SCAIP Questions and Answers

In Saviynt EIC when integrated with ServiceNow as aticketing system (ITSM)for disconnected applications, ticket creation behavior depends on the configuration setting“Enable Multi Entitlement Request.”

If this option is enabled, Saviynt treats each entitlement independently and createsseparate tickets in ServiceNow for each entitlementselected in the request. Therefore, if a user selects three entitlements,three individual ticketswill be generated, allowing granular tracking and fulfillment of each entitlement.

If the option is not enabled, Saviynt consolidates multiple entitlements into asingle request payload, resulting inone ServiceNow ticketthat includes all requested entitlements. This approach simplifies ticket management but reduces granularity.

Option B is incorrect because Saviynt fully supports multiple entitlement requests with ServiceNow integration. Option C is only conditionally correct (depends on configuration), making it incomplete. Option D is also conditional and not always true.

Thus, the correct answer isA, as it accurately reflects the behavior based on system configuration.

In Saviynt EIC, when an account is compromised and requiresimmediate containment, the most appropriate action is tolock the account(Option A). Locking an account ensures that the user is instantly prevented from logging into the target system without removing the account or affecting its underlying configuration. This action is reversible and allows administrators to quickly secure the account while further investigation or remediation steps (such as password reset or access review) are performed.

Option B (Suspend) is typically used for longer-term access revocation scenarios, such as employee leave or inactivity, and may depend on application-specific configurations. Option C (Expire) relates to setting an end date for account validity, which is not suitable for immediate threat mitigation. Option D (Delete) is a permanent and destructive action, generally avoided in incident response because it removes audit trails and complicates recovery.

Therefore, locking the account aligns with Saviynt best practices forincident response and rapid risk mitigation, ensuring security without losing account traceability.

In Saviynt EIC, handling special characters such as accents in user attributes (e.g., names used for email generation) is typically addressed usingRules, specificallyUser Update Rules or Technical Rules. Therefore,Option D (Rules)is the correct answer.

Rules allow administrators to apply transformation logic to user attributes during identity processing. For example, accent characters can be normalized or replaced (e.g., converting “é” to “e”) before generating email addresses. This ensures that generated emails conform to system or organizational standards and avoid issues with downstream systems that may not support special characters.

Datasets (Option B)are primarily used for data retrieval and reporting, not transformation.Roles (Option C)are related to access control and do not influence attribute formatting.API (Option A)could theoretically be used externally, but it is not the standard or recommended approach within Saviynt for solving this problem.

Thus, Rules provide the most effective and native way to sanitize and standardize user data, ensuring consistent and valid email generation.

In Saviynt EIC,Role Intelligenceis a key component of Identity Governance that focuses on analyzing, optimizing, and managing roles effectively. It provides multiple features that help organizations improve role design and maintain compliance.

Role Governance (A)is a core feature that ensures roles are properly defined, reviewed, and certified. It helps maintain accountability and ensures that roles align with business policies.

Entitlement Discovery (B)enables identification and analysis of entitlements across applications, helping administrators understand what access exists and how it can be grouped into meaningful roles. This is essential for building accurate and efficient role models.

Role Mining (C)is one of the most important capabilities, allowing organizations to analyze user access patterns and automatically suggest roles based on common entitlement combinations. This improves role engineering and reduces manual effort.

Option D (Role-Access Mismatches) is not considered a standard feature under Role Intelligence; it is more aligned with analytics or audit findings rather than a core Role Intelligence function.

Therefore, the correct answers areA, B, and C, which represent the foundational features of Role Intelligence in Saviynt.

The correct answer is A. User Manager Campaign . In Saviynt, the User Manager campaign is specifically designed for manager-based certifications, where managers review and certify the access of their direct reportees. Saviynt documentation explicitly states that in a User Manager campaign, managers are responsible for reviewing and certifying the access of users who report to them. That makes this campaign type the best fit when the certification driver is the reporting hierarchy rather than entitlement ownership, role ownership, or service account ownership.

The other options represent different certification ownership models. Entitlement Owner Campaign is meant for entitlement owners, Role Owner Campaign is for role owners, and Service Account Campaign is focused on service account ownership verification and access review. Saviynt also describes campaigns as a way to automatically generate and distribute certifications to the appropriate certifiers based on the selected campaign type and ownership model. Therefore, when the requirement clearly says “managers must review direct reportees,” the User Manager campaign is the correct and most aligned selection within Saviynt Level 200 scope.

In Saviynt EIC, job scheduling is managed through theJob Control Panel, which provides flexible options to define when and how jobs such asUser Importare executed. The correct options for scheduling areCRON expressionandbuilt-in schedule options, makingA and Bcorrect.

Option A (CRON expression in Job trigger)allows administrators to define precise scheduling using CRON syntax. For example, scheduling a job at exactly 9 AM every day can be achieved using a CRON expression, offering high flexibility and control.

Option B (Schedule option - Hourly, Weekly, Daily, Minutes)provides a user-friendly way to configure job schedules without writing CRON expressions. Administrators can simply select “Daily” and specify 9 AM, making it easier for standard scheduling needs.

OptionC (Global configuration)is not used for scheduling jobs. OptionD (Externalconfig.properties file)is used for system-level configurations, not job scheduling.

Thus, Saviynt supports both CRON-based and UI-based scheduling mechanisms for job execution.

Saviynt EIC provides multiple standardized approaches for integrating applications, primarily focusing onconnector-based integrationandapplication onboarding via the Design module. OptionA (Classic integration using connectors)is correct because Saviynt supports a wide range of out-of-the-box connectors such as Active Directory, REST, JDBC, SAP, etc. These connectors enable provisioning, deprovisioning, and account aggregation, forming the foundation of application integration in Saviynt.

OptionB (Application Onboarding using Design module)is also correct and represents a modern and structured way of onboarding applications. The Design module simplifies integration by allowing administrators to configure applications, schemas, and connections using a guided UI-driven approach. It ensures consistency, faster onboarding, and better governance alignment.

OptionC (Using Connector framework)is incorrect because it is not considered a separate integration method from an administrator’s perspective; rather, it is the underlying technical architecture that supports connectors. OptionD (Upload Connection file)is also incorrect, as Saviynt does not define application integration as a file-upload-driven process in its standard onboarding methodology.

Thus, the two valid integration methods aligned with Saviynt IGA Level 200 documentation are connector-based integration and Design module onboarding.

The correct answer is B. OAuth access token . Saviynt documentation states that to integrate Saviynt APIs with Saviynt Identity Cloud, an OAuth access token must be generated to authenticate API calls. This is a foundational concept for the API section of Level 200 because even when using Postman or another client, the request must be authenticated before protected endpoints can be called successfully. Saviynt also documents that its APIs are RESTful APIs used to configure and access various platform features, so token-based authentication is central to practical API usage.

The other options are unrelated to Saviynt REST API authentication. SMTP token is not a Saviynt API authentication model, Transport package is used for moving supported configurations between environments, and Dataset key is not the documented authentication requirement for API access. Saviynt’s API reference guide further describes version-specific collections, supported methods, requests, and responses, which is exactly why Postman-based testing in certification labs usually starts with authentication setup first. In practical terms, if the OAuth token is missing or invalid, the request will fail even if the endpoint URL and payload are correct. That is why OAuth access token generation is the correct answer.

In Saviynt EIC, retrieving reports such as users and their assigned SAV roles can be achieved through multipleanalytics and reporting mechanisms.

Option A is correct because administrators can createAnalytics using SQL queriesand configure them tosend results via email as attachments, which is useful for scheduled reporting and automated distribution.

Option B is also valid since Analytics allows administrators toexport query results into CSV or Excel formats, enabling offline analysis, auditing, and sharing with stakeholders.

Option C is correct becauseData Analyzerprovides a direct interface to execute SQL queries on the Saviynt database, allowing administrators to quickly retrieve required data without creating a formal analytics job.

Option D (Using enhanced query) is not a standard or recognized reporting method within Saviynt for this use case. While advanced queries can be written, “enhanced query” is not a defined feature or module for report extraction.

Thus, the correct answers areA, B, and C, which represent the primary supported methods for reporting in Saviynt.

The correct answer is A . Saviynt documentation describes two major ServiceNow integration models: ServiceNow as a Managed Application and ServiceNow as a Ticketing System . The managed application model is used for application-style integration, including reconciliation or import and provisioning or deprovisioning activities. The ticketing system model is used when ServiceNow functions as the ITSM workflow and ticket platform connected to Saviynt request processing. This distinction is repeatedly emphasized in the ServiceNow integration overview documentation.

Saviynt further notes that integration with ServiceNow is required to perform reconciliation, provisioning, and deprovisioning tasks, and separately documents ServiceNow as a ticketing system for request-related use cases. That means the two modes are complementary but not identical. Option D is therefore wrong because the modes serve different architectural purposes. Options B and C are incorrect because branding, analytics-only usage, SAV-role-only usage, and password-sync-only behavior do not describe the documented ServiceNow integration patterns. For Level 200 exam preparation, this is a high-value distinction: choose Managed Application when ServiceNow is the governed target system, and Ticketing System when ServiceNow is the ITSM workflow engine around Saviynt processes

Saviynt’sRole MiningandDuplicate Identity Management (DIM)features are key components of Identity Analytics and Governance.

Option Ais correct because Role Mining analyzes user access patterns and identifies similarities across users. Based on these similarities, Saviynt suggests logical groupings of entitlements that can be converted into roles, improving role design and governance.

Option Bis also correct. Thepercentage cut-offin Role Mining defines the threshold for common access across users. A higher threshold (e.g., 60% or more) ensures that only frequently shared entitlements are considered. In practice, this drives mining toward highly consistent access patterns, often close to universally assigned (near 100%), ensuring stronger role accuracy.

Option Cis correct because access to DIM functionality is controlled throughSAV Roles. Administrators must explicitly grant permissions to view and manage duplicate identities.

Option Dis incorrect because DIM not only merges identity attributes but can also consolidate associated access (accounts and entitlements), ensuring a unified identity profile.

In Saviynt EIC, generating anAuthorization Tokenfor API access is performed using theHTTP POST method. This is aligned with standard REST API authentication practices, where sensitive information such as credentials (username, password, client ID, or client secret) is securely transmitted in the request body rather than in the URL.

Saviynt provides API endpoints (such as/ECM/api/login) that require aPOST requestcontaining authentication details in JSON format. Upon successful authentication, the system returns asession token or authorization token, which is then used in subsequent API calls (typically passed in headers likeAuthorizationortoken).

Option A (PUT) and Option B (GET) are not suitable for authentication token generation. GET exposes parameters in the URL and is not secure for credential transmission, while PUT is typically used for updating resources. Option D (GIVE) is not a valid HTTP method.

Therefore, POST is the correct and secure method used in Saviynt APIs forauthentication and token generation, ensuring compliance with RESTful and security best practices.

In Saviynt EIC, when configuringdynamic attributes or custom forms, system variables are used to fetch context-specific data such as the currently logged-in user. To retrieve theDisplay Name of the logged-in user, the correct variable is${loggedInUser}, which directly represents the userkey of the active session user.

Option A correctly uses this variable in the SQL query to fetch the DISPLAYNAME from the Users table. This ensures that the attribute dynamically reflects the logged-in user's display name at runtime.

Option B is incorrect because${user.id}typically refers to the target user in a request context, not necessarily the logged-in user. Option C (${requestor}) may represent the requester in certain workflows but is not consistently equivalent to the logged-in user in all scenarios, especially in delegated or admin-driven requests.

Therefore, Option A is the most accurate and reliable approach for retrieving the logged-in user’s display name in Saviynt configurations, ensuring proper context-aware data population.