.

The required parameters for configuring acctEntMappings includelistPath, idPath, and keyField.listPath (Option A)specifies the JSON path where the entitlement list is located within the API response. This allows Saviynt to identify the array or collection containing entitlement data.idPath (Option B)defines the unique identifier for each entitlement within that list, ensuring proper tracking and mapping.keyField (Option C)is used to associate the entitlement back to the account, effectively linking account and entitlement records.

OptionD (accountID)is not a valid parameter within acctEntMappings configuration. While account identifiers are important in overall mapping, acctEntMappings specifically uses keyField instead of accountID to establish relationships.

Thus, the correct parameters required for acctEntMappings are listPath, idPath, and keyField, as per Saviynt REST connector configuration standards.

Answer : A

In Saviynt EIC, automation of campaigns based on identity changes is typically achieved usingUser Update Rules. These rules monitor changes in user attributes (such as department, role, manager, or status) and can trigger predefined actions when conditions are met.

Option A is correct because aUser Update Rule can be configured to trigger a campaignwhen specific attribute changes are detected. This allows organizations to automatically initiate certification campaigns when critical identity attributes change, ensuring continuous compliance and governance without manual intervention.

Option B is incorrect because connection attributes are primarily used for provisioning and integration logic, not for triggering campaigns. Option C is partially valid in a general sense, but scheduled campaigns do not dynamically react to attribute changes---they run on predefined schedules regardless of changes. Option D is incorrect because Saviynt supports automation through rules.

Thus,User Update Rules provide an event-driven mechanismto launch campaigns based on real-time user attribute changes, making Option A the correct answer.

Answer : A, D

In Saviynt EIC, theservice account name generationis controlled through configuration-driven mechanisms to ensure consistency, automation, and compliance with naming standards.

Option A is correct because administrators can define naming conventions at theEndpoint level using the Service Account Name Rule. This allows dynamic generation of account names based on attributes such as application name, environment, or other identifiers, ensuring standardized naming across systems.

Option D is also correct since in many connector-based integrations, theCreate Account JSONconfiguration plays a role in provisioning. The account name can be derived or constructed within this JSON payload based on defined mappings and logic, especially for REST or custom connectors.

Option B is incorrect because service account creation in Saviynt is typically controlled and standardized; manual entry of account names is generally restricted or governed to avoid inconsistencies. Option C is incorrect because Global Configurations do not directly define service account naming rules in standard implementations.

Thus, the correct answers areEndpoint-based naming rules and Connection-level JSON configuration, ensuring automated and consistent service account naming.