SCAIP Sample Questions Answers

In Saviynt EIC,job orchestration and sequencingare critical for automating identity lifecycle processes such as user import followed by provisioning. To ensure that provisioning starts immediately after user import completes, Saviynt provides the concept of aTrigger Chain Job.

ATrigger Chain Job (Option B)allows administrators to define a sequence of jobs where one job is automatically triggered upon the successful completion of another. In this scenario, once theUser Import Jobfinishes, the system can automatically trigger theProvisioning Job, ensuring seamless and immediate execution without manual intervention or time delays.

Option A (Multi-threading job) relates to performance optimization, not sequencing. Option C (Single Threaded Job) defines execution style but does not control job dependency. Option D (WSRetry job) is used for retrying failed web service calls, not for chaining processes.

Thus,Trigger Chain Jobis the correct approach for automating dependent job execution and is widely used in Saviynt for efficient workflow orchestration.

In Saviynt EIC,Role Intelligenceis a key component of Identity Governance that focuses on analyzing, optimizing, and managing roles effectively. It provides multiple features that help organizations improve role design and maintain compliance.

Role Governance (A)is a core feature that ensures roles are properly defined, reviewed, and certified. It helps maintain accountability and ensures that roles align with business policies.

Entitlement Discovery (B)enables identification and analysis of entitlements across applications, helping administrators understand what access exists and how it can be grouped into meaningful roles. This is essential for building accurate and efficient role models.

Role Mining (C)is one of the most important capabilities, allowing organizations to analyze user access patterns and automatically suggest roles based on common entitlement combinations. This improves role engineering and reduces manual effort.

Option D (Role-Access Mismatches) is not considered a standard feature under Role Intelligence; it is more aligned with analytics or audit findings rather than a core Role Intelligence function.

Therefore, the correct answers areA, B, and C, which represent the foundational features of Role Intelligence in Saviynt.

The correct answer is B. OAuth access token . Saviynt documentation states that to integrate Saviynt APIs with Saviynt Identity Cloud, an OAuth access token must be generated to authenticate API calls. This is a foundational concept for the API section of Level 200 because even when using Postman or another client, the request must be authenticated before protected endpoints can be called successfully. Saviynt also documents that its APIs are RESTful APIs used to configure and access various platform features, so token-based authentication is central to practical API usage.

The other options are unrelated to Saviynt REST API authentication. SMTP token is not a Saviynt API authentication model, Transport package is used for moving supported configurations between environments, and Dataset key is not the documented authentication requirement for API access. Saviynt’s API reference guide further describes version-specific collections, supported methods, requests, and responses, which is exactly why Postman-based testing in certification labs usually starts with authentication setup first. In practical terms, if the OAuth token is missing or invalid, the request will fail even if the endpoint URL and payload are correct. That is why OAuth access token generation is the correct answer.

In Saviynt EIC,Dynamic Attributesare often used in request forms to capture additional information, and some of these attributes may be configured ashidden fieldsfor backend processing. By default, hidden dynamic attributes are not exposed in workflows, which can prevent administrators from accessing their values during request processing.

To resolve this issue, Saviynt provides a specific configuration inGlobal Configurationscalled“Expose hidden dynamic attributes in workflow”. Enabling this setting (Option A) ensures that even if the dynamic attributes are hidden in the UI, their values are still accessible within workflows for processing, approvals, and provisioning logic.

Option B is incorrect because this setting is not configured at the endpoint level. Option C relates to saving default values but does not ensure visibility in workflows. Option D is unrelated to hidden attribute exposure.

Thus, enabling theGlobal Config setting to expose hidden dynamic attributesis the correct solution to ensure their values are available within workflow execution.

In Saviynt EIC REST connector configurations, pagination is a critical mechanism used duringuser import (identity reconciliation)to efficiently process large datasets from target systems. The parameterMAX_PAGINATION_SIZEdetermines how many records are fetched and processed per API call (per page).

IfMAX_PAGINATION_SIZEis not explicitly defined, Saviynt uses adefault value of 1000 records per page. This default is designed to balance performance and system stability. Fetching too many records in a single API call can lead to performance bottlenecks, API timeouts, or memory issues, while too few records can increase the number of API calls and slow down the overall import process.

OptionA (50000)andC (10000)are incorrect because these values are typically too large for default settings and must be explicitly configured if required. OptionBis incorrect because Saviynt does provide a default fallback value rather than leaving it undefined.

Therefore, when MAX_PAGINATION_SIZE is not specified, Saviynt defaults to1000, ensuring efficient and stable data import operations.

In Saviynt EIC, mass unintended changes—such as all accounts being disabled due to incorrect target application configuration—can be prevented usingthreshold-based controls. These controls are defined using theSTATUS_THRESHOLD_CONFIGconnection parameter, which acts as a safeguard during reconciliation and provisioning processes.

The correct attribute in this scenario isaccountThresholdValue (Option D). This parameter allows administrators to define a threshold limit for account status changes (such as disablement). If the number or percentage of accounts being disabled exceeds the defined threshold, Saviynt can stop or flag the operation, preventing large-scale unintended impact.

OptionA (accEntThresholdValue)is used for entitlement-level thresholds, not account status changes. OptionBis incorrect because Saviynt does provide this safeguard mechanism. OptionCis also incorrect since such controls are not managed externally but are part of Saviynt’s connector configuration.

By usingaccountThresholdValuewithin STATUS_THRESHOLD_CONFIG, organizations can implement strong governance and prevent bulk account disablement due to misconfigurations or data issues during account import or reconciliation.

In Saviynt EIC, retrieving reports such as users and their assigned SAV roles can be achieved through multiple analytics and reporting mechanisms. The correct approaches areOptions A, B, and C, all of which leverage SQL-based analytics capabilities.

Option Ais correct because Saviynt allows administrators to create analytics using SQL queries and schedule them. The“Send Email As Attachment”feature enables automated report delivery, making it useful for periodic reporting and compliance requirements.

Option Bis also valid, as analytics results can be exported directly into formats like CSV or Excel, allowing further analysis or sharing outside the platform.

Option Cis correct because theData Analyzertool enables administrators to run SQL queries directly on the Saviynt database to retrieve real-time data for reporting and troubleshooting purposes.

Option D (Using enhanced query)is not considered a standard or distinct reporting mechanism in Saviynt for this use case.

Together, these methods provide flexible reporting options, supporting both real-time access and scheduled report distribution within Saviynt.

In Saviynt EIC REST connector configuration,ImportAccountEntJSONis used to define how account and entitlement data are imported (reconciled) from a target system. This JSON structure includes several predefined and supported parameters that control how accounts, entitlements, and their ownership relationships are processed.

accountParams (Option C)is a valid parameter and is used to map account-level attributes such as account name, status, and identifiers.entitlementParams (Option B)is also valid and defines how entitlement data (groups, roles, permissions) are fetched and mapped.accountOwnerParams (Option A)is another valid parameter used to define account ownership mapping, helping assign owners to accounts during reconciliation.

However,entOwnerParams (Option D)is NOT a valid parameter in the ImportAccountEntJSON structure. The correct naming convention for entitlement ownership (if applicable) does not use "entOwnerParams" in Saviynt REST connector configuration. Saviynt follows strict parameter naming standards, and incorrect parameter names will not be recognized or processed by the connector.

Thus, Option D is the correct answer, as it represents an invalid configuration parameter in the context of ImportAccountEntJSON.

The error message"Connection Name Specified in accountJSON is not found"clearly indicates that the issue is related to theaccountJSON configuration, which directly corresponds toImportAccountJSONin Saviynt REST connector terminology. This JSON is responsible for handling account import (reconciliation) operations, including defining the connection name, API endpoints, and parsing logic for retrieving account data.

TheWSRETRY jobis typically used to retry failed web service (REST) operations, especially related to account imports or provisioning failures. Since the error explicitly referencesaccountJSON, it means the system is unable to locate the connection name defined within theImportAccountJSONconfiguration. This usually happens when the connection name is either misspelled, mismatched with the ConnectionJSON configuration, or incorrectly referenced.

Other options are incorrect becauseCreateAccountJSONis used for provisioning (account creation),ImportUserJSONis for identity import, andImportAccountEntJSONis primarily used for entitlement and combined account-entitlement imports.

Therefore, correcting the connection name inImportAccountJSONresolves this issue.

In Saviynt EIC,Technical Rulesare triggered based on lifecycle events related to user creation, updates, and imports, provided the defined conditions evaluate to true. The correct answers areB, C, and D.

Option Bis correct because duringImport Jobs, when users are brought into Saviynt from authoritative sources, Technical Rules are evaluated, and if conditions match, they are executed. This is a common mechanism for provisioning access during onboarding.

Option Cis also correct since when anew user is created via the UI, Technical Rules can be triggered if the user attributes meet the rule conditions. This ensures consistent provisioning regardless of how users are created.

Option Dis correct because when anexisting user is updated, and a User Update Rule is configured tore-run provisioning rules, it can trigger associated Technical Rules again.

Option Ais incorrect because deletion events typically trigger deprovisioning workflows rather than standard Technical Rule execution.

Thus, Technical Rules are triggered during import, creation, and update events—not deletion.

In Saviynt–ServiceNow integration using theSaviynt App for ServiceNow, therequest fulfillment location is flexible and depends on how the integration is configured. This is why Option C is correct.

Saviynt supports different integration patterns with ServiceNow. In one model,ServiceNow acts as the front-end request system, while Saviynt handles the fulfillment (provisioning, approvals, and access governance). In another model, ServiceNow can handle certain fulfillment steps depending on how workflows, APIs, and ticketing configurations are defined.

For example, if the integration is configured such that ServiceNow creates a request and passes it to Saviynt, thenSaviynt performs fulfillment. Alternatively, if certain fulfillment logic or orchestration is handled within ServiceNow workflows or ITSM processes, thenServiceNow may drive parts of the fulfillment process.

This flexibility allows organizations to align the integration with their operational model, whether centralized in Saviynt or distributed with ServiceNow. Therefore, fulfillment is not restricted to a single system and is determined byconfiguration and architectural design choices.

In Saviynt EIC,User Update Rulesare powerful automation mechanisms used to perform actions based on user attribute changes or conditions defined through SQL queries. These rules support multiple actions that help streamline identity lifecycle management.

Option A is correct because User Update Rules cantrigger Technical Rules, enabling further downstream processing such as provisioning, deprovisioning, or executing custom logic. This allows modular and scalable automation.

Option B is also valid since User Update Rules can be used togenerate usernames dynamicallybased on defined patterns or business logic, especially during onboarding or identity updates.

Option C is correct as well because these rules supportsending email notifications, which can be used for alerts, approvals, or informing stakeholders about identity changes.

Since all these actions are supported within User Update Rules, Option D (All the above) is correct. This highlights the flexibility of User Update Rules in handling automation, communication, and identity data transformations within Saviynt EIC.

In Saviynt EIC REST connector configurations,attribute mapping between Saviynt and the target applicationis primarily handled during provisioning operations such as account creation and updates. Among the given options,CreateAccountJSONis the correct configuration where attribute mapping is explicitly defined for provisioning new accounts in the target system.

CreateAccountJSON (Option C)contains the payload structure and field mappings that determine how Saviynt attributes (such as username, email, department, etc.) are translated into the target application's API request format. Administrators define mappings using placeholders and transformation logic to ensure correct data flow from Saviynt to the external system.

OptionA (ImportAccountEntJSON)is used for reconciliation (importing accounts and entitlements), not provisioning. OptionB (CreateAccountEntJSON)is not a standard REST connector configuration in Saviynt. OptionD (UpdateAccountJSON)is used for modifying existing accounts, but the primary and most commonly referenced mapping configuration for attribute mapping is defined in CreateAccountJSON during initial provisioning.

Thus,CreateAccountJSONis the correct answer for attribute mapping between EIC and the target application.

In Saviynt EIC, when configuringdynamic attributes or custom forms, system variables are used to fetch context-specific data such as the currently logged-in user. To retrieve theDisplay Name of the logged-in user, the correct variable is${loggedInUser}, which directly represents the userkey of the active session user.

Option A correctly uses this variable in the SQL query to fetch the DISPLAYNAME from the Users table. This ensures that the attribute dynamically reflects the logged-in user's display name at runtime.

Option B is incorrect because${user.id}typically refers to the target user in a request context, not necessarily the logged-in user. Option C (${requestor}) may represent the requester in certain workflows but is not consistently equivalent to the logged-in user in all scenarios, especially in delegated or admin-driven requests.

Therefore, Option A is the most accurate and reliable approach for retrieving the logged-in user’s display name in Saviynt configurations, ensuring proper context-aware data population.

The correct answers are A, B, and C . Saviynt documentation for Active Directory group management states that the connector can be used to create, update, and delete AD or ADSI groups. It also supports related group-management functions such as updating group attributes and maintaining group membership and owners. This confirms that Saviynt group management is not limited to visibility or request tracking; it supports the full operational lifecycle for AD groups when configured correctly.

Saviynt’s administrative documentation further explains that group management must be configured to enable users to create and manage groups in Saviynt Identity Cloud. That broader wording aligns with the specific lifecycle operations of create, update, and delete. Option D is incorrect because campaign launching is part of certification governance, not the core capability set of AD group management itself. A campaign may later review group-related access, but group management is fundamentally about administering the group object and its membership lifecycle. For Level 200 preparation, this distinction matters: group management handles the lifecycle of the group object, while campaigns handle review and attestation of access associated with identities, roles, or entitlements.