SAV-L100 Practice Test

SAV-L100 practice test: what's covered

• Enterprise Identity Cloud
• IGA
• access certifications
• SoD
• connectors

Free SAV-L100 sample questions

1. An Enterprise Identity Architect is deploying Saviynt Enterprise Identity Cloud (EIC) for a global enterprise. User identity records are ingested daily from Workday HCM. Where does Saviynt EIC physically maintain the canonical identity profiles, account mappings, and entitlement assignments used for continuous access governance evaluations?

   • A. In Saviynt EIC internal database known as the Identity Warehouse, which aggregates users, accounts, roles, and entitlements
   • B. Directly inside target endpoint applications like Active Directory, performing real-time LDAP queries during every policy check
   • C. In the upstream Workday HCM tenant, keeping Saviynt as an ephemeral, stateless API proxy without local storage
   • D. Within client web browser session storage objects managed by the application gateway
   Show answer

   Correct: A. Saviynt EIC Identity Warehouse acts as the central, canonical repository storing consolidated identity data, target accounts, entitlements, roles, and historical audit logs required for real-time governance, SoD checks, and certification campaigns. Option B is incorrect because querying target directories via real-time LDAP during policy checks causes severe performance latency and cannot support offline analytics. Option C is incorrect because Workday is an authoritative HR source, not an IGA engine, and Saviynt must store relationship data statefully. Option D is incorrect because client browser session storage is volatile and cannot securely store centralized governance state.

2. You are an IAM Security Engineer configuring target application objects in Saviynt EIC for a newly connected SAP S/4HANA system. Which TWO core Saviynt access modeling components directly define the user target-system representation and fine-grained permissions?

   • A. Accounts (representing the user specific target-system identity container or username login)
   • B. Entitlements (representing specific fine-grained privileges, transaction codes, or security roles within the target system)
   • C. Connectors (representing the underlying transport channel and API protocol handler)
   • D. Certification Campaigns (representing periodic administrative audit review schedules)
   Show answer

   Correct: A and B. In Saviynt object model, Accounts represent identity containers on target systems (e.g., SAP user IDs), while Entitlements represent granular permissions assigned to those accounts (e.g., SAP T-Codes or security roles). Option C is incorrect because Connectors represent the integration channel (REST, LDAP, RFC) that executes transport operations rather than the identity access state. Option D is incorrect because Certification Campaigns are periodic compliance review processes, not target access definition objects.

3. You are an IAM Administrator managing a large-scale Saviynt EIC deployment for an enterprise with 250,000 Active Directory user accounts. The identity team needs to perform full reconciliation imports from Active Directory without degrading portal performance for end users during peak working hours. What is the recommended operational best practice?

   • A. Schedule heavy full data imports during off-peak maintenance windows, and utilize incremental delta imports during business hours to process changed records
   • B. Run full data imports during peak hours because Saviynt EIC automatically handles database table locking without user impact
   • C. Temporarily disable all automated approval workflows and email notification daemons before running daytime full imports
   • D. Deploy unmanaged standalone on-premises agent daemons to bypass scheduled sync intervals
   Show answer

   Correct: A. Full reconciliation imports require extensive database I/O and table processing, which can slow down portal response times if run during peak daytime hours; scheduling full syncs off-peak and relying on delta syncs for real-time changes ensures operational stability. Option B is incorrect because running full syncs during peak business hours creates significant database load and portal latency. Option C is incorrect because disabling workflows disrupts active business requests. Option D is incorrect because unmanaged agents bypass governance controls and introduce sync race conditions.

4. A Cloud Infrastructure Architect is establishing connectivity between Saviynt EIC SaaS and legacy on-premises Microsoft Active Directory domain controllers located behind secure corporate firewalls. Which architectural approach establishes this connection securely without exposing inbound firewall ports?

   • A. Deploying the Saviynt Cloud Agent on-premises to establish outbound secure TLS connections back to the EIC SaaS platform
   • B. Configuring a reverse proxy in the DMZ with inbound TCP port 443 open directly to internal domain controllers
   • C. Installing hardware-based IPsec VPN appliances that require static public IP address mappings for every target domain controller
   • D. Setting up automated nightly CSV flat-file file transfers over unencrypted FTP to an external cloud storage bucket
   Show answer

   Correct: A. The Saviynt Cloud Agent is a lightweight proxy deployed inside the enterprise network that polls Saviynt EIC SaaS over outbound HTTPS/TLS connections, eliminating the need to open inbound firewall ports. Option B is incorrect because opening inbound TCP port 443 through perimeter firewalls to domain controllers introduces severe security risks. Option C is incorrect because hardware IPsec VPNs add high network complexity compared to outbound agent proxies. Option D is incorrect because unencrypted FTP flat-file transfers expose credential data and lack real-time capabilities.

5. As an IAM Security Engineer, you need to implement an automated governance policy ensuring that every new hire in the Customer Support department is immediately assigned baseline access to Salesforce and Zendesk. Which Saviynt mechanism handles this automated grant?

   • A. Configuring a Birthright Role mapped to an attribute-based assignment rule (e.g., department == Customer Support)
   • B. Initiating a quarterly User Access Review campaign targeted at Customer Support team leads
   • C. Executing a detective Segregation of Duties (SoD) audit scan immediately after account creation
   • D. Generating a manual IT Service Management (ITSM) ticket for manual service desk provisioning
   Show answer

   Correct: A. Birthright role rules evaluate user identity attributes (such as department or title) during identity ingestion or updates, automatically provisioning baseline roles without manual intervention. Option B is incorrect because certification campaigns validate existing access rather than granting new Day-1 access. Option C is incorrect because detective SoD scans identify toxic permission combinations rather than assigning baseline entitlements. Option D is incorrect because manual ITSM ticketing defeats the purpose of automated identity governance and administration (IGA).

Last updated: 2026-10-19

SAV-L100 practice test FAQ