SCAIP Saviynt Certified Advanced IGA Professional (Level 200) Free Practice Exam Questions (2026 Updated)

In Saviynt EIC REST connector configuration,ImportAccountEntJSONis used to define how account and entitlement data are imported (reconciled) from a target system. This JSON structure includes several predefined and supported parameters that control how accounts, entitlements, and their ownership relationships are processed.

accountParams (Option C)is a valid parameter and is used to map account-level attributes such as account name, status, and identifiers.entitlementParams (Option B)is also valid and defines how entitlement data (groups, roles, permissions) are fetched and mapped.accountOwnerParams (Option A)is another valid parameter used to define account ownership mapping, helping assign owners to accounts during reconciliation.

However,entOwnerParams (Option D)is NOT a valid parameter in the ImportAccountEntJSON structure. The correct naming convention for entitlement ownership (if applicable) does not use "entOwnerParams" in Saviynt REST connector configuration. Saviynt follows strict parameter naming standards, and incorrect parameter names will not be recognized or processed by the connector.

Thus, Option D is the correct answer, as it represents an invalid configuration parameter in the context of ImportAccountEntJSON.

In Saviynt EIC, workflows are a core component used to control approval processes for access requests, provisioning, and other identity lifecycle events. These workflows can be configured at multiple levels depending on the scope and granularity required.

Security System (A)supports workflow configuration to define approval processes at the application level. This allows organizations to enforce consistent approval logic for all endpoints associated with that system.

Endpoint (B)also supports workflow configuration, enabling more granular control where different endpoints within the same security system may require distinct approval processes. This is particularly useful in complex environments with varied access control requirements.

Entitlement Type (D)supports workflows to manage approvals specific to entitlement categories (such as roles, groups, or permissions), ensuring appropriate governance at a finer level.

Global Configuration (C), while important for system-wide settings, is not typically used to directly assign active workflows to access requests. Instead, workflows are selected and applied within modules like Security System, Endpoint, and Entitlement Type.

Thus, the correct modules supporting active workflow configuration areSecurity System, Endpoint, and Entitlement Type.

In Saviynt EIC,Duplicate Identity Management (DIM)supports multiple mechanisms to detect duplicate identities across the identity lifecycle, makingOption D (All of the above)the correct answer.

Firstly, duplicate identities can be detectedduring user import (Option A)when data is ingested from authoritative sources like HR systems. Saviynt can apply matching rules and prevent or flag duplicates at the ingestion stage. Secondly, duplicates can be identified by executing theDuplicate Identity Detection Job (Option B), which is a detective control that scans existing identities in the repository and identifies potential duplicates based on configured correlation rules such as email, username, or employee ID.

Additionally, duplicates may also be identifiedduring manual updates in the Identity Repository (Option C)when administrators modify user attributes. If updated values match existing identities based on defined criteria, Saviynt can flag potential duplicates.

These multiple detection points ensure both proactive and reactive duplicate management, helping maintain identity data accuracy and preventing access risks associated with duplicate identities.

Saviynt’sDuplicate Identity Management (DIM)feature is designed to identify, analyze, and remediate duplicate identities within the Identity Repository, ensuring data integrity and governance. All the listed actions are core capabilities of DIM, makingOption D (All of the Above)the correct answer.

Firstly, DIM enablesduplicate detectionboth during identity import (pre-processing stage) and for already existing identities using detective jobs. This ensures that duplicates are identified proactively and retrospectively. Secondly, DIM provides aside-by-side comparison view, allowing administrators or reviewers to analyze ambiguous duplicate records and decide whether they should be merged. This comparison highlights attribute-level differences for informed decision-making.

Finally, after merging duplicate identities, Saviynt allows administrators todeactivate or retire redundant identities, ensuring only a single authoritative identity remains active. This helps maintain clean identity data and prevents access risks.

Together, these features support identity consolidation, reduce redundancy, and improve overall governance, making DIM a critical component of Saviynt’s intelligence and analytics capabilities.

The correct answer is B. Technical Rule . Saviynt documentation clearly states that a Technical Rule is primarily used to provision birthright access , also referred to as zero-day provisioning , to users joining the organization based on specified conditions. This is one of the most important distinctions in the Rules and Policies section of the Level 200 syllabus. Technical Rules are intended for automated access assignment logic, especially where access must be granted immediately when user attributes match business conditions such as department, location, or cost center.

The other options are not correct for this use case. User Update Rules are generally used to take actions when user records change and can support lifecycle events, but the documentation identifies Technical Rules as the primary mechanism for birthright provisioning. Scan Rules are used for detection and policy-based scanning use cases, not default access assignment. SAV Role controls platform authorization inside Saviynt rather than provisioning target application access. Saviynt also documents that entitlement assignments in a Birthright Rule can be parameterized using user attributes, which reinforces that Technical Rules are the intended framework for this type of zero-day access automation.

In Saviynt EIC, when an account is compromised and requiresimmediate containment, the most appropriate action is tolock the account(Option A). Locking an account ensures that the user is instantly prevented from logging into the target system without removing the account or affecting its underlying configuration. This action is reversible and allows administrators to quickly secure the account while further investigation or remediation steps (such as password reset or access review) are performed.

Option B (Suspend) is typically used for longer-term access revocation scenarios, such as employee leave or inactivity, and may depend on application-specific configurations. Option C (Expire) relates to setting an end date for account validity, which is not suitable for immediate threat mitigation. Option D (Delete) is a permanent and destructive action, generally avoided in incident response because it removes audit trails and complicates recovery.

Therefore, locking the account aligns with Saviynt best practices forincident response and rapid risk mitigation, ensuring security without losing account traceability.

In Saviynt EIC,SMTP configurationis used to enable email notifications for workflows such as access requests, certifications, alerts, and system communications. To securely connect with mail servers, Saviynt supports multiple authentication mechanisms. The valid authentication modes areNTLM, OAuth, and Basic, making OptionsA, B, and Dcorrect.

Basic Authentication (Option D)is the traditional method where a username and password are used to authenticate with the SMTP server. While widely supported, it is less secure compared to modern methods and is being phased out in many environments.

NTLM (Option A)is commonly used in Microsoft-based environments (e.g., Exchange servers) and provides integrated authentication using Windows credentials, offering better security than basic authentication.

OAuth (Option B)is a modern and more secure authentication mechanism that uses token-based authorization instead of storing credentials. It is commonly used with cloud-based email services such as Microsoft 365 or Google Workspace.

OptionCis incorrect because Saviynt explicitly supports multiple authentication modes.

Thus, NTLM, OAuth, and Basic are the supported SMTP authentication modes in Saviynt.

In Saviynt EIC, retrieving reports such as users and their assigned SAV roles can be achieved through multiple analytics and reporting mechanisms. The correct approaches areOptions A, B, and C, all of which leverage SQL-based analytics capabilities.

Option Ais correct because Saviynt allows administrators to create analytics using SQL queries and schedule them. The“Send Email As Attachment”feature enables automated report delivery, making it useful for periodic reporting and compliance requirements.

Option Bis also valid, as analytics results can be exported directly into formats like CSV or Excel, allowing further analysis or sharing outside the platform.

Option Cis correct because theData Analyzertool enables administrators to run SQL queries directly on the Saviynt database to retrieve real-time data for reporting and troubleshooting purposes.

Option D (Using enhanced query)is not considered a standard or distinct reporting mechanism in Saviynt for this use case.

Together, these methods provide flexible reporting options, supporting both real-time access and scheduled report distribution within Saviynt.

The correct answer is B. REST Connector . Saviynt documentation explains that REST integration is intended for applications whose data and lifecycle actions are available through REST endpoints. It states that the REST integration enables organizations to gain visibility, manage the user lifecycle, and govern access for data available in the REST application or REST endpoint. That directly matches the question, which requires imports plus provisioning and deprovisioning for an API-driven target system.

Saviynt’s REST connector documentation also notes that provisioning and deprovisioning are supported when the connection is configured correctly. This makes the REST connector the standard choice when the target system does not use an out-of-the-box native connector but does provide usable REST APIs. The other options do not fit the requirement. Active Directory Connector is specific to AD use cases, SMTP Configuration is only for email delivery, and Dataset Configuration is an administrative data-structuring feature rather than an application integration method. In Saviynt Level 200 terms, when an application is API-first and lifecycle actions must be automated, the REST connector is the appropriate design decision.

In Saviynt EIC, theSOD (Segregation of Duties) Risk Evaluation Jobis used to identify conflicts in user access that violate defined SOD policies. To efficiently analyze and review these violations, Saviynt provides several filtering options.

Users (A)is a valid filter that allows administrators to view SOD violations specific to individual users or a group of users. This is helpful for targeted investigations or audits.

Security System (B)is also a valid filter, enabling administrators to narrow down violations based on specific applications or systems. This is useful when analyzing risks within a particular application landscape.

Ruleset (C)is another important filter, as SOD violations are evaluated based on predefined rule sets. Administrators can filter results based on specific rulesets to understand which policies are being violated.

Option D (User Account Evaluation) is not a standard filter in the SOD Risk Evaluation Job. It is more related to job execution scope rather than filtering results.

Thus, the correct answers areUsers, Security System, and Ruleset, which are the primary filters for analyzing SOD violations.

In Saviynt EIC REST connector configurations,attribute mapping between Saviynt and the target applicationis primarily handled during provisioning operations such as account creation and updates. Among the given options,CreateAccountJSONis the correct configuration where attribute mapping is explicitly defined for provisioning new accounts in the target system.

CreateAccountJSON (Option C)contains the payload structure and field mappings that determine how Saviynt attributes (such as username, email, department, etc.) are translated into the target application's API request format. Administrators define mappings using placeholders and transformation logic to ensure correct data flow from Saviynt to the external system.

OptionA (ImportAccountEntJSON)is used for reconciliation (importing accounts and entitlements), not provisioning. OptionB (CreateAccountEntJSON)is not a standard REST connector configuration in Saviynt. OptionD (UpdateAccountJSON)is used for modifying existing accounts, but the primary and most commonly referenced mapping configuration for attribute mapping is defined in CreateAccountJSON during initial provisioning.

Thus,CreateAccountJSONis the correct answer for attribute mapping between EIC and the target application.

In Saviynt EIC, job scheduling is managed through theJob Control Panel, which provides flexible options to define when and how jobs such asUser Importare executed. The correct options for scheduling areCRON expressionandbuilt-in schedule options, makingA and Bcorrect.

Option A (CRON expression in Job trigger)allows administrators to define precise scheduling using CRON syntax. For example, scheduling a job at exactly 9 AM every day can be achieved using a CRON expression, offering high flexibility and control.

Option B (Schedule option - Hourly, Weekly, Daily, Minutes)provides a user-friendly way to configure job schedules without writing CRON expressions. Administrators can simply select “Daily” and specify 9 AM, making it easier for standard scheduling needs.

OptionC (Global configuration)is not used for scheduling jobs. OptionD (Externalconfig.properties file)is used for system-level configurations, not job scheduling.

Thus, Saviynt supports both CRON-based and UI-based scheduling mechanisms for job execution.

Saviynt EIC provides multiple flexible integration options with ServiceNow to support different business and operational use cases. Therefore,Option D (All of the above)is correct.

ServiceNow as a Managed Application (Option A)allows Saviynt to treat ServiceNow like any other application, enabling account provisioning, deprovisioning, and access governance directly within ServiceNow using REST connectors.

ServiceNow as a Request Form (Option B)enables organizations to leverage ServiceNow’s front-end portal for access requests. Users can initiate requests in ServiceNow, which are then processed and fulfilled by Saviynt, ensuring seamless user experience while maintaining governance.

ServiceNow as a Ticketing System (ITSM) (Option C)is another key integration pattern where Saviynt generates tickets (incidents, requests, or tasks) in ServiceNow for approval workflows, provisioning actions, or tracking purposes. This ensures alignment with enterprise ITSM processes.

These multiple integration models provide flexibility, allowing organizations to choose the approach that best fits their operational and governance requirements.

In Saviynt EIC,job orchestration and sequencingare critical for automating identity lifecycle processes such as user import followed by provisioning. To ensure that provisioning starts immediately after user import completes, Saviynt provides the concept of aTrigger Chain Job.

ATrigger Chain Job (Option B)allows administrators to define a sequence of jobs where one job is automatically triggered upon the successful completion of another. In this scenario, once theUser Import Jobfinishes, the system can automatically trigger theProvisioning Job, ensuring seamless and immediate execution without manual intervention or time delays.

Option A (Multi-threading job) relates to performance optimization, not sequencing. Option C (Single Threaded Job) defines execution style but does not control job dependency. Option D (WSRetry job) is used for retrying failed web service calls, not for chaining processes.

Thus,Trigger Chain Jobis the correct approach for automating dependent job execution and is widely used in Saviynt for efficient workflow orchestration.

In Saviynt REST connector configuration,acctEntMappingsis used to define how account-entitlement relationships are extracted and mapped from the target system response. This configuration is critical when importing entitlements associated with accounts, such as groups, roles, or permissions.

The required parameters for configuring acctEntMappings includelistPath, idPath, and keyField.listPath (Option A)specifies the JSON path where the entitlement list is located within the API response. This allows Saviynt to identify the array or collection containing entitlement data.idPath (Option B)defines the unique identifier for each entitlement within that list, ensuring proper tracking and mapping.keyField (Option C)is used to associate the entitlement back to the account, effectively linking account and entitlement records.

OptionD (accountID)is not a valid parameter within acctEntMappings configuration. While account identifiers are important in overall mapping, acctEntMappings specifically uses keyField instead of accountID to establish relationships.

Thus, the correct parameters required for acctEntMappings are listPath, idPath, and keyField, as per Saviynt REST connector configuration standards.

In Saviynt EIC, automation of campaigns based on identity changes is typically achieved usingUser Update Rules. These rules monitor changes in user attributes (such as department, role, manager, or status) and can trigger predefined actions when conditions are met.

Option A is correct because aUser Update Rule can be configured to trigger a campaignwhen specific attribute changes are detected. This allows organizations to automatically initiate certification campaigns when critical identity attributes change, ensuring continuous compliance and governance without manual intervention.

Option B is incorrect because connection attributes are primarily used for provisioning and integration logic, not for triggering campaigns. Option C is partially valid in a general sense, but scheduled campaigns do not dynamically react to attribute changes—they run on predefined schedules regardless of changes. Option D is incorrect because Saviynt supports automation through rules.

Thus,User Update Rules provide an event-driven mechanismto launch campaigns based on real-time user attribute changes, making Option A the correct answer.

In Saviynt EIC, the correct configuration for controlling which roles appear in the Access Request screen is theRequest Roles Query / Role Request QueryunderGlobal Configuration. Saviynt’s official documentation forConfiguring Role Requestsstates that this setting is used tospecify a query to control the display of roles in Access Request, meaning only roles returned by that query are shown to the requester. That is exactly the use case in this question: filtering the visible role list by a user attribute such as country or location. A query can be written so that users from Country A see only the roles mapped for Country A.

The other options are not correct in this context.SAV Rolecontrols administrative UI permissions in Saviynt, not end-user role catalog filtering.Role Configuration - > User Queryis not the standard setting used to drive request-time role visibility for this scenario. Option D is incorrect because Saviynt explicitly supports this use case through the Request Roles Query capability.