SAVIGA-C01 Saviynt IGA Certified Professional Exam (L100) Questions and Answers

The Job that should be created and scheduled to evaluate Rules on a need basis in Saviynt is A. Run Detective Rules and Take Action . Here ' s an explanation:

Saviynt ' s Jobs: Saviynt uses Jobs to perform various tasks, including data imports, rule evaluations, and provisioning operations.

" Run Detective Rules and Take Action " : This specific job is designed to:

Evaluate Rules: It evaluates rules that are configured for detective (monitoring) purposes. These rules typically check for specific conditions or changes in user attributes, access rights, or other data.

Take Action (Optional): Based on the rule evaluation results, the job can be configured to automatically take actions, such as:

Generating alerts or notifications.

Creating tasks for administrators to review.

Triggering workflows.

Automatically remediating issues (e.g., revoking access if a rule detects a violation).

Scheduling: This job can be scheduled to run periodically (e.g., daily, hourly) to continuously monitor for changes and enforce defined rules.

On-Demand Execution: You can also run this job on-demand to evaluate rules immediately.

Other Options:

B. Provisioning Job: This job is primarily used for provisioning access to target systems, not for evaluating general-purpose rules.

C. User Import via Connection: This job is for importing user data from external sources.

D. Trigger Chain Job: This allows for running a series or " chain " of jobs, but it doesn ' t directly evaluate rules itself.

In this scenario, where John is a new full-time employee required to work from the Sydney office, the most specific and appropriate Enterprise Role assigned from the Birthright Rule would likely be A. Birthright - Sydney . Here ' s the reasoning:

Saviynt ' s Birthright Roles and Rules: Birthright roles are designed to automatically provision access based on specific criteria like location, job role, or employment type. Birthright rules define the conditions for assigning these roles.

Specificity of Role Assignment: The goal is to assign the most relevant and granular role based on the available information. In this case, John ' s location (Sydney) is the most specific criterion mentioned.

Why Other Options Are Less Likely:

B. Birthright - Permanent - Full-time: While John is a full-time employee, this role might be too broad if there are other location-specific roles.

C. Birthright - All: This role is likely too generic and would grant excessive access. It ' s generally not good practice to have an " all-encompassing " birthright role.

D. Birthright - Employee: Similar to the " Full-time " role, this might be too broad if location-specific roles are available.

Best Practices: It ' s a best practice in identity governance to use the most specific criteria possible when assigning birthright access. This helps enforce the principle of least privilege.

In summary: The " Birthright - Sydney " role is the most appropriate choice because it aligns with John ' s specific work location, ensuring he receives the necessary access for his role while adhering to the principle of least privilege.

User Account Correlation Rules in Saviynt are specifically designed to map imported accounts to existing users within the system. These rules define the logic for matching accounts to users based on various attributes, such as employee ID, email address, or username.

Why other options are incorrect:

Account to User Rule: This is not a standard rule type in Saviynt.

Account Name Rule: This might focus on naming conventions for accounts, not correlating them to users.

Technical Rule: This is a broader category of rules and doesn ' t specifically address account-user mapping.

Saviynt IGA References:

Saviynt Documentation: The section on Account Correlation Rules provides detailed information on how to configure these rules for different scenarios.

Saviynt Use Cases: Saviynt often provides examples and use cases demonstrating how to use User Account Correlation Rules to automate account mapping during imports.

To implement a workflow involving a Saviynt User Group ' s approval, the appropriate workflow block is B. TASK Access Approve . Here ' s an explanation:

Saviynt ' s Workflow Engine: Saviynt ' s workflow engine allows for the creation of complex approval processes using various building blocks or activities.

TASK Access Approve: This specific activity is designed to handle approval steps within a workflow. It allows you to define who the approver(s) should be and how the approval should be processed.

User Group Approval: To implement approval by a Saviynt User Group, you would configure the " TASK Access Approve " activity as follows:

Approver Type: You would select " User Group " as the approver type.

User Group Selection: You would then specify the particular Saviynt User Group that should be responsible for the approval.

Approval Logic: You can define whether all members of the group must approve, or if a certain number or percentage of approvals is sufficient.

Saviynt User Groups: User Groups in Saviynt are collections of users, often based on department, role, or other criteria. They are useful for managing access and approvals at a group level.

Other Options:

A. CONDITION IF Else: This block is used for branching logic in a workflow, not specifically for assigning approvals to user groups.

C. Action Prompt: This might be used for displaying information or collecting input, but not for defining an approval step.

D. TASK Custom Assignment: While you could potentially use custom assignment with scripting to achieve user group approval, the " TASK Access Approve " activity provides a more straightforward and built-in way to do it.

In conclusion: The " TASK Access Approve " workflow block in Saviynt, configured with a User Group as the approver type, is the most appropriate and direct way to implement a workflow that requires approval from a specific Saviynt User Group.

The type of Rule that should always be used in conjunction with the Organization object in Saviynt is the B. User Update Rule . Here ' s the explanation:

Saviynt ' s Organization Object: The Organization object in Saviynt represents the organizational structure or hierarchy (e.g., departments, locations, cost centers). It ' s often used to define relationships between users and organizational units.

User Update Rule: This type of rule is designed to automatically update user attributes based on changes in other user attributes or related objects.

Using Organization with User Update Rule: The User Update Rule is frequently used with the Organization object to automate user management based on organizational changes.

Example: You can create a User Update Rule that automatically assigns users to specific roles or groups based on their department (defined in the Organization object). If a user is moved to a different department, the rule will trigger and update their roles or group memberships accordingly.

Dynamic User Management: This combination enables dynamic user management, ensuring that user attributes and access rights are automatically adjusted as users move within the organization.

Other Options:

A. Technical Rule: Technical Rules are more general-purpose and can be used for various tasks, but they are not specifically tied to the Organization object.

C. Scan Rule: Scan Rules are used for data analysis and identifying potential issues, not for updating user attributes based on organizational structure.

D. Request Rule: Request Rules are related to access request workflows, not to automatic user updates.

In essence: The User Update Rule, when used in conjunction with the Organization object, provides a powerful way to automate user management in Saviynt, ensuring that user attributes and access rights are dynamically updated based on changes in the organizational structure.

In the given scenario, where ABC Company has a one-level workflow with the manager as the sole approver, and Margaret (Edward ' s manager) raises a request on behalf of Edward, the statement that would be true/applicable is A. Manager ' s approval is auto-approved . Here ' s why:

Saviynt ' s Workflow Configuration: Saviynt allows for the configuration of various workflow scenarios, including auto-approval based on certain conditions.

Self-Approval Prevention/Auto-Approval: A common security best practice is to prevent users from approving their own access requests. However, when a manager requests on behalf of a subordinate, this is considered a delegated request and many organizations find it acceptable to auto-approve since the approval should be implicit in the act of requesting.

Manager Requesting on Behalf: When a manager initiates a request for a subordinate, it ' s often considered an implicit approval. The manager is essentially saying, " I approve this access for my team member. "

Saviynt ' s Default Behavior (Typically): By default, or through common configuration practices, Saviynt is often set up to recognize this scenario and auto-approve the manager ' s approval step in the workflow. This streamlines the process and avoids unnecessary delays.

Configuration Options: While auto-approval is common, Saviynt ' s workflow engine is flexible. It ' s possible to configure it differently, for instance, to still require explicit manager approval even in this scenario. However, this is less typical.

Other Options:

B. Manager ' s approval is auto-rejected: This is highly unlikely and would defeat the purpose of having a manager initiate the request.

C. Manager must manually approve/reject the request: While possible through configuration, it ' s not the typical or default behavior in this scenario.

D. None of the above: Option A is the most likely and common outcome.

In summary: In a one-level workflow where the manager is the approver, and the manager requests access on behalf of a subordinate, Saviynt is typically configured to auto-approve the manager ' s approval step, streamlining the process and reflecting the implicit approval inherent in the manager ' s action.

=================

To automatically deprovision birthright access when the defining condition fails, the correct option is C. Remove the birthright Access if the condition fails under the created Rule. Here ' s a detailed explanation:

Saviynt ' s Birthright Access (Automatic Provisioning): Saviynt allows administrators to define rules that automatically grant access (birthright access) based on user attributes or other criteria (e.g., new hires in a specific department automatically get access to certain applications).

Rule-Based Access Management: These rules are a core part of Saviynt ' s access management capabilities, allowing for dynamic and automated provisioning.

" Remove the birthright Access if the condition fails " : This option, typically found within the birthright rule configuration itself, is crucial for ensuring that access is revoked when the conditions that granted it are no longer met.

Example: If a user is granted access to an application because they are in the " Sales " department, and they are later moved to the " Marketing " department, the condition for the birthright rule would fail, and Saviynt would automatically deprovision the access.

Saviynt ' s Continuous Monitoring: Saviynt continuously monitors user attributes and rule conditions. When a change occurs that causes a condition to fail, the deprovisioning action is triggered.

Other Options:

A. Remove the Access Rule: This would remove the entire rule, preventing it from granting access to anyone, not just the user whose condition has failed.

B. Apply a new Technical Rule to remove the Access: While technically possible, it ' s less efficient and more complex than using the built-in option within the birthright rule.

D. Use the Request Rule: Request Rules are for access requests, not for automatically provisioning or deprovisioning birthright access.

=================

To set up an Entitlement Owner Campaign for Entitlements belonging to an Oracle ERP Endpoint that launches at the beginning of every month, and includes only Accounts and Entitlements that meet the prerequisites, the 2-key configurations you should recommend are A. Use Campaign Template and the Schedule Later option . Here ' s a breakdown:

Campaign Template:

Purpose: Templates allow you to save a set of campaign configurations as a reusable template. This is ideal for recurring campaigns with consistent settings.

Benefits: Using a template saves time and ensures consistency across multiple campaign instances. You can define the scope (Oracle ERP Endpoint), Certifier type (Entitlement Owners), and other settings within the template.

Prerequisites: You can include logic within the template to filter for Accounts and Entitlements that meet the defined prerequisites.

Schedule Later option:

Purpose: This option allows you to schedule the campaign to launch at a specific date and time in the future.

Recurring Scheduling: You can configure the campaign to run on a recurring schedule, such as the beginning of every month.

Automation: This automates the campaign launch process, eliminating the need for manual intervention each month.

Why Other Options Are Less Suitable:

B. Use Advanced Configurations and Preview mode and create the Campaign at the beginning of each month: This approach is manual and prone to errors. It doesn ' t leverage the automation benefits of templates and scheduling.

C. Use Advanced Configurations and set the Campaign expiry to 31 days: While setting an expiry is important, it doesn ' t address the need for recurring monthly launches or using a template for consistent configuration.

D. Cannot be achieved: This is incorrect; the scenario can be easily achieved using Campaign Templates and the Schedule Later option.

=================

The option that cannot be regarded as a Smart Filter in Saviynt ' s User Manager and Service Account Campaigns is A. User ' s Assigned Role counts . Here ' s why:

Saviynt ' s Smart Filters: Smart Filters are pre-defined filters in Saviynt that help Certifiers quickly focus on specific access patterns or risk indicators during a certification campaign. They are designed to highlight potentially problematic or high-risk access.

Examples of Smart Filters:

B. Access with SoD Violations: This is a Smart Filter because it highlights access that violates Segregation of Duties policies, a significant risk indicator.

C. Out-of-Band Access for Entitlements: This is a Smart Filter as it identifies access that was granted outside of the normal Saviynt processes, potentially indicating a security risk.

D. Risk Level for Accounts: This is a Smart Filter because it allows Certifiers to focus on accounts with high-risk levels, which might require more scrutiny.

Why " User ' s Assigned Role counts " Is Not a Smart Filter:

Not a Risk Indicator: Simply knowing the number of roles assigned to a user doesn ' t inherently indicate a risk or a specific access pattern that requires attention. A user might have many roles legitimately, or they might have few roles but with high-risk access.

Not Actionable: This information alone doesn ' t provide enough context for a Certifier to make an informed decision about whether to approve or revoke access.

Alternative: While not a " Smart Filter " , the number of roles assigned could be a data point displayed within the campaign, but it wouldn ' t be considered a pre-defined filter for highlighting risks.

=================

The connection type best suited to expose Workday reports as a data service in Saviynt is A. Workday-RAAS (Report as a Service) . Here ' s why:

Workday-RAAS: This connection type is specifically designed to integrate with Workday ' s RaaS functionality. Workday RaaS allows you to expose custom reports created within Workday as web services that can be consumed by external applications like Saviynt.

Data Service for Reports: RaaS essentially turns a Workday report into a data service, making it easy to retrieve the report ' s data in a structured format (typically XML or JSON).

Saviynt ' s Integration: Saviynt ' s Workday-RAAS connection type is built to leverage this capability, allowing you to:

Select Workday Reports: Choose the specific Workday reports you want to integrate with.

Import Data: Import the data from those reports into Saviynt for various purposes (e.g., identity governance, access certification, analytics).

Schedule Imports: Schedule regular data imports to keep Saviynt ' s data synchronized with Workday.

Why Other Options Are Less Suitable:

B. Workday-REST: While Workday has a REST API, it ' s more general-purpose and not specifically tailored for exposing reports as data services in the same way as RaaS.

C. Workday-OAuth: OAuth is an authorization protocol, not a connection type for retrieving report data.

D. Workday-SOAP: Workday ' s SOAP API is being gradually replaced by the REST API and is less focused on report data retrieval than RaaS.

=================

To view the Entitlements Query used in a previously launched Campaign in Saviynt, a Campaign Owner can use the C. Campaign Summary . Here ' s why:

Saviynt ' s Campaign Summary: The Campaign Summary provides a detailed overview of a campaign ' s configuration, including:

Campaign Scope: The users, applications, or entitlements included in the campaign.

Filters and Queries: Any filters or queries used to define the campaign scope, including the Entitlements Query.

Certifier Information: Details about the assigned certifiers.

Schedule: The campaign ' s start and end dates.

Status: The current status of the campaign (e.g., Active, Completed, Expired).

Accessing the Entitlements Query: The Campaign Summary typically includes a section that displays the exact query used to select the entitlements included in the campaign.

Why Other Options Are Less Suitable:

A. Reconfigure option: While you might be able to see the query by going into the reconfiguration, it ' s not the most direct way. The Campaign Summary is designed to provide this information readily.

B. Campaign Export: Exporting the campaign data might include the list of entitlements but not necessarily the original query used to select them.

D. Export option at the top right corner of the page, next to the Refresh Progress option: This option typically exports the current view of the campaign data, not the underlying configuration details like the Entitlements Query.

In conclusion: The Campaign Summary in Saviynt is the most direct and convenient place for a Campaign Owner to review the detailed configuration of a campaign, including the Entitlements Query used to define the campaign ' s scope.

=================

The statement " An Application Owner Campaign can have multiple primary Certifiers and a single secondary Certifier " is generally False in Saviynt. Here ' s why:

Saviynt ' s Application Owner Campaign: This campaign type is designed for Application Owners to review and certify access to their applications.

Primary Certifier: There is usually a single designated Application Owner for each application. This is because application ownership is typically a single point of accountability. While it is technically possible to assign multiple owners, it is not considered a best practice.

Secondary Certifiers (Backup/Delegates): Application Owner Campaigns can have multiple secondary certifiers. These are often used as:

Backup: To ensure the campaign can proceed if the primary certifier is unavailable.

Delegates: To allow the primary certifier to delegate some of the certification tasks.

Consultants: Other stakeholders, such as security or compliance teams, who can be consulted during the decision-making process.

Why the Statement Is Generally False: The core principle of application ownership implies a single point of accountability. While multiple secondary certifiers can assist, having multiple primary certifiers can lead to confusion and conflicting decisions.

Possible Exceptions (Less Common):

Highly Customized Configurations: In some very specific scenarios, organizations might customize Saviynt to allow multiple primary certifiers for an application, but this is not a standard or recommended practice.

In Saviynt, Enterprise Roles are specifically designed to encompass entitlements that span multiple applications. This is in contrast to Application Roles, which are limited to entitlements within a single application.

Enterprise Roles: Provide a way to group entitlements across different applications, reflecting a user ' s overall job function or responsibilities within the organization. This is essential for managing access for users who need permissions in various systems to perform their duties.

Other Role Types:

Application Role: Grants permissions specific to a single application.

Transactional Role: Focuses on granting permissions for specific tasks or transactions within an application.

Enabler Role: Provides supplementary permissions that enhance or support other roles.

Saviynt IGA References:

Saviynt Documentation: The section on Role Management within Saviynt ' s documentation clearly defines the different role types and their purposes.

Saviynt Training Materials: Saviynt ' s training courses emphasize the importance of Enterprise Roles in managing cross-application access.

The bulk operation that is not typically a supported feature in the same way as the others is C. Bulk Approval - Single-click approval for multiple entitlements in a single request. Here ' s why:

Saviynt ' s Bulk Operations: Saviynt supports various bulk operations to streamline administration and user experience, especially when dealing with multiple users or requests.

Supported Bulk Operations:

A. Bulk Request Access: Saviynt allows users to request access for multiple users in a single request. This is a common and supported feature.

B. Disabling multiple users and their access: Administrators can disable multiple user accounts and revoke their access in bulk.

D. Deleting multiple users: Saviynt supports the bulk deletion of user accounts.

Bulk Approval - Granularity: While Saviynt supports bulk approvals (approving multiple requests at once), it typically operates at the request level , not at the individual entitlement level within a single request. Approving multiple separate requests in one go is a standard bulk approval action.

Each request (even if it ' s a bulk request for multiple users or contains multiple entitlements) is usually treated as a single unit for approval.

Approvers typically approve or reject the entire request, not individual entitlements within it.

Security and Control: This approach maintains better control and auditability. Approving each entitlement within a single request individually would require a more complex interface and potentially increase the risk of accidental approvals.

Possible Workarounds:

Separate Requests: To achieve a similar outcome, users could submit separate requests for each entitlement, allowing the approver to approve them individually (and potentially in bulk if they are separate requests).

Custom Workflows: In theory, it might be possible to create highly customized workflows to handle this scenario, but it ' s not a standard out-of-the-box feature.

In summary: While Saviynt excels at bulk operations for users and requests, single-click approval of individual entitlements within a single request is not a typical supported feature due to the need for granular control and a clear audit trail. Bulk approvals usually apply to entire requests, not to individual entitlements within them.

=================

The formats suitable for downloading an Analytics report in Saviynt typically include A. CSV file and Excel Sheet . Here ' s an explanation:

Saviynt ' s Reporting Capabilities: Saviynt provides options for exporting and downloading analytics reports in various formats to facilitate data sharing and further analysis.

Common Export Formats:

CSV (Comma Separated Values): A widely used format for storing tabular data in plain text. It ' s easily imported into various data analysis tools and spreadsheet programs.

Excel Sheet (e.g., .xlsx): A popular spreadsheet format that allows for data organization, formatting, and calculations.

Why These Formats Are Suitable:

Data Analysis: Both CSV and Excel formats are well-suited for further data analysis and manipulation.

Reporting: They are commonly used for creating reports and sharing data with stakeholders.

Compatibility: Most data analysis and reporting tools support these formats.

Other Less Common Options: While less frequent, Saviynt might offer other export formats like PDF, depending on the specific version and configuration.

B. Text file: Although technically a text file, a raw .txt export might not be as useful for structured data like analytics reports. CSV would be preferred.

In conclusion: CSV and Excel are the most common and practical formats for downloading analytics reports from Saviynt, offering flexibility for data analysis, reporting, and sharing.