Dumps for Free Saviynt SCAIP Practice Exam Questions [Sep 09, 2026]
SCAIP Dumps PDF And Certification Training
NEW QUESTION # 23
Administrator created a custom SAV role, ROLE_CUSTOM_READ, with the "Read Only" option set to true.
If the user is assigned both ROLE_ADMIN and ROLE_CUSTOM_READ, what actions can the user perform?
- A. User will have full view/edit access as user is part of ROLE_ADMIN
- B. User can only view/edit the modules as mapped under Features for ROLE_CUSTOM_READ
- C. It depends; the access defined in the SAV Role that was assigned later takes precedence over the other
- D. User can only view all EIC configurations
Answer: A
Explanation:
In Saviynt EIC,SAV Roles are additive in nature, meaning that when a user is assigned multiple roles, the system grants theunion of all permissionsacross those roles. There is no restrictive override where one role limits another; instead, the highest level of access prevails.
In this scenario, the user is assigned bothROLE_ADMINandROLE_CUSTOM_READ (Read Only). While ROLE_CUSTOM_READ restricts access to read-only, theROLE_ADMIN role provides full administrative privileges, including both view and edit capabilities across modules.
Saviynt does not enforce precedence based on role assignment order, nor does a read-only role override an admin role. Instead, permissions are cumulative, and the most permissive access is effectively granted.
Therefore,Option Dis correct: the user will havefull view and edit accessbecause ROLE_ADMIN includes comprehensive permissions that supersede the limitations of the read-only role.
This behavior ensures flexibility in role assignments but also requires careful governance to avoid over- provisioning of administrative access.
NEW QUESTION # 24
Which of the following scenarios are True to trigger Technical Rule Execution in EIC? (Multi-Select)
- A. A new user is registered or created from the UI and the condition in the rule matches
- B. The existing user is updated and satisfies a user update rule with action as Re-run provisioning rules
- C. When users are imported through Import Job and the condition in the rule matches
- D. When a user is deleted and the condition in the rule matches
Answer: A,B,C
Explanation:
In Saviynt EIC,Technical Rulesare triggered based on lifecycle events related to user creation, updates, and imports, provided the defined conditions evaluate to true. The correct answers areB, C, and D.
Option Bis correct because duringImport Jobs, when users are brought into Saviynt from authoritative sources, Technical Rules are evaluated, and if conditions match, they are executed. This is a common mechanism for provisioning access during onboarding.
Option Cis also correct since when anew user is created via the UI, Technical Rules can be triggered if the user attributes meet the rule conditions. This ensures consistent provisioning regardless of how users are created.
Option Dis correct because when anexisting user is updated, and a User Update Rule is configured tore-run provisioning rules, it can trigger associated Technical Rules again.
Option Ais incorrect because deletion events typically trigger deprovisioning workflows rather than standard Technical Rule execution.
Thus, Technical Rules are triggered during import, creation, and update events-not deletion.
NEW QUESTION # 25
A customer requires provisioning of time-bound access through roles that should be revoked automatically after certain days from the day of assignment. What option in EIC will help the customer achieve this requirement?
- A. Configure an Enterprise Role and enable timestamp under Role Details
- B. Configure an Emergency Access Role
- C. Configure Dynamic Attributes for Roles
- D. Enable Time-bound for Roles in Global Configurations > Roles
Answer: D
Explanation:
In Saviynt EIC,time-bound accessis a standard feature used to ensure that access granted to users is automatically revoked after a defined duration. This requirement is fulfilled by enabling thetime-bound configuration for roles under Global Configurations > Roles(Option B). Once this setting is enabled, users can request roles with a specified start and end date, and Saviynt automatically deprovisions the access when the validity period expires.
This capability is essential for enforcingleast privilege and compliance requirements, as it eliminates the need for manual revocation and reduces the risk of lingering access. The system leverages scheduled jobs to monitor and remove expired entitlements or roles.
Option A is incorrect because Dynamic Attributes are mainly used for form customization and conditional logic, not for enforcing access expiration. Option C (Emergency Access Role) is designed for temporary elevated access but follows a different configuration pattern and use case. Option D is not a valid standard approach for enabling automatic revocation.
Thus, enablingtime-bound roles in global configurationis the correct and scalable solution.
NEW QUESTION # 26
The EIC Administrator observed that all accounts were disabled in Saviynt due to incorrect configuration in the target application. What controls can be implemented in Saviynt to avoid such scenarios?
- A. It is not possible to set a limit
- B. Set the limit in the external config file
- C. Use the accEntThresholdValue attribute in the STATUS_THRESHOLD_CONFIG connection parameter
- D. Use the accountThresholdValue attribute in the STATUS_THRESHOLD_CONFIG connection parameter
Answer: D
Explanation:
In Saviynt EIC, mass unintended changes-such as all accounts being disabled due to incorrect target application configuration-can be prevented usingthreshold-based controls. These controls are defined using theSTATUS_THRESHOLD_CONFIGconnection parameter, which acts as a safeguard during reconciliation and provisioning processes.
The correct attribute in this scenario isaccountThresholdValue (Option D). This parameter allows administrators to define a threshold limit for account status changes (such as disablement). If the number or percentage of accounts being disabled exceeds the defined threshold, Saviynt can stop or flag the operation, preventing large-scale unintended impact.
OptionA (accEntThresholdValue)is used for entitlement-level thresholds, not account status changes.
OptionBis incorrect because Saviynt does provide this safeguard mechanism. OptionCis also incorrect since such controls are not managed externally but are part of Saviynt's connector configuration.
By usingaccountThresholdValuewithin STATUS_THRESHOLD_CONFIG, organizations can implement strong governance and prevent bulk account disablement due to misconfigurations or data issues during account import or reconciliation.
NEW QUESTION # 27
An EIC Administration has a requirement to configure a separate password policy for service accounts along with the password policy for regular accounts. How can this be achieved in EIC?
- A. Define a separate Password Policy for Service Account and select the checkbox Password Policy Service Account field under Password Policy configurations
- B. Only one Password Policy can be defined in the Security System which applies to both regular and service accounts
- C. Define a separate Password Policy for Service Account and select it in Policy Rule Service Account field under Security System
- D. Define a separate Password Policy for Service Account and select it in Policy Rule Service Account field under Global Configurations
Answer: C
Explanation:
In Saviynt EIC, password management is highly configurable, allowing organizations to defineseparate password policies for different account types, including service accounts and regular user accounts. This requirement is achieved by creating a dedicated password policy specifically for service accounts and associating it appropriately within the system.
Option A is correct because Saviynt allows administrators to define aseparate Password Policy for Service Accountsand map it using thePolicy Rule Service Account field under the Security System configuration.
This ensures that when service account operations such as password resets or provisioning occur, the system enforces the correct policy distinct from regular user accounts.
Option B is incorrect since Saviynt supports multiple password policies and does not restrict to a single policy. Option C is incorrect because simply selecting a checkbox in password policy configuration does not link it to service account usage. Option D is incorrect as Global Configurations do not directly assign password policies for service accounts at the execution level.
Thus, configuring and mapping the policy at theSecurity System levelensures correct enforcement for service accounts.
NEW QUESTION # 28
What are the different authentication modes supported for SMTP configurations? (Multi Select)
- A. NTLM
- B. Basic
- C. None of the above
- D. OAuth
Answer: A,B,D
Explanation:
In Saviynt EIC,SMTP configurationis used to enable email notifications for workflows such as access requests, certifications, alerts, and system communications. To securely connect with mail servers, Saviynt supports multiple authentication mechanisms. The valid authentication modes areNTLM, OAuth, and Basic, making OptionsA, B, and Dcorrect.
Basic Authentication (Option D)is the traditional method where a username and password are used to authenticate with the SMTP server. While widely supported, it is less secure compared to modern methods and is being phased out in many environments.
NTLM (Option A)is commonly used in Microsoft-based environments (e.g., Exchange servers) and provides integrated authentication using Windows credentials, offering better security than basic authentication.
OAuth (Option B)is a modern and more secure authentication mechanism that uses token-based authorization instead of storing credentials. It is commonly used with cloud-based email services such as Microsoft 365 or Google Workspace.
OptionCis incorrect because Saviynt explicitly supports multiple authentication modes.
Thus, NTLM, OAuth, and Basic are the supported SMTP authentication modes in Saviynt.
NEW QUESTION # 29
Which of the following EIC modules support configuration of active workflow? (Choose 3 options)
- A. Security System
- B. Entitlement Type
- C. Endpoint
- D. Global Configuration
Answer: A,B,C
Explanation:
In Saviynt EIC, workflows are a core component used to control approval processes for access requests, provisioning, and other identity lifecycle events. These workflows can be configured at multiple levels depending on the scope and granularity required.
Security System (A)supports workflow configuration to define approval processes at the application level.
This allows organizations to enforce consistent approval logic for all endpoints associated with that system.
Endpoint (B)also supports workflow configuration, enabling more granular control where different endpoints within the same security system may require distinct approval processes. This is particularly useful in complex environments with varied access control requirements.
Entitlement Type (D)supports workflows to manage approvals specific to entitlement categories (such as roles, groups, or permissions), ensuring appropriate governance at a finer level.
Global Configuration (C), while important for system-wide settings, is not typically used to directly assign active workflows to access requests. Instead, workflows are selected and applied within modules like Security System, Endpoint, and Entitlement Type.
Thus, the correct modules supporting active workflow configuration areSecurity System, Endpoint, and Entitlement Type.
NEW QUESTION # 30
Which campaign type should be used when managers must review and certify access for their direct reportees?
- A. Role Owner Campaign
- B. Service Account Campaign
- C. Entitlement Owner Campaign
- D. User Manager Campaign
Answer: D
Explanation:
The correct answer is A. User Manager Campaign . In Saviynt, the User Manager campaign is specifically designed for manager-based certifications, where managers review and certify the access of their direct reportees. Saviynt documentation explicitly states that in a User Manager campaign, managers are responsible for reviewing and certifying the access of users who report to them. That makes this campaign type the best fit when the certification driver is the reporting hierarchy rather than entitlement ownership, role ownership, or service account ownership.
The other options represent different certification ownership models. Entitlement Owner Campaign is meant for entitlement owners, Role Owner Campaign is for role owners, and Service Account Campaign is focused on service account ownership verification and access review. Saviynt also describes campaigns as a way to automatically generate and distribute certifications to the appropriate certifiers based on the selected campaign type and ownership model. Therefore, when the requirement clearly says "managers must review direct reportees," the User Manager campaign is the correct and most aligned selection within Saviynt Level
200 scope.
NEW QUESTION # 31
Scenario:
John, an EIC System Administrator, encounters a situation where a user account has been compromised, and he needs to take immediate action to prevent further unauthorized access.
Question:
Given the scenario, which action should John take on EIC to prevent compromised user account access on the impacted application?
- A. Expire
- B. Delete
- C. Suspend
- D. Lock
Answer: D
Explanation:
In Saviynt EIC, when an account is compromised and requiresimmediate containment, the most appropriate action is tolock the account(Option A). Locking an account ensures that the user is instantly prevented from logging into the target system without removing the account or affecting its underlying configuration. This action is reversible and allows administrators to quickly secure the account while further investigation or remediation steps (such as password reset or access review) are performed.
Option B (Suspend) is typically used for longer-term access revocation scenarios, such as employee leave or inactivity, and may depend on application-specific configurations. Option C (Expire) relates to setting an end date for account validity, which is not suitable for immediate threat mitigation. Option D (Delete) is a permanent and destructive action, generally avoided in incident response because it removes audit trails and complicates recovery.
Therefore, locking the account aligns with Saviynt best practices forincident response and rapid risk mitigation, ensuring security without losing account traceability.
NEW QUESTION # 32
A customer requires provisioning of time-bound access through roles that should be revoked automatically after certain days from the day of assignment. What option in EIC will help the customer achieve this requirement?
- A. Configure an Enterprise Role and enable timestamp under Role Details
- B. Configure an Emergency Access Role
- C. Configure Dynamic Attributes for Roles
- D. Enable Time-bound for Roles in Global Configurations > Roles
Answer: D
NEW QUESTION # 33
Problem Statement:
Access request approval is not being assigned to the correct approver for a given endpoint.
In this scenario, what configurations will you check? (Multi-Select)
- A. Verify the workflow attached to the corresponding Endpoint to ensure it is correctly configured
- B. Verify the requestor selected the correct approver while submitting the request
- C. Verify the workflow attached to the corresponding Security System to ensure it is correctly configured
- D. Verify if Delegate is configured for the intended approver
Answer: A,C,D
Explanation:
In Saviynt EIC, approval assignment for access requests is primarily controlled throughworkflow configurations, which are associated either at theendpoint level or security system level. Therefore, the first step in troubleshooting incorrect approver assignment is to validate whether the correct workflow is attached and properly configured at both levels (Options A and C). Workflows define approval logic such as manager, owner, or custom approvers, and misconfiguration here often leads to incorrect routing.
Option B is also correct becausedelegation settingscan override the intended approver. If a delegate is configured for an approver, the request may be routed to the delegate instead of the original approver, causing confusion if not validated.
Option D is incorrect because in Saviynt, approvers are typicallysystem-driven based on workflow rules, not manually selected by the requester in most standard configurations. The requester does not usually control approver assignment unless explicitly customized, making this option irrelevant for standard troubleshooting.
NEW QUESTION # 34
In which system does the request fulfillment happen while integrating ServiceNow using Saviynt App for ServiceNow?
- A. ServiceNow
- B. Saviynt
- C. Saviynt or ServiceNow, based on the configuration
- D. None of the above
Answer: C
Explanation:
In Saviynt-ServiceNow integration using theSaviynt App for ServiceNow, therequest fulfillment location is flexible and depends on how the integration is configured. This is why Option C is correct.
Saviynt supports different integration patterns with ServiceNow. In one model,ServiceNow acts as the front- end request system, while Saviynt handles the fulfillment (provisioning, approvals, and access governance).
In another model, ServiceNow can handle certain fulfillment steps depending on how workflows, APIs, and ticketing configurations are defined.
For example, if the integration is configured such that ServiceNow creates a request and passes it to Saviynt, thenSaviynt performs fulfillment. Alternatively, if certain fulfillment logic or orchestration is handled within ServiceNow workflows or ITSM processes, thenServiceNow may drive parts of the fulfillment process.
This flexibility allows organizations to align the integration with their operational model, whether centralized in Saviynt or distributed with ServiceNow. Therefore, fulfillment is not restricted to a single system and is determined byconfiguration and architectural design choices.
NEW QUESTION # 35
The Helpdesk has set a new password for the user who called in for password reset assistance. Choose the correct configuration to share the password with the calling user
- A. Configure an email template in Change Password Notification configurations
- B. System automatically shares the password
- C. Configure an email template in the Reset Password notification under password policy
- D. Setup User Update Rule and configure an email template
Answer: C
Explanation:
In Saviynt EIC, password management includes configurable notification mechanisms to securely communicate password changes or resets to users. When aHelpdesk performs a password reset, the appropriate configuration to notify the user is through theReset Password notification under Password Policy.
Option C is correct because Saviynt provides a dedicatedReset Password notification templatewithin password policy configurations. This ensures that whenever a password is reset (either by user self-service or by Helpdesk), the system triggers the configured email template to notify the user. This template can include secure messaging and instructions related to the new password or next steps.
Option A is incorrect because the system does not automatically share passwords without proper configuration. Option B applies tochange password scenarios initiated by users, not Helpdesk resets. Option D is not recommended, as User Update Rules are not designed specifically for password notification workflows.
Thus, configuring theReset Password notification under password policyis the correct and secure approach.
NEW QUESTION # 36
Which of the following statements are correct? (Multi-Select)
- A. Duplicate Identity Management feature access need to be added to the SAV Role to view the duplicate identity management
- B. Duplicate Identity Management can only merge user attributes but not user access
- C. The role mining process discovers relationships between users based on similar access permissions that can logically be grouped to form a role
- D. In the Role mining, if the percentage cut-off = 60%, it would perform mining on only the access which is associated with 100% users
Answer: A,C
Explanation:
Statement A is correct becauseRole Miningin Saviynt analyzes user access patterns and identifies relationships between users who share similar entitlements. These patterns are then used to logically group access into roles, enabling efficient role-based access control (RBAC) implementation and reducing manual effort in role creation.
Statement B is incorrect because apercentage cut-off (e.g., 60%)in role mining means that entitlements common to at least 60% of users are considered for role creation-not 100%. The statement incorrectly interprets how threshold-based mining works.
Statement C is correct since access toDuplicate Identity Management (DIM)features is controlled viaSAV Role configurations. Administrators must grant appropriate permissions within SAV roles to allow users to view and manage duplicate identities in the system.
Statement D is incorrect because DIM supports merging not only user attributes but also associated accounts and access depending on configuration. It is not limited to attributes alone.
Thus, the correct answers areA and C.
NEW QUESTION # 37
Which User Update Rule action is used to automatically change service account ownership when the current owner is terminated?
- A. Launch Campaign
- B. Transfer Ownership
- C. Run Role Mining
- D. Disable SMTP
Answer: B
Explanation:
The correct answer is A. Transfer Ownership . Saviynt documentation on User Update Rules explains that the purpose of Transfer Ownership is to change ownership, and specifically notes that service accounts can be reassigned to the OwnerOnTerminate user when the current owner is terminated. The documentation further states that when the current service account owner is terminated, a user update rule with the action Transfer Ownership is triggered so that service account ownership is moved appropriately. This directly matches the scenario in the question.
This is also consistent with Saviynt's service account model, where every service account must have at least one designated owner who is authorized to manage it. Because ownership is required, Saviynt provides lifecycle controls to preserve accountable ownership when a human owner leaves the organization. The remaining options are unrelated. Run Role Mining belongs to analytics and role engineering, Launch Campaign belongs to certification processes, and Disable SMTP is an email configuration concept. For Level 200 understanding, the key takeaway is that automatic service account ownership continuity is handled through a User Update Rule using the Transfer Ownership action, often combined with OwnerOnTerminate configuration.
NEW QUESTION # 38
What is the use of the Show XML option in a workflow?
- A. It enables users to open and view the Workflow XML script in a read-only mode
- B. It allows users to create new JSON wirings from scratch
- C. It provides the ability to edit the Workflow XML script
- D. It shows the Workflow version history
Answer: A
Explanation:
In Saviynt EIC, workflows are internally represented inXML format, which defines the sequence of approval steps, conditions, and actions. The"Show XML"option is specifically designed to allow administrators toview the underlying XML structure of a workflow. However, this view is provided in aread-only mode, meaning administrators can inspect the configuration but cannot directly modify it from this option.
This feature is particularly useful fordebugging, auditing, and understanding workflow logic, especially in complex approval processes involving multiple steps and conditions. It helps administrators verify how a workflow is constructed without risking accidental changes to the configuration.
Option C is incorrect because editing workflow XML is not typically done directly through the "Show XML" view in Saviynt UI; modifications are handled through workflow configuration screens or controlled import
/export processes. Option A is unrelated since Saviynt workflows are XML-based, not JSON-based. Option B is also incorrect because version history is managed separately and not through the Show XML option.
Thus, the correct purpose of "Show XML" is toview workflow configuration safely in read-only format.
NEW QUESTION # 39
Which option can be used in the REST Connector to perform attribute mapping between target application and EIC?
- A. UpdateAccountJSON
- B. CreateAccountJSON
- C. ImportAccountEntJSON
- D. CreateAccountEntJSON
Answer: B
Explanation:
In Saviynt EIC REST connector configurations,attribute mapping between Saviynt and the target applicationis primarily handled during provisioning operations such as account creation and updates. Among the given options,CreateAccountJSONis the correct configuration where attribute mapping is explicitly defined for provisioning new accounts in the target system.
CreateAccountJSON (Option C)contains the payload structure and field mappings that determine how Saviynt attributes (such as username, email, department, etc.) are translated into the target application's API request format. Administrators define mappings using placeholders and transformation logic to ensure correct data flow from Saviynt to the external system.
OptionA (ImportAccountEntJSON)is used for reconciliation (importing accounts and entitlements), not provisioning. OptionB (CreateAccountEntJSON)is not a standard REST connector configuration in Saviynt.
OptionD (UpdateAccountJSON)is used for modifying existing accounts, but the primary and most commonly referenced mapping configuration for attribute mapping is defined in CreateAccountJSON during initial provisioning.
Thus,CreateAccountJSONis the correct answer for attribute mapping between EIC and the target application.
NEW QUESTION # 40
In the Saviynt App for ServiceNow, what options are available to refresh the RITM status in the ServiceNow app based on the respective Saviynt's status? (Multi-Select)
- A. It will be automatically updated in 1 minute via Request item history job in ServiceNow
- B. Make a Postman API call
- C. Regenerate application catalog item
- D. Click Refresh button on the RITM page in ServiceNow
Answer: A,D
Explanation:
In Saviynt-ServiceNow integration, the synchronization ofRITM (Request Item) statusbetween Saviynt and ServiceNow is handled through bothmanual and automated mechanisms.
Option B is correct because users or administrators can manuallyclick the Refresh button on the RITM page in ServiceNowto immediately fetch the latest status from Saviynt. This is useful for real-time validation when monitoring request progress.
Option C is also correct as ServiceNow includes aRequest Item History Job, which runs periodically (commonly every minute) to automatically sync and update the RITM status based on the latest state in Saviynt. This ensures near real-time consistency between both systems without manual intervention.
Option A is incorrect because Postman API calls are not a standard or supported operational method for end users to refresh RITM status. Option D is unrelated, as regenerating catalog items does not impact ticket status synchronization.
Thus, the correct answers aremanual refresh and automated job-based synchronization.
NEW QUESTION # 41
......
Check your preparation for Saviynt SCAIP On-Demand Exam: https://www.pass4leader.com/Saviynt/SCAIP-exam.html
Practice Exam SCAIP Realistic Dumps Verified Questions: https://drive.google.com/open?id=194i3Nj6S5NaWs0opZ0sjE_J7hfwUHtkk