BEST Verified Saviynt SAVIGA-C01 Exam Questions (2025) [Q16-Q34]

NEW QUESTION 16
________ allows detection of access rights granted outside the Saviynt platform.

REST API

RevokeOutOfBandAccessJob

Bulk Upload

ARS > Request Access for Others

The Saviynt feature that allows detection of access rights granted outside the Saviynt platform is the B.
RevokeOutOfBandAccessJob. Here’s a detailed explanation:
* Out-of-Band Access: This refers to access that is provisioned directly in the target system, bypassing the normal access request and approval processes within Saviynt. This can create security risks and compliance issues.
* Saviynt’s Reconciliation Process: Saviynt uses a reconciliation process to compare the access rights defined within its system with the actual access rights present in connected applications.
* RevokeOutOfBandAccessJob: This specific job is designed to identify and flag out-of-band access. It works by:
* Importing Account and Entitlement Data: The job imports data from the target system, capturing the current state of user access.
* Comparing with Saviynt Data: It compares this imported data with the access rights managed within Saviynt.
* Identifying Discrepancies: Any discrepancies, where a user has access in the target system that wasn’t granted through Saviynt, are identified as out-of-band access.
* Taking Action (Optional): The job can be configured to automatically revoke this out-of-band access or to simply generate a report for review and manual remediation. Or it can be configured to create a task for an administrator to review.
* Saviynt’s Access Governance: This feature is a crucial part of Saviynt’s overall access governance capabilities, helping organizations maintain control over user access and enforce the principle of least privilege.
* Other Options:
* A. REST API: While Saviynt’s REST API can be used to interact with the system and potentially retrieve access data, it’s not the specific feature designed for out-of-band access detection.
* C. Bulk Upload: This is a method for importing data into Saviynt, but it doesn’t inherently detect out-of-band access.
* D. ARS > Request Access for Others: This is part of the access request process, not related to detecting access granted outside of Saviynt.
In conclusion: The RevokeOutOfBandAccessJob in Saviynt plays a vital role in identifying and remediating out-of-band access, ensuring that access rights are managed centrally and consistently through the Saviynt platform.

NEW QUESTION 17
Accounts, Entitlement types, and Entitlement data of an application are directly associated with:

Endpoints

Roles

Workflows

Security Systems

NEW QUESTION 18
Which of the following actions is appropriate if the data displayed in the Campaign Preview mode does not meet the requirement?

Re-configure Campaign

Check Summary

Export Campaign

Activate Campaign

NEW QUESTION 19
The Max Authentication Session parameter in Single Sign-On settings specifies the maximum duration, in seconds, for which an SSO session will remain valid. The default value is 3600 seconds. If the session logout value defined in IDP is 10,000 seconds and Max Authentication Session in Saviynt SSO is 5000 seconds, how long will the session last?

5000 seconds

10,000 seconds

3600 seconds

None of the above

NEW QUESTION 20
Which of the following options can a Campaign Owner use to view the Entitlements Query that was used in a previously launched Campaign?

Campaign Export

Campaign Summary

Reconfigure option

Export option at the top right corner of the page, next to the Refresh Progress option

NEW QUESTION 21
Access privileges for any specific Analytical Control can be assigned using SAV Roles. Which of the following tasks can be performed, by default, by users belonging to an SAV Role?

Only view the configurations of the Control

View Control, Run Control, and View Analytic History of the Control

Only view the Analytic History of the Control

View Control and Run Control

NEW QUESTION 22
If you want an application to be available for requesting access (self or other), which of the following should be configured?

Proposed Accounts Workflow

Access Remove Workflow

Access Add Workflow

Emergency Access ID Request Workflow

To make an application available for access requests (either self-service or requests for others), the Access Add Workflow needs to be configured within Saviynt. This workflow defines the process that governs how access to the application is granted. Here’s a breakdown with Saviynt IGA references:
* Saviynt’s Access Request System (ARS): This is the module within Saviynt that handles access requests. The ARS relies on defined workflows to manage the approval and provisioning process.
* Access Add Workflow: This specific type of workflow within Saviynt’s ARS is triggered when a user requests access to an application or entitlement. It dictates the steps involved, such as:
* Requester Details: Capturing information about who is requesting access.
* Application/Entitlement Selection: The user selects the application (and potentially specific roles or entitlements within that application) for which they are requesting access.
* Approval Routing: Defining the approval chain (e.g., manager approval, application owner approval, etc.). This is configured within the workflow using various approval activities.
* Provisioning: Upon approval, the workflow can trigger automated provisioning of access to the target system (if connected integration is set up).
* Saviynt’s Application Onboarding: For an application to be available in the ARS, it needs to be onboarded into Saviynt. During this process, you would typically define the relevant entitlements (access rights) associated with the application.
* Workflow Configuration in Saviynt: Saviynt’s admin interface allows administrators to create and customize workflows using a visual designer. This includes setting up conditions, defining approval steps, and configuring actions to be taken at each stage of the workflow.
* Other options:
* Proposed Accounts Workflow: This is less common, often used to suggest potential accounts during the request or account creation process. It’s not the primary mechanism for making an application available for access requests.
* Access Remove Workflow: This workflow is used when access needs to be revoked, not granted.
* Emergency Access ID Request Workflow: This workflow is specific to requesting temporary, elevated access in emergency situations. It’s not the workflow for general access requests to applications.

NEW QUESTION 23
ABC Company has set up a one-level workflow for an application, where the lone approver is the manager of the beneficiary. Margaret, who is Edward’s manager, raised an access request on behalf of Edward. Which of the following statements would be true/applicable?

Manager’s approval is auto-approved

Manager’s approval is auto-rejected

Manager must manually approve/reject the request

None of the above

In the given scenario, where ABC Company has a one-level workflow with the manager as the sole approver, and Margaret (Edward’s manager) raises a request on behalf of Edward, the statement that would be true
/applicable is A. Manager’s approval is auto-approved. Here’s why:
* Saviynt’s Workflow Configuration: Saviynt allows for the configuration of various workflow scenarios, including auto-approval based on certain conditions.
* Self-Approval Prevention/Auto-Approval: A common security best practice is to prevent users from approving their own access requests. However, when a manager requests on behalf of a subordinate, this is considered a delegated request and many organizations find it acceptable to auto-approve since the approval should be implicit in the act of requesting.
* Manager Requesting on Behalf: When a manager initiates a request for a subordinate, it’s often considered an implicit approval. The manager is essentially saying, “I approve this access for my team member.”
* Saviynt’s Default Behavior (Typically): By default, or through common configuration practices, Saviynt is often set up to recognize this scenario and auto-approve the manager’s approval step in the workflow. This streamlines the process and avoids unnecessary delays.
* Configuration Options: While auto-approval is common, Saviynt’s workflow engine is flexible. It’s possible to configure it differently, for instance, to still require explicit manager approval even in this scenario. However, this is less typical.
* Other Options:
* B. Manager’s approval is auto-rejected: This is highly unlikely and would defeat the purpose of having a manager initiate the request.
* C. Manager must manually approve/reject the request: While possible through configuration, it’s not the typical or default behavior in this scenario.
* D. None of the above: Option A is the most likely and common outcome.
In summary: In a one-level workflow where the manager is the approver, and the manager requests access on behalf of a subordinate, Saviynt is typically configured to auto-approve the manager’s approval step, streamlining the process and reflecting the implicit approval inherent in the manager’s action.

NEW QUESTION 24
Which of the following Jobs should be created and scheduled to evaluate Rules on a need basis?

Run Detective Rules and Take Action

Provisioning Job

User Import via Connection

Trigger Chain Job

NEW QUESTION 25
John, who recently joined an organization as a full-time employee, is required to work from the Sydney office. He was assigned birthright entitlements as part of the new joiner provisioning. Which of the following Enterprise Roles will be assigned to John from the Birthright Rule?

Birthright – Sydney

Birthright – Permanent – Full-time

Birthright – All

Birthright – Employee

NEW QUESTION 26
Single Sign-On is enabled in EIC using Azure Identity Provider. In this scenario, can the user log in using Azure and EIC native authentication?

True

False

NEW QUESTION 27
Which of the following statuses is applicable for the “Add Access” task type when the task is successfully completed?

Provisioned

Success

Manually Provisioned

Active

When an “Add Access” task is successfully completed in Saviynt, the applicable status is typically ” Provisioned.” Here’s a detailed explanation with Saviynt references:
* Saviynt’s Task Management: Saviynt uses tasks to track the progress of various operations, including access provisioning. These tasks are generated as part of workflows, such as the “Access Add Workflow.”
* “Add Access” Task Type: This specific task type is created when the access request is approved and the system is ready to grant the requested access to the target application.
* Task Statuses in Saviynt: Saviynt uses different statuses to indicate the current state of a task.
Common statuses include:
* Pending: The task is waiting to be processed.
* In Progress: The task is currently being executed.
* Provisioned: This status signifies that the requested access has been successfully granted to the user in the target system.
* Failed: The task encountered an error and could not be completed.
* Manually Provisioned: The task was completed manually by an administrator, rather than through automated provisioning.
* Success: While sometimes used, this status is less specific than “Provisioned” in the context of
“Add Access” tasks, since it does not specify that the action completed was a provisioning action.
* Active: Typically applies to accounts or users, not tasks.
* Saviynt’s Workflow Engine: The workflow engine in Saviynt updates the task status as it progresses through the defined steps. For connected applications, the workflow engine might directly interact with the target system’s API to provision the access. Once the provisioning is successful, the status is updated to “Provisioned.”
* Saviynt’s Audit Trails: Saviynt maintains detailed audit trails, and the task status changes are logged.
This provides a clear record of when access was provisioned for a user.
* Other Options:
* Success: As mentioned above, this is a general status. While technically correct (the task succeeded), “Provisioned” provides more context.
* Manually Provisioned: This status is only applicable if an administrator intervened and manually granted the access outside of the automated workflow.
* Active: This status typically pertains to a user or account’s overall status, not specifically to the completion of an “Add Access” task.

NEW QUESTION 28
In the process of setting up Single Sign-On using SAML 2.0, the “SP Entity ID” acts as a unique identifier for the Saviynt SP. If “SP Entity ID” is set to the value of SaviyntSP, which of the following will be the correct Single Sign-On URL to log in to EIC?

https://myorg.saviyntcloud.com/ECM/saml/SSO/SaviyntSP

https://myorg.saviyntcloud.com/SaviyntSP

https://myorg.saviyntcloud.com/ECM/saml/SSO/alias/SaviyntSP

NEW QUESTION 29
Which of the following Role types should be selected for a Role containing Entitlements that span across multiple applications?

Application Role

Transactional Role

Enabler Role

Enterprise Role

NEW QUESTION 30
Multiple indices can be selected while creating Analytics using the Elasticsearch Query.

True

False

NEW QUESTION 31
Match the following SoD Violations status with their description.

NEW QUESTION 32
Marty, an Administrator, reconciled Oracle Accounts into Saviynt. During the import, the incoming accounts were required to be mapped to the existing users in Saviynt. Which of the following Rules should be used to successfully associate Accounts to the correct users?

Account to User Rule

Account Name Rule

Technical Rule

User Account Correlation Rule

NEW QUESTION 33
________ filters the requestable applications under “Request New Access.”

Access Add Workflow

Access Query

Provisioning Connection

Whom to Request

The component that filters the requestable applications under “Request New Access” in Saviynt is the Access Query. Here’s a detailed explanation:
* Saviynt’s Access Request System (ARS): As the front end for requesting access, the ARS needs a mechanism to determine which applications (and entitlements) should be displayed to a user as requestable.
* Access Query: This is a powerful feature within Saviynt that allows administrators to define specific criteria to control the visibility of applications and entitlements in the ARS. Think of it as a filter that determines what a user can see and request.
* How Access Queries Work:
* Defined on Applications/Entitlements: Access Queries are configured on individual applications or entitlements within Saviynt.
* Based on User Attributes: They use user attributes (e.g., department, location, job title, group memberships) and other criteria (e.g., risk level) to determine if a user should see a particular application or entitlement.
* Dynamic Filtering: When a user accesses the “Request New Access” section, Saviynt evaluates the Access Queries associated with each application and entitlement in real-time. Based on the user’s attributes, the system dynamically filters the list, showing only the applications and entitlements that match the query conditions.
* Saviynt’s Security Model: Access Queries are a fundamental part of Saviynt’s security model. They ensure that users are only presented with access options that are relevant and appropriate for their role and context, preventing accidental over-provisioning and reducing the attack surface.
* Other Options:
* Access Add Workflow: While essential for processing access requests, the workflow itself doesn’t filter which applications are initially displayed.
* Provisioning Connection: This relates to how Saviynt connects to target systems for automated provisioning. It doesn’t control the initial visibility of applications in the ARS.
* Whom to Request: This setting might determine the available approvers, but it doesn’t filter the list of requestable applications.
In essence: Access Queries act as a dynamic filter, leveraging user attributes and defined criteria to determine which applications and entitlements are presented to a user within Saviynt’s “Request New Access” interface, ensuring a personalized and secure access request experience.

NEW QUESTION 34
Which of the following options can a Campaign Owner use to view the Entitlements Query that was used in a previously launched Campaign?

Reconfigure option

Campaign Export

Campaign Summary

Export option at the top right corner of the page, next to the Refresh Progress option