SCAIP Practice Questions

Technical rules in Saviynt EIC are event-driven and trigger based on user lifecycle events. They execute when a user's record is created or updated, and the new or modified user data matches the rule's defined condition. This includes bulk user imports (B), interactive user creation via the UI (C), and updates to existing user profiles (D). The rule's configuration (e.g., "Run on User Create" or "Run on User Update") determines which specific event will trigger its execution.

A. User deletion is a terminal lifecycle event that typically triggers deprovisioning workflows or offboarding processes, not the standard technical rule execution engine designed for create/update events.

Saviynt Enterprise Identity Cloud (EIC) Documentation, "Technical Rules Guide," Section: Introduction to Technical Rules, Subsection: Rule Triggers and Execution.

Saviynt Enterprise Identity Cloud (EIC) Documentation, "User Lifecycle Management Guide," Section: User Import and Reconciliation.

In Saviynt EIC's Service Account Management, the succession of ownership upon the termination of the current owner is handled via a specific attribute on the service account object itself. The "Owner On Terminate" attribute is configured directly on the service account. When the owner's identity is terminated in EIC, the system workflow reads this attribute on the service account to identify and assign the designated new owner, ensuring business continuity and accountability for the account.

A. While SQL queries can be used for custom logic, the standard, out-of-the-box process for owner succession relies on direct attribute configuration, not a global query.

B. Placing this attribute on the owner's user profile would be less flexible, as it would apply the same successor to all service accounts they own.

C. The Manage Owners Page is for viewing and managing current ownership assignments, not for configuring contingent succession logic for future termination events.

- Saviynt EIC Documentation, "Service Account Management," Section: "Configuring Service Accounts." This section details the available attributes for a service account, including "Owner On Terminate" and its function in the owner termination workflow.

- Saviynt Training Courseware, "Module: Privileged Access Management," Topic: "Service Account Lifecycle." The course material illustrates the workflow for owner termination, highlighting the lookup of the "Owner On Terminate" attribute on the service account.

In Saviynt EIC, the accountname for a service account is generated based on rules. The Service Account Name Rule, configured at the Endpoint level, specifically defines the naming convention for service accounts, overriding any global rules. This logical rule is then implemented within the Create Account JSON of the connection configuration. This JSON script retrieves user and endpoint attributes and applies the rule to construct the final accountname attribute that is sent to the target system for provisioning. Both the rule definition and its implementation in the JSON are essential parts of the creation process.

B. Manual entry is a possibility depending on form design but is not the configured, automated rule-based method for creation.

C. The Account Name Rule in Global Configurations applies to standard user accounts, not specifically to service accounts, and is overridden by endpoint-level rules.

1. Saviynt Enterprise Identity Cloud (EIC) Documentation, "Configuring Endpoints for Provisioning," Section 5.4: Service Account Management, pp. 112-114.

2. Saviynt Enterprise Identity Cloud (EIC) Documentation, "Connector Guide: REST," Section 4.2: Configuring Provisioning JSONs, pp. 45-47.

The IMPORTUSERJSON configuration is specifically designed to be used with an inline preprocessor during the user import reconciliation process. It allows for the manipulation and transformation of raw data fetched from the source system (like Workday) before it is saved into the Saviynt Identity Repository. This is the correct place to implement logic for combining attributes, such as concatenating firstname and lastname to create a fullname, ensuring the data is normalized upon entry into EIC.

A. USERUPDATEJSON is used for processing near real-time user attribute updates from a source, not for the bulk transformation logic during the initial import reconciliation.

B. MODIFYUSERDATAJSON is not a standard Saviynt JSON configuration name for pre-processing user import data in this context.

D. An option is available and correct. IMPORTUSERJSON directly addresses the requirement described in the scenario.

1. Saviynt Enterprise Identity Cloud (EIC) Documentation, "Connector Guide" for relevant application (e.g., Workday). The section on "Configuring the Connector for Import" details the use of IMPORTUSERJSON for data transformation.

2. Saviynt EIC Documentation, "Administrator Guide", Chapter on Data Integration and Connectors, Section on "Inline Preprocessor" and its JSON configurations.

Saviynt EIC offers two primary, distinct methods for integrating and onboarding applications. The "Classic integration using connectors" is the traditional method where an administrator manually selects and configures a connector from the Admin console. The "Application Onboarding using Design module" is a modern, wizard-based approach that provides a guided, streamlined user experience for connecting applications, configuring schemas, and setting up provisioning logic. Both methods are built upon Saviynt's core connector framework but represent different administrative experiences.

C. The "Connector framework" is the underlying technology that enables connectivity; it is not a user-facing integration method itself but the foundation for both A and B.

D. Uploading a connection file is a specific action or step that can be part of an integration process (e.g., for bulk onboarding), not a standalone integration method.

Saviynt EIC Documentation, Application Integration Guide, Section: "Choosing an Application Onboarding Method," Document ID: EIC-AIG-v2023.1, pp. 5-7. This chapter introduces and contrasts the two primary methods: the classic connector configuration and the modern Application Onboarding module.

When analyzing the results of a Segregation of Duties (SOD) Risk Evaluation Job, the EIC interface provides several powerful filtering capabilities to help administrators investigate violations. Analysts can filter the violation data by specific Users to review all risks associated with an individual. They can also filter by Security System to focus on violations within a single application (e.g., SAP or Oracle). Furthermore, filtering by Ruleset allows for analysis of violations against a specific regulatory or policy framework (e.g., SOX, GDPR).

D. "User Account Evaluation" describes the analysis process itself rather than serving as a filterable attribute or category for the resulting data.

Saviynt EIC Documentation, Risk and Compliance Management Guide, Section: "Analyzing SOD Violations," Document ID: EIC-RCMG-v2023.1, pp. 78-82. This section details the user interface for SOD violation analysis, explicitly mentioning the ability to filter by user, security system, and ruleset.

Saviynt EIC can automate the initiation of access certification campaigns based on changes to user identity attributes. This is achieved by configuring a "User Update Rule." This type of rule continuously monitors for changes in specified user attributes (e.g., department, location, job code). When a change event matches the rule's criteria, it can automatically trigger a predefined action, such as launching a targeted access review campaign for the affected user, ensuring access is appropriate for their new role or status.

B. Connection attributes define parameters for communicating with a target application, not for triggering internal EIC workflows like campaigns.

C. Scheduling a campaign initiates it based on a fixed time interval (e.g., quarterly), not in response to a real-time user attribute change.

D. This is incorrect; event-based campaign triggers are a core automation capability within Saviynt EIC for implementing JML (Joiner-Mover-Leaver) processes.

Saviynt EIC Documentation, Rules and Workflows Guide, Section: "Configuring User Update Rules," Document ID: EIC-RWG-v2023.1, pp. 45-51. This section explicitly describes how to create rules that trigger actions, including campaigns, upon user attribute updates.

To execute a job immediately following the completion of another, a "Trigger chain job" should be configured. This feature allows an administrator to create a dependency between jobs. You can configure a job (e.g., a provisioning job) to be automatically triggered based on the completion status (Success, Failure, or Always) of a preceding job (e.g., a user import job). This ensures that processes that depend on the successful completion of prior tasks are executed in the correct sequence without manual intervention.

A. A multi-threading job refers to the internal processing model of a single job for performance, not the sequencing of multiple distinct jobs.

C. A single-threaded job, similar to a multi-threading job, describes how a job executes internally, not its relationship with other jobs.

D. A WSRetry job is a specialized job used to retry failed web service calls during provisioning actions, not for chaining different types of jobs together.

- Saviynt EIC Documentation, "Administrator Guide," Chapter: Job Control Panel, Section: Configuring Trigger Chain Jobs. This section explicitly details the steps to link two or more jobs in a sequence, where one job's execution is triggered by the outcome of another.

The integration architecture between Saviynt and ServiceNow is flexible, allowing for request fulfillment to occur in either system based on the configuration. For requests involving applications managed directly by Saviynt via its connectors (e.g., AWS, SAP), fulfillment is handled by the Saviynt EIC engine. Conversely, for requests related to resources managed within ServiceNow itself (e.g., ServiceNow roles or assignment groups), fulfillment can be handled by ServiceNow's native workflow engine. Therefore, the location of fulfillment is not fixed and is determined by the specific use case and integration setup.

A. While Saviynt often handles fulfillment, it is not the only possibility; ServiceNow can also be configured to fulfill certain requests.

B. While ServiceNow can handle fulfillment for its native objects, it typically delegates fulfillment for external applications to Saviynt.

D. Fulfillment happens in one of the two systems, making this option incorrect.

1. Saviynt Enterprise Identity Cloud (EIC) Documentation, "Saviynt for ServiceNow Integration Guide," Chapter 1: Architecture and Integration Patterns, Section 1.2: Fulfillment Models, pp. 8-10.

2. Saviynt Whitepaper, "Leveraging ServiceNow and Saviynt for Closed-Loop Identity Management," WP-SNOW-2022, Section: "Configurable Fulfillment Workflows."

In Saviynt EIC, active workflows, which manage approval processes for access requests and provisioning, can be configured at multiple levels for granularity. They can be attached to a Security System to govern all associated endpoints, directly to an Endpoint for more specific control, and to an Entitlement Type to enforce unique approval paths for certain classes of entitlements (e.g., high-risk). This layered approach allows for flexible and context-aware governance. Global Configurations manage system-wide settings, not module-specific active workflows.

C. Global Configuration: This module is for system-wide settings like password policies or UI branding, not for configuring access approval workflows for specific applications or entitlements.

1. Saviynt Enterprise Identity Cloud (EIC) Documentation, "Configuring Workflows for Access Requests," Section: Attaching Workflows to Security Systems, Endpoints, and Entitlement Types. (This is a conceptual reference to standard EIC architecture).

2. Saviynt Training Courseware, "EIC 201: Application Onboarding," Module 4: Configuring Provisioning and Workflows.