SAVIGA-C01 Exam Questions & Answers

The type of Rule that should always be used in conjunction with the Organization object in Saviynt is the B. User Update Rule. Here's the explanation:

Saviynt's Organization Object: The Organization object in Saviynt represents the organizational structure or hierarchy (e.g., departments, locations, cost centers). It's often used to define relationships between users and organizational units.

User Update Rule: This type of rule is designed to automatically update user attributes based on changes in other user attributes or related objects.

Using Organization with User Update Rule: The User Update Rule is frequently used with the Organization object to automate user management based on organizational changes.

Example: You can create a User Update Rule that automatically assigns users to specific roles or groups based on their department (defined in the Organization object). If a user is moved to a different department, the rule will trigger and update their roles or group memberships accordingly.

Dynamic User Management: This combination enables dynamic user management, ensuring that user attributes and access rights are automatically adjusted as users move within the organization.

Other Options:

A . Technical Rule: Technical Rules are more general-purpose and can be used for various tasks, but they are not specifically tied to the Organization object.

C . Scan Rule: Scan Rules are used for data analysis and identifying potential issues, not for updating user attributes based on organizational structure.

D . Request Rule: Request Rules are related to access request workflows, not to automatic user updates.

In essence: The User Update Rule, when used in conjunction with the Organization object, provides a powerful way to automate user management in Saviynt, ensuring that user attributes and access rights are dynamically updated based on changes in the organizational structure.

If the data displayed in the Campaign Preview mode does not meet the requirement in Saviynt, the appropriate action is A. Re-configure Campaign. Here's why:

Saviynt's Campaign Preview Mode: This mode allows administrators to review the data that will be included in a campaign before activating it. It's a crucial step for ensuring that the campaign scope, data, and configuration are correct.

Purpose of Preview Mode: The primary purpose of the preview is to identify any issues or discrepancies in the campaign setup before it goes live.

Re-configure Campaign: If the preview reveals problems (e.g., incorrect users or entitlements are included, the wrong Certifiers are assigned, filters are not working as expected), the administrator needs to go back and re-configure the campaign settings. This might involve:

Adjusting the campaign scope.

Modifying filters or selection criteria.

Changing Certifier assignments.

Updating the campaign schedule or notifications.

Why Other Options Are Incorrect:

B . Check Summary: The summary provides a high-level overview of the campaign, but it doesn't allow for detailed data review like the preview mode.

C . Export Campaign: Exporting the campaign data won't fix the underlying configuration issues.

D . Activate Campaign: Activating a campaign with incorrect data would lead to inaccurate certification decisions and potential security risks.

The purpose of a Custom Assignment Workflow block in Saviynt is A. Request must be approved based on any attribute of a user or account, or a custom condition. Here's a detailed explanation:

Saviynt's Workflow Flexibility: Saviynt's workflow engine is designed to be highly flexible, allowing organizations to create complex approval processes tailored to their specific needs.

Standard Approver Types: While Saviynt provides standard approver types like Manager, Role Owner, and Application Owner, there are often scenarios where the approval needs to be routed based on more dynamic or complex criteria.

Custom Assignment Block: This is where the 'Custom Assignment' block comes in. It allows you to define custom logic to determine the approver(s) for a request.

Attribute-Based Approvals: You can use attributes of the requester, the beneficiary (if different), or even attributes of the requested resource (e.g., application, entitlement) to determine the approver. For example:

Requests from users in a specific department could be routed to a particular security officer.

Requests for access to a high-risk application could be routed to a specific risk management team.

Custom Conditions: You can also define custom conditions using scripting or other logic within the Custom Assignment block. This allows for even greater flexibility in defining the approval routing.

Example: You might have a condition that checks if the requested entitlement has a certain risk level and, if so, routes the approval to a specific compliance officer.

Other Options:

B . Request must be approved by the Role Owner: This is handled by a standard 'TASK Access Approve' activity assigned to the Role Owner.

C . Request must be approved by the Application Owner: Similar to the above, this is a standard approver type.

D . None of the above: Option A accurately describes the purpose of the Custom Assignment block.

RULES & POLICIES

When an 'Add Access' task is successfully completed in Saviynt, the applicable status is typically 'Provisioned.' Here's a detailed explanation with Saviynt references:

Saviynt's Task Management: Saviynt uses tasks to track the progress of various operations, including access provisioning. These tasks are generated as part of workflows, such as the 'Access Add Workflow.'

'Add Access' Task Type: This specific task type is created when the access request is approved and the system is ready to grant the requested access to the target application.

Task Statuses in Saviynt: Saviynt uses different statuses to indicate the current state of a task. Common statuses include:

Pending: The task is waiting to be processed.

In Progress: The task is currently being executed.

Provisioned: This status signifies that the requested access has been successfully granted to the user in the target system.

Failed: The task encountered an error and could not be completed.

Manually Provisioned: The task was completed manually by an administrator, rather than through automated provisioning.

Success: While sometimes used, this status is less specific than 'Provisioned' in the context of 'Add Access' tasks, since it does not specify that the action completed was a provisioning action.

Active: Typically applies to accounts or users, not tasks.

Saviynt's Workflow Engine: The workflow engine in Saviynt updates the task status as it progresses through the defined steps. For connected applications, the workflow engine might directly interact with the target system's API to provision the access. Once the provisioning is successful, the status is updated to 'Provisioned.'

Saviynt's Audit Trails: Saviynt maintains detailed audit trails, and the task status changes are logged. This provides a clear record of when access was provisioned for a user.

Other Options:

Success: As mentioned above, this is a general status. While technically correct (the task succeeded), 'Provisioned' provides more context.

Manually Provisioned: This status is only applicable if an administrator intervened and manually granted the access outside of the automated workflow.

Active: This status typically pertains to a user or account's overall status, not specifically to the completion of an 'Add Access' task.

The bulk operation that is not typically a supported feature in the same way as the others is C. Bulk Approval - Single-click approval for multiple entitlements in a single request. Here's why:

Saviynt's Bulk Operations: Saviynt supports various bulk operations to streamline administration and user experience, especially when dealing with multiple users or requests.

Supported Bulk Operations:

A . Bulk Request Access: Saviynt allows users to request access for multiple users in a single request. This is a common and supported feature.

B . Disabling multiple users and their access: Administrators can disable multiple user accounts and revoke their access in bulk.

D . Deleting multiple users: Saviynt supports the bulk deletion of user accounts.

Bulk Approval - Granularity: While Saviynt supports bulk approvals (approving multiple requests at once), it typically operates at the request level, not at the individual entitlement level within a single request. Approving multiple separate requests in one go is a standard bulk approval action.

Each request (even if it's a bulk request for multiple users or contains multiple entitlements) is usually treated as a single unit for approval.

Approvers typically approve or reject the entire request, not individual entitlements within it.

Security and Control: This approach maintains better control and auditability. Approving each entitlement within a single request individually would require a more complex interface and potentially increase the risk of accidental approvals.

Possible Workarounds:

Separate Requests: To achieve a similar outcome, users could submit separate requests for each entitlement, allowing the approver to approve them individually (and potentially in bulk if they are separate requests).

Custom Workflows: In theory, it might be possible to create highly customized workflows to handle this scenario, but it's not a standard out-of-the-box feature.

In summary: While Saviynt excels at bulk operations for users and requests, single-click approval of individual entitlements within a single request is not a typical supported feature due to the need for granular control and a clear audit trail. Bulk approvals usually apply to entire requests, not to individual entitlements within them.