Saviynt Saviynt Certified Advanced IGA Professional (Level 200) SCAIP Exam Dumps: Updated Questions & Answers (May 2026)

In Saviynt EIC, workflows are internally represented inXML format, which defines the sequence of approval steps, conditions, and actions. The“Show XML”option is specifically designed to allow administrators toview the underlying XML structure of a workflow. However, this view is provided in aread-only mode, meaning administrators can inspect the configuration but cannot directly modify it from this option.

This feature is particularly useful fordebugging, auditing, and understanding workflow logic, especially in complex approval processes involving multiple steps and conditions. It helps administrators verify how a workflow is constructed without risking accidental changes to the configuration.

Option C is incorrect because editing workflow XML is not typically done directly through the “Show XML” view in Saviynt UI; modifications are handled through workflow configuration screens or controlled import/export processes. Option A is unrelated since Saviynt workflows are XML-based, not JSON-based. Option B is also incorrect because version history is managed separately and not through the Show XML option.

Thus, the correct purpose of “Show XML” is toview workflow configuration safely in read-only format.

The correct answer is A. Transfer Ownership . Saviynt documentation on User Update Rules explains that the purpose of Transfer Ownership is to change ownership, and specifically notes that service accounts can be reassigned to the OwnerOnTerminate user when the current owner is terminated. The documentation further states that when the current service account owner is terminated, a user update rule with the action Transfer Ownership is triggered so that service account ownership is moved appropriately. This directly matches the scenario in the question.

This is also consistent with Saviynt’s service account model, where every service account must have at least one designated owner who is authorized to manage it. Because ownership is required, Saviynt provides lifecycle controls to preserve accountable ownership when a human owner leaves the organization. The remaining options are unrelated. Run Role Mining belongs to analytics and role engineering, Launch Campaign belongs to certification processes, and Disable SMTP is an email configuration concept. For Level 200 understanding, the key takeaway is that automatic service account ownership continuity is handled through a User Update Rule using the Transfer Ownership action, often combined with OwnerOnTerminate configuration.

In Saviynt EIC, workflows are a core component used to control approval processes for access requests, provisioning, and other identity lifecycle events. These workflows can be configured at multiple levels depending on the scope and granularity required.

Security System (A)supports workflow configuration to define approval processes at the application level. This allows organizations to enforce consistent approval logic for all endpoints associated with that system.

Endpoint (B)also supports workflow configuration, enabling more granular control where different endpoints within the same security system may require distinct approval processes. This is particularly useful in complex environments with varied access control requirements.

Entitlement Type (D)supports workflows to manage approvals specific to entitlement categories (such as roles, groups, or permissions), ensuring appropriate governance at a finer level.

Global Configuration (C), while important for system-wide settings, is not typically used to directly assign active workflows to access requests. Instead, workflows are selected and applied within modules like Security System, Endpoint, and Entitlement Type.

Thus, the correct modules supporting active workflow configuration areSecurity System, Endpoint, and Entitlement Type.

In Saviynt EIC, when configuringdynamic attributes or custom forms, system variables are used to fetch context-specific data such as the currently logged-in user. To retrieve theDisplay Name of the logged-in user, the correct variable is${loggedInUser}, which directly represents the userkey of the active session user.

Option A correctly uses this variable in the SQL query to fetch the DISPLAYNAME from the Users table. This ensures that the attribute dynamically reflects the logged-in user's display name at runtime.

Option B is incorrect because${user.id}typically refers to the target user in a request context, not necessarily the logged-in user. Option C (${requestor}) may represent the requester in certain workflows but is not consistently equivalent to the logged-in user in all scenarios, especially in delegated or admin-driven requests.

Therefore, Option A is the most accurate and reliable approach for retrieving the logged-in user’s display name in Saviynt configurations, ensuring proper context-aware data population.

In Saviynt EIC, job scheduling is managed through theJob Control Panel, which provides flexible options to define when and how jobs such asUser Importare executed. The correct options for scheduling areCRON expressionandbuilt-in schedule options, makingA and Bcorrect.

Option A (CRON expression in Job trigger)allows administrators to define precise scheduling using CRON syntax. For example, scheduling a job at exactly 9 AM every day can be achieved using a CRON expression, offering high flexibility and control.

Option B (Schedule option - Hourly, Weekly, Daily, Minutes)provides a user-friendly way to configure job schedules without writing CRON expressions. Administrators can simply select “Daily” and specify 9 AM, making it easier for standard scheduling needs.

OptionC (Global configuration)is not used for scheduling jobs. OptionD (Externalconfig.properties file)is used for system-level configurations, not job scheduling.

Thus, Saviynt supports both CRON-based and UI-based scheduling mechanisms for job execution.

The correct answer is B. REST Connector . Saviynt documentation explains that REST integration is intended for applications whose data and lifecycle actions are available through REST endpoints. It states that the REST integration enables organizations to gain visibility, manage the user lifecycle, and govern access for data available in the REST application or REST endpoint. That directly matches the question, which requires imports plus provisioning and deprovisioning for an API-driven target system.

Saviynt’s REST connector documentation also notes that provisioning and deprovisioning are supported when the connection is configured correctly. This makes the REST connector the standard choice when the target system does not use an out-of-the-box native connector but does provide usable REST APIs. The other options do not fit the requirement. Active Directory Connector is specific to AD use cases, SMTP Configuration is only for email delivery, and Dataset Configuration is an administrative data-structuring feature rather than an application integration method. In Saviynt Level 200 terms, when an application is API-first and lifecycle actions must be automated, the REST connector is the appropriate design decision.

Saviynt EIC provides multiple standardized approaches for integrating applications, primarily focusing onconnector-based integrationandapplication onboarding via the Design module. OptionA (Classic integration using connectors)is correct because Saviynt supports a wide range of out-of-the-box connectors such as Active Directory, REST, JDBC, SAP, etc. These connectors enable provisioning, deprovisioning, and account aggregation, forming the foundation of application integration in Saviynt.

OptionB (Application Onboarding using Design module)is also correct and represents a modern and structured way of onboarding applications. The Design module simplifies integration by allowing administrators to configure applications, schemas, and connections using a guided UI-driven approach. It ensures consistency, faster onboarding, and better governance alignment.

OptionC (Using Connector framework)is incorrect because it is not considered a separate integration method from an administrator’s perspective; rather, it is the underlying technical architecture that supports connectors. OptionD (Upload Connection file)is also incorrect, as Saviynt does not define application integration as a file-upload-driven process in its standard onboarding methodology.

Thus, the two valid integration methods aligned with Saviynt IGA Level 200 documentation are connector-based integration and Design module onboarding.

In Saviynt EIC,Password Policy precedence and enforcementdepend on where the policy is configured within the hierarchy of Security System and Connector.

Option A is correct because when password policies are defined at both levels, theSecurity System-level policy takes precedence. This ensures centralized governance and consistency across all endpoints under that security system.

Option B is also correct since Saviynt allows administrators to control password change permissions at a granular level using the“Change Password Access Query”at the endpoint. This enables restriction of password changes based on user attributes or conditions.

Option C is incorrect because connector-level policies do not override security system-level configurations when both are present.

Option D is correct because if no policy is defined at the security system level, theconnector-level password policy will be applied by default, ensuring that password rules are still enforced.

Thus, the correct answers areA, B, and D, reflecting Saviynt’s hierarchical and flexible password policy framework.

In Saviynt EIC, identity data transformation and normalization during ingestion from authoritative sources like Workday are handled at theimport stage, specifically usingIMPORTUSERJSON. This JSON configuration governs how user data is fetched, parsed, and mapped into the Saviynt Identity Repository.

To meet the requirement of combining first name and last name into a full name and ensuring near real-time reflection of updates, aninline preprocessor within IMPORTUSERJSONis used. This allows administrators to apply transformation logic—such as concatenation, formatting, or conditional mapping—directly during the import process before the data is persisted in Saviynt.

OptionA (USERUPDATEJSON)andB (MODIFYUSERDATAJSON)are used for post-import updates or provisioning-related user modifications, not for initial transformation during ingestion. These do not meet the requirement of transforming data before it is stored in the Identity Repository.

OptionDis incorrect because Saviynt explicitly supports inline preprocessors in IMPORTUSERJSON for such use cases.

Thus, configuring an inline preprocessor inIMPORTUSERJSONis the correct and recommended approach for identity data normalization during import.

The correct answers are A, B, and C . Saviynt documentation for Active Directory group management states that the connector can be used to create, update, and delete AD or ADSI groups. It also supports related group-management functions such as updating group attributes and maintaining group membership and owners. This confirms that Saviynt group management is not limited to visibility or request tracking; it supports the full operational lifecycle for AD groups when configured correctly.

Saviynt’s administrative documentation further explains that group management must be configured to enable users to create and manage groups in Saviynt Identity Cloud. That broader wording aligns with the specific lifecycle operations of create, update, and delete. Option D is incorrect because campaign launching is part of certification governance, not the core capability set of AD group management itself. A campaign may later review group-related access, but group management is fundamentally about administering the group object and its membership lifecycle. For Level 200 preparation, this distinction matters: group management handles the lifecycle of the group object, while campaigns handle review and attestation of access associated with identities, roles, or entitlements.