SAVIGA-C01 Saviynt IGA Certified Professional Exam (L100) Questions and Answers

The image signifies B. Assigning of Enterprise Role based on users' location. Here's a breakdown, assuming the image depicts a portion of a Saviynt User Update Rule configuration:

Dynamic Variable "City": The image highlights the use of a dynamic variable called "city." This strongly suggests that the rule is using the user's location (city) as a key factor in determining role assignment.

Saviynt's User Update Rules and Dynamic Variables: User Update Rules in Saviynt allow for the use of dynamic variables, which represent user attributes. These variables can be used in conditions and actions within the rule.

Enterprise Role Assignment: The context of the question implies that the rule is assigning an Enterprise Role based on the value of this "city" variable.

Example: The rule might be configured to assign an Enterprise Role like "Sydney-Users" to users whose "city" attribute is "Sydney."

Why Other Options Are Less Likely:

A. Assigning of Enterprise Role based on users' department: There's no mention of "department" in the provided information.

C. Assigning of Enterprise Role based on concatenation of dynamic variable city and Finance: While concatenation is possible in Saviynt, there's no indication that "Finance" is involved here. The focus seems to be solely on the "city" variable.

In conclusion: Based on the information given, the image most likely represents a Saviynt User Update Rule that assigns an Enterprise Role based on the user's location, as indicated by the dynamic variable "city.

=================

An AD Connection in Saviynt is required to establish communication and data exchange with an Active Directory (AD) domain. This connection enables Saviynt to automatically reconcile accounts from AD, ensuring that the identity information in Saviynt stays synchronized with the AD.

Why other options are incorrect:

AD Control, AD Rule, AD Role: These terms are not standard components within Saviynt's framework for integrating with Active Directory.

Saviynt IGA References:

Saviynt Documentation: The section on integrating with Active Directory clearly outlines the need for an AD Connection and provides step-by-step instructions for configuring it.

Saviynt Connectors: Saviynt offers pre-built connectors for Active Directory that simplify the process of establishing the connection.

Given that an Admin launched a Role Ownership Campaign for you in Saviynt, the option you can not certify is A. Role Ownership. Here's why:

Saviynt's Role Ownership Campaign: This type of campaign is specifically designed for reviewing and certifying the ownership of roles, not the other aspects of a role.

Your Role as Certifier: In this scenario, you are the designated reviewer for role ownership. This means you are responsible for confirming who should be the owner of specific roles.

What You Can Certify in a Role Ownership Campaign:

Confirm or Change Role Owner: You can confirm that the current role owner is correct or assign a new owner.

What You Cannot Certify in This Campaign:

A. Role Ownership: You are the one certifying role ownership, so you cannot certify your own action of assigning an owner. It would be a circular process.

B. User membership of the Role: This is typically reviewed in a User Access Campaign or a Role Membership Campaign.

C. Delete Role: Role deletion is an administrative action, not typically part of a Role Ownership Campaign.

D. Associated Entitlements: Entitlement certification is usually handled in an Entitlement Owner Campaign or as part of a broader User Access Campaign.

In essence: A Role Ownership Campaign focuses solely on validating and assigning role owners. Other aspects of role management, such as user membership or associated entitlements, are handled in different campaign types or through separate administrative actions. As the certifier in this specific campaign, you cannot certify the very action you are performing, which is assigning role ownership.

The component that filters the requestable applications under "Request New Access" in Saviynt is the Access Query. Here's a detailed explanation:

Saviynt's Access Request System (ARS): As the front end for requesting access, the ARS needs a mechanism to determine which applications (and entitlements) should be displayed to a user as requestable.

Access Query: This is a powerful feature within Saviynt that allows administrators to define specific criteria to control the visibility of applications and entitlements in the ARS. Think of it as a filter that determines what a user can see and request.

How Access Queries Work:

Defined on Applications/Entitlements: Access Queries are configured on individual applications or entitlements within Saviynt.

Based on User Attributes: They use user attributes (e.g., department, location, job title, group memberships) and other criteria (e.g., risk level) to determine if a user should see a particular application or entitlement.

Dynamic Filtering: When a user accesses the "Request New Access" section, Saviynt evaluates the Access Queries associated with each application and entitlement in real-time. Based on the user's attributes, the system dynamically filters the list, showing only the applications and entitlements that match the query conditions.

Saviynt's Security Model: Access Queries are a fundamental part of Saviynt's security model. They ensure that users are only presented with access options that are relevant and appropriate for their role and context, preventing accidental over-provisioning and reducing the attack surface.

Other Options:

Access Add Workflow: While essential for processing access requests, the workflow itself doesn't filter which applications are initially displayed.

Provisioning Connection: This relates to how Saviynt connects to target systems for automated provisioning. It doesn't control the initial visibility of applications in the ARS.

Whom to Request: This setting might determine the available approvers, but it doesn't filter the list of requestable applications.

In essence: Access Queries act as a dynamic filter, leveraging user attributes and defined criteria to determine which applications and entitlements are presented to a user within Saviynt's "Request New Access" interface, ensuring a personalized and secure access request experience.

=================

In the given scenario, where ABC Company has a one-level workflow with the manager as the sole approver, and Margaret (Edward's manager) raises a request on behalf of Edward, the statement that would be true/applicable is A. Manager's approval is auto-approved. Here's why:

Saviynt's Workflow Configuration: Saviynt allows for the configuration of various workflow scenarios, including auto-approval based on certain conditions.

Self-Approval Prevention/Auto-Approval: A common security best practice is to prevent users from approving their own access requests. However, when a manager requests on behalf of a subordinate, this is considered a delegated request and many organizations find it acceptable to auto-approve since the approval should be implicit in the act of requesting.

Manager Requesting on Behalf: When a manager initiates a request for a subordinate, it's often considered an implicit approval. The manager is essentially saying, "I approve this access for my team member."

Saviynt's Default Behavior (Typically): By default, or through common configuration practices, Saviynt is often set up to recognize this scenario and auto-approve the manager's approval step in the workflow. This streamlines the process and avoids unnecessary delays.

Configuration Options: While auto-approval is common, Saviynt's workflow engine is flexible. It's possible to configure it differently, for instance, to still require explicit manager approval even in this scenario. However, this is less typical.

Other Options:

B. Manager's approval is auto-rejected: This is highly unlikely and would defeat the purpose of having a manager initiate the request.

C. Manager must manually approve/reject the request: While possible through configuration, it's not the typical or default behavior in this scenario.

D. None of the above: Option A is the most likely and common outcome.

In summary: In a one-level workflow where the manager is the approver, and the manager requests access on behalf of a subordinate, Saviynt is typically configured to auto-approve the manager's approval step, streamlining the process and reflecting the implicit approval inherent in the manager's action.

=================

When an "Add Access" task is successfully completed in Saviynt, the applicable status is typically "Provisioned." Here's a detailed explanation with Saviynt references:

Saviynt's Task Management: Saviynt uses tasks to track the progress of various operations, including access provisioning. These tasks are generated as part of workflows, such as the "Access Add Workflow."

"Add Access" Task Type: This specific task type is created when the access request is approved and the system is ready to grant the requested access to the target application.

Task Statuses in Saviynt: Saviynt uses different statuses to indicate the current state of a task. Common statuses include:

Pending: The task is waiting to be processed.

In Progress: The task is currently being executed.

Provisioned: This status signifies that the requested access has been successfully granted to the user in the target system.

Failed: The task encountered an error and could not be completed.

Manually Provisioned: The task was completed manually by an administrator, rather than through automated provisioning.

Success: While sometimes used, this status is less specific than "Provisioned" in the context of "Add Access" tasks, since it does not specify that the action completed was a provisioning action.

Active: Typically applies to accounts or users, not tasks.

Saviynt's Workflow Engine: The workflow engine in Saviynt updates the task status as it progresses through the defined steps. For connected applications, the workflow engine might directly interact with the target system's API to provision the access. Once the provisioning is successful, the status is updated to "Provisioned."

Saviynt's Audit Trails: Saviynt maintains detailed audit trails, and the task status changes are logged. This provides a clear record of when access was provisioned for a user.

Other Options:

Success: As mentioned above, this is a general status. While technically correct (the task succeeded), "Provisioned" provides more context.

Manually Provisioned: This status is only applicable if an administrator intervened and manually granted the access outside of the automated workflow.

Active: This status typically pertains to a user or account's overall status, not specifically to the completion of an "Add Access" task.

=================

The process of Attestation or Certification in the context of Saviynt can be best described as B. Access Reviews. Here's why:

Attestation/Certification: These terms are often used interchangeably in the context of identity governance. They refer to the process of formally reviewing and approving or revoking user access rights.

Access Reviews: This is the broader term that encompasses the entire process of periodically reviewing user access to ensure it is appropriate and aligned with business needs and security policies. Attestation and Certification are specific actions performed within an access review.

Saviynt's Campaigns: Saviynt's campaigns are designed to facilitate and manage access reviews.

Why Other Options Are Less Suitable:

A. Segregation of Duties: SoD is a principle that aims to prevent fraud and errors by dividing critical tasks among different individuals. While access reviews can help enforce SoD, they are not the same thing.

C. Access Request: This is the process of requesting access to resources, which is a separate process from reviewing existing access.

D. Application Onboarding: This is the process of integrating an application into Saviynt, which is a prerequisite for access reviews but not the review process itself.

In conclusion: Attestation or Certification, as performed within Saviynt campaigns, are integral parts of the broader process of Access Reviews, which aim to ensure that user access is appropriate, authorized, and aligned with security policies.

=================

The statement "An Application Owner Campaign can have multiple primary Certifiers and a single secondary Certifier" is generally False in Saviynt. Here's why:

Saviynt's Application Owner Campaign: This campaign type is designed for Application Owners to review and certify access to their applications.

Primary Certifier: There is usually a single designated Application Owner for each application. This is because application ownership is typically a single point of accountability. While it is technically possible to assign multiple owners, it is not considered a best practice.

Secondary Certifiers (Backup/Delegates): Application Owner Campaigns can have multiple secondary certifiers. These are often used as:

Backup: To ensure the campaign can proceed if the primary certifier is unavailable.

Delegates: To allow the primary certifier to delegate some of the certification tasks.

Consultants: Other stakeholders, such as security or compliance teams, who can be consulted during the decision-making process.

Why the Statement Is Generally False: The core principle of application ownership implies a single point of accountability. While multiple secondary certifiers can assist, having multiple primary certifiers can lead to confusion and conflicting decisions.

Possible Exceptions (Less Common):

Highly Customized Configurations: In some very specific scenarios, organizations might customize Saviynt to allow multiple primary certifiers for an application, but this is not a standard or recommended practice.

The object that is available in the User Update Rule to configure Rule conditions in Saviynt is A. Users. Here's an explanation:

User Update Rule Purpose: As mentioned before, User Update Rules are used to automatically update user attributes based on certain conditions.

Condition Based on User Attributes: The conditions for triggering a User Update Rule are primarily based on attributes of the User object itself.

Examples of User Attributes: These attributes can include:

User Status: (e.g., Active, Inactive, Disabled)

Department:

Location:

Job Title:

Manager:

Custom Attributes: Any custom attributes defined for users in your Saviynt environment.

Triggering the Rule: When a user's attributes change, and those changes match the conditions defined in a User Update Rule, the rule is triggered.

Other Options:

B. Accounts: While account attributes can be updated as an action of a User Update Rule, the conditions for triggering the rule are typically based on user attributes, not account attributes.

C. Roles: Similar to accounts, roles can be assigned or removed as an action of a User Update Rule, but the triggering conditions are usually based on user attributes.

D. Entitlements: Entitlements are also typically managed as an action of a User Update Rule, not as part of the triggering condition.

In conclusion: The User object and its attributes are the primary focus for defining conditions within a Saviynt User Update Rule. Changes to user attributes trigger the rule, which can then perform actions such as updating other user attributes, accounts, roles, or entitlements.

The feature that best describes the Authorization mechanism for the EIC (Enterprise Identity Cloud) application in Saviynt is A. Security System. Here's an explanation:

Saviynt's Security System: This is the core component within Saviynt that handles authentication and authorization for various applications and resources, including EIC.

Authorization in EIC: The Security System determines what actions users are allowed to perform within EIC, such as:

Creating, updating, or deleting users.

Managing roles and entitlements.

Running reports.

Configuring connections.

Role-Based Access Control (RBAC): The Security System typically uses RBAC to manage these permissions. Users are assigned to roles, and roles are granted specific permissions within EIC.

Why Other Options Are Less Relevant:

B. SSO (Single Sign-On): SSO is an authentication mechanism that allows users to log in once and access multiple applications. While Saviynt supports SSO, it's not the primary authorization mechanism for EIC.

C. WSRETRY Job: This is a job related to retrying web service calls, not authorization.

In this scenario, where John is a new full-time employee required to work from the Sydney office, the most specific and appropriate Enterprise Role assigned from the Birthright Rule would likely be A. Birthright - Sydney. Here's the reasoning:

Saviynt's Birthright Roles and Rules: Birthright roles are designed to automatically provision access based on specific criteria like location, job role, or employment type. Birthright rules define the conditions for assigning these roles.

Specificity of Role Assignment: The goal is to assign the most relevant and granular role based on the available information. In this case, John's location (Sydney) is the most specific criterion mentioned.

Why Other Options Are Less Likely:

B. Birthright - Permanent - Full-time: While John is a full-time employee, this role might be too broad if there are other location-specific roles.

C. Birthright - All: This role is likely too generic and would grant excessive access. It's generally not good practice to have an "all-encompassing" birthright role.

D. Birthright - Employee: Similar to the "Full-time" role, this might be too broad if location-specific roles are available.

Best Practices: It's a best practice in identity governance to use the most specific criteria possible when assigning birthright access. This helps enforce the principle of least privilege.

In summary: The "Birthright - Sydney" role is the most appropriate choice because it aligns with John's specific work location, ensuring he receives the necessary access for his role while adhering to the principle of least privilege.

The formats suitable for downloading an Analytics report in Saviynt typically include A. CSV file and Excel Sheet. Here's an explanation:

Saviynt's Reporting Capabilities: Saviynt provides options for exporting and downloading analytics reports in various formats to facilitate data sharing and further analysis.

Common Export Formats:

CSV (Comma Separated Values): A widely used format for storing tabular data in plain text. It's easily imported into various data analysis tools and spreadsheet programs.

Excel Sheet (e.g., .xlsx): A popular spreadsheet format that allows for data organization, formatting, and calculations.

Why These Formats Are Suitable:

Data Analysis: Both CSV and Excel formats are well-suited for further data analysis and manipulation.

Reporting: They are commonly used for creating reports and sharing data with stakeholders.

Compatibility: Most data analysis and reporting tools support these formats.

Other Less Common Options: While less frequent, Saviynt might offer other export formats like PDF, depending on the specific version and configuration.

B. Text file: Although technically a text file, a raw .txt export might not be as useful for structured data like analytics reports. CSV would be preferred.

In conclusion: CSV and Excel are the most common and practical formats for downloading analytics reports from Saviynt, offering flexibility for data analysis, reporting, and sharing.

It is True that multiple indices can be selected while creating Analytics using the Elasticsearch Query in Saviynt. Here's why:

Saviynt's Analytics and Elasticsearch: Saviynt's analytics capabilities are often built on top of Elasticsearch, a powerful search and analytics engine.

Indices in Elasticsearch: In Elasticsearch, an index is like a database table. It's a collection of documents with similar characteristics. Saviynt uses indices to store various types of data, such as user data, account data, entitlement data, and event logs.

Multi-Index Queries: Elasticsearch allows you to query across multiple indices simultaneously. This is a fundamental feature of the search engine.

Saviynt's Interface: When creating analytics in Saviynt using Elasticsearch queries, the interface typically allows you to select multiple indices as the data source for your analysis.

Use Cases: This capability is essential for creating comprehensive analytics that span different data domains. For example, you might want to analyze user access patterns (from one index) in conjunction with application usage data (from another index).

In conclusion: The ability to select multiple indices is a core feature of Elasticsearch and is supported within Saviynt's analytics interface,

=================

The UIADMIN ROLE in Saviynt grants users the privilege to edit UI (User Interface) labels. This role is crucial for customizing the Saviynt interface to align with an organization's terminology and branding.

UI Customization: Saviynt allows administrators to modify various UI elements, including labels, to improve user experience and comprehension. The UIADMIN ROLE provides the necessary permissions for these modifications.

Why other options are incorrect:

The other options are not standard Saviynt roles and do not have any associated privileges for UI label editing.

Saviynt IGA References:

Saviynt Documentation: The documentation on Saviynt's administration and configuration settings includes information about UI customization and the associated UIADMIN ROLE.

Saviynt Support: Saviynt's support resources may contain articles or knowledge base entries related to UI customization and the permissions required.

The option that cannot be regarded as a Smart Filter in Saviynt's User Manager and Service Account Campaigns is A. User's Assigned Role counts. Here's why:

Saviynt's Smart Filters: Smart Filters are pre-defined filters in Saviynt that help Certifiers quickly focus on specific access patterns or risk indicators during a certification campaign. They are designed to highlight potentially problematic or high-risk access.

Examples of Smart Filters:

B. Access with SoD Violations: This is a Smart Filter because it highlights access that violates Segregation of Duties policies, a significant risk indicator.

C. Out-of-Band Access for Entitlements: This is a Smart Filter as it identifies access that was granted outside of the normal Saviynt processes, potentially indicating a security risk.

D. Risk Level for Accounts: This is a Smart Filter because it allows Certifiers to focus on accounts with high-risk levels, which might require more scrutiny.

Why "User's Assigned Role counts" Is Not a Smart Filter:

Not a Risk Indicator: Simply knowing the number of roles assigned to a user doesn't inherently indicate a risk or a specific access pattern that requires attention. A user might have many roles legitimately, or they might have few roles but with high-risk access.

Not Actionable: This information alone doesn't provide enough context for a Certifier to make an informed decision about whether to approve or revoke access.

Alternative: While not a "Smart Filter", the number of roles assigned could be a data point displayed within the campaign, but it wouldn't be considered a pre-defined filter for highlighting risks.

=================