Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Saviynt Identity Governance & Administration > Saviynt IGA 101 > Flashcards

Saviynt IGA 101 Flashcards

Certification

1
Q

What are the advantages of a microservices based architecture? (chose one or more)

  • Automatic scale up & scale down
  • Save cost on infrastructure
  • No network latency
  • None of the above
A

Automatic scale up and scale down
Save cost on infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Saviynt allows end users to interact with a UI that is backed by a
- business layer
- user interface layer
- data layer
- none of the above

A

user interface layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Explain the three levels of disaster recovery available

A

Diamond - Warm DR / continuous replica

Gold - RDS (Relational Database Service) instance provisioned every 24 hours

Platinum - RDS (Relational Database Service) instance provisioned every six hours

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What compliance can Saviynt meet?

A

FedRAMP moderate
ISO 27001:2013
ISO 27001:2015
PCI-DSS
SOC1 Type II
SOC2 Type II

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What four types of application security are used?

A
  • Data Isolation
  • Security at rest - AES 256 bit encryption w/ Azure Key Vault
  • Security in transit - HTTPS only, TLS 1.2+
  • URL Security - Akamai WAF, MFA & SSO
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is SC2.0?

A

Saviynt Connect 2.0
- Provides Secure tunnel from customer’s network to Saviynt Cloud
- Supports forward proxy w/ basic auth & bypass auth
- Routing is handled entirely by SC 2.0 server & routes auto-push to the client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Saviynt Architecture / Connectivity Options

A

On-prem:
1. Saviynt Connect 2.0 (default)
2. IPSEC VPN
3. VPC / VNET Peering

SAAS:
1. HTTPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Number of Saviynt regions worldwide

A

27

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following options does Saviynt suggest for achieving high availability? (choose one or more)
- Deployment in different availability zones and regions
- Assigning elastic IP addresses
- Clustering
- None of the above

A
  • Deployment in different availability zones and regions
  • Assigning elastic IP addresses
  • Clustering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does Saviynt mean by Account Correlation?

A

Account correlation is the process of mapping to users. This also identifies accounts that are unmapped as orphan accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does EIC stand for?

A

Enteprise Identity Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What four types of accounts can be managed with Saviynt?

A

Application accounts
Orphan accounts
Privilege accounts
Service accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are entitlements according to Saviynt?

A

Entitlements are privileges that are granted to users. Entitlements can be mapped to accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a role according to Saviynt?

A

A role is a collection of entitlements that are assigned to a user. Saviynt’s roles lesson the tedious task of manually assigning entitlements (privileges) to users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the four types of Saviynt roles that can be assigned to users?

A

Application roles
Enterprise roles
Privileged roles
Other roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the three ways can you import roles to Saviynt?

A
  1. Upload roles from the Saviynt UI, as admin (can use CSV files)
  2. Upload roles based on schema (can also use SAV & CSV files)
  3. Upload roles using the database connection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How is a 3rd party application represented in Saviynt Enterprise Identity Cloud (EIC)?

A

As an endpoint (AKA target)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

One or more application endpoints logically grouped together under an appliation category is referred to as this by Saviynt

A

Security System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Accounts, entitlements, and other data can be imported from the target application and mapped into this in Saviynt Enterprise Identity Cloud (EIC)

A

an endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A endpoint in Saviynt supports these three types of applications

A

connected, disconnected and hybrid applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A Saviynt endpoint (target application) can contain user data such as

A

accounts, entitlements and roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Saviynt Connectors refer to this for connecting enterprise identity cloud (EIC) to target applications

A

Saviynt Connectors refer to the configuration setup for connecting enterprise identity cloud (EIC) to target applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Examples of Saviynt EIC supported out of the box connectors

A

Active Directory, AWS, Azure, Box, Database, LDAP, PeopleSoft, REST, Salesforce, SAP, SOAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

For home-grown applications, Saviynt provides support to build custom connectors via this

A

the Saviynt Connector Framework (SCF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Saviynt Connector Framework allows customers to do what?

A

Build connectors for home-grown applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

In the Identity Repository Schema Model, what does the Saviynt schema contain?

A

The Saviynt schema contains Information about key Saviynt tables used when performing SQL queries, in order to obtain identity details.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What does the Saviynt database tables store?

A

All relevant details pertaining to an object in Enterprise Identity Cloud (EIC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the four ways to import users?

A

API - triggered through an external system via Saviynt’s REST interface

Flat files / batch process (Disconnected)

HR Platform sync (Connected)

Manual - user registration / vendor onboarding through a sponsor, or bulk action by an admin in the UI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What does a connected user import refer to?

A

In this type of user import, a direct connection is made to a target appliation to pull user details into Saviynt’s EIC database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What does a disconnected user import refer to?

A

Method 1: Batch files sent to the server
Method 2: Batch files uploaded by an admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the three ways to manually create a new user?

A
  1. Upload from a CSV
  2. Create a user manually in the UI
  3. Open a request to create a user in the UI
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the three application types?

A

Connected, Hybrid, & Disconnected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

A Security System can be considered as this in Saviynt EIC

A

an Application Category (notes page 18)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Connections created in Saviynt are selected in this. Additionally, Workflows, access approval and removal need to be selected in this as well.

A

in the Security System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

An endpoint is an instance of this in Saviynt

A

an application or target system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How does application data import compare for disconnected applications versus connected applications?

A

For disconnected applications, a CSV file is used to import the data. For connected applications, you can use an out-of-the-box Saviynt connector or a database connector.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What job is used to import application data?

A

Application Data Import Job

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What Saviynt mechanism is used for rapid application onboarding?

A

Saiviynt Application Onboarding Workbench.

This is especially relevant for self-serve onboarding for business users and application owners.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Why the new application onboarding in Saviynt EIC?

A
  1. Less effort to onboard apps
  2. Reduced time to onboard apps
  3. Reduce application onboarding time by up to 90%
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Application Onboarding is via this particular Saviynt role

A

ROLE_ADMIN SAV role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are three types of application onboarding methods?

A

Advanced - Use this method to manually configure the enrollment of an application

Assisted - Use a wizard to define app settings.

Quick - Use of default or minimal settings, complete enrolling of the application with a single click

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is an identity BOT?

A

An identity bot allows you to integrate Saviynt Enterprise Identity Cloud with applications that do not expose integration APIs

Identity BOT can perform a set of predefined steps to help in the rapid onboarding of such applications for automating the process of integration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Three application types supported for onboarding by Identity BOT

A

Command Line
Desktop
Web

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Saviynt Controls Library Feature does this

A

The Saviynt Controls Library collects suggestions for common applications & compliance requirements, including HIPAA, HiTRUST, SOX, PCI DSS, CPPA, GDPR, ISO 2000 series, and NIST.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What two roles can provide admin privileges to Enterprise Identity Cloud

A

Role_Admin
Role_UIAdmin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Saviynt Roles are used to define this

A

Saviynt Roles are used to define the privileges granted to users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Benefits of Saviynt Roles

A

Persona-based access control (Sys Admin, Helpdesk, reporting manager, role owner)

Reduced administrative work and IT support

Maximized Operational Efficiency

Improved Compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What are the recommended naming conventions for Custom Saviynt Roles?

A

Start with ROLE_

Use UPPERCASE characters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are four ways to assign Saviynt Roles to users?

A

While setting up a connector (e.g. AD Connector)

When using Technical & User update rules

Via the Access Request System (ARS) module

While setting up Job Request Management (JRM) rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What are some core Saviynt IGA lifecycle & functional capabilities

A

Providing rules for new users that are distinct form rules for existing users.

Enabling event-based configuration rules

Facilitating automatic revoke of access based on the lifecycle of an identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What are three types of rules in Saviynt?

A

Event-Based Rules (technical rules, user update rules, entitlement update rules)

Access Request-based Rules

Data Access Governance-based Rules (Scan Rules)

52
Q

What are technical rules in Saviynt?

A

Technical rules are applied to provision birthrate access to employees joining an organization.

53
Q

What are user update rules in Saviynt?

A

User update rules are for the mover and leaver scenarios. When a user moves from contractor to permanent employee, the user gets a new manager, or the user is rehire, the user update rule is triggered.

54
Q

What are entitlement update rules in Saviynt?

A

Entitlement update rules are executed when any property or attribute of an entitlement changes

Entitlement update rules are used in conjunction w/ “non-elastic analytical runtime control of preventative type”

The above phrase might refer to a feature that continuously analyzes user activity and access attempts against predefined security rules. If the analysis detects suspicious activity that violates these rules (e.g., access attempts from unusual locations, excessive privilege escalation attempts), the control mechanism takes preventative actions.

Here’s a possible scenario:

  1. A user attempts to access a highly sensitive resource from an unrecognized location.
  2. Saviynt’s analytical runtime control detects this attempt in real-time.
  3. The non-elastic control, which might be a pre-configured rule, automatically blocks the access attempt to prevent a potential security breach.
55
Q

What are request rules in Saviynt?

A

Request rules are used when a single user, multi-user or bulk upload user requests are made from the Access Request System

56
Q

What are scan rules in Saviynt?

A

Scan rules are used to provide the capability to scan any sensitive or confidential information.

57
Q

Organization Update Rules

A

Organization Update Rules are used in conjunction with management of Organizations in Enterprise Identity Cloud

58
Q

What is the execution trail?

A

The execution trail shows you the details for rules that have been run. It contains information about the rules applied, as well as data before and after it was changed.

It also provides the ability to rerun failed rules & actions.

59
Q

What three tabs are on the execution trail page?

A

Action Trail - provides details of failed actions

Rule Trail - provides details about failed rules

Archived Rule Trail - used to view the line items archived after retrying the rule / rule action execution to successful completion

60
Q

True or false: Technical Rules can be used for zero-day access for new employees

A

True

61
Q

True of false: Technical Rules can remove birthright access automatically if a birthright condition fails anytime in the future

A

True

62
Q

What are two ways to trigger technical rules?

A

Auto-Trigger: User is created in Saviynt or imported from external sources (CSV, HRMS)

User Update Rule: A user update rule can re-run all provisioning rules and technical rules.

63
Q

Where can importing users from a HRMS be accomplished?

A

This can be done via the Job Control Panel using the drop-down option, Zero-day provisioning

64
Q

A technical rules is made up of a combination of these two parts

A

A condition (made up of user attributes) and an action.

65
Q

True or false: You can preview the data when you create technical rules, so that you have an understanding of the current users who match that rule.

A

True

66
Q

How does one create a technical rule?

A

Go to Policies -> Technical Rules. Then click Actions -> Create Technical Rule.

67
Q

List eight features of technical rules (used to assign access)

A
  1. Preview data capability
  2. Rule creation & modification approvals
  3. Advanced query options
  4. Ability to retry failed rules
  5. Rule ownership & approvals Workflow
  6. Delegated administration of rules
  7. Auto removal of access if condition fails
  8. Ability to assign access dynamically
68
Q

For technical rules, what are the birthright checkbox, and detective checkbox for?

A

The birthright check box is used if you want to evaluate a rule for newly created users.

The detective check box is used if you want to evaluate a rule for existing users.

69
Q

For technical rules, what does the advanced config slider do?

A

The advanced config slider, when turned on, allows you to write an advanced query for the condition to determine when and for who a technical rule applies.

70
Q

What are user update rules for?

A

User update rules are for the mover and leaver scenarios. When a user moves from contractor to permanent employee, the user gets a new manager, the user’s department changes, the new user is rehire, or a person is terminated, the user update rule is triggered.

71
Q

What are the two ways to trigger a user update rule?

(User update rules are for the mover and leaver scenarios)

A
  1. Auto-Trigger (user is updated in Saviynt, from CSV or HRMS)
  2. via Saviynt APIs
72
Q

Where do you find user update rules?

(User update rules are for the mover and leaver scenarios)

A

Go to Admin module - > Go to policies -> User update rules to see user update rules

73
Q

How do you trigger user updated rules when importing users from a CSV?

(User update rules are for the mover and leaver scenarios)

A

Go to Users -> Actions -> Upload user -> Check Rules -> Yes

74
Q

How do you trigger user updated rules when importing users from a HRMS?

(User update rules are for the mover and leaver scenarios)

A

Go to Job Control Panel -> UserImport job -> Check rules drop-down -> Yes

75
Q

List the eight features of User update rules

(User update rules are for the mover and leaver scenarios)

A
  1. Deprovision account
  2. Deprovision access
  3. Transfer Ownership
  4. Launch Microcertification
  5. Trigger technical rules
  6. Remove failed birthright access
  7. Deprovision role
  8. Enable user
76
Q

Where do you create user update rules?

(User update rules are for the mover and leaver scenarios)

A

Admin -> Policies -> User update rules -> Actions -> Create user update rule

77
Q

Where do you find roles?

A

Admin module -> Identity Repository -> Roles

78
Q

If a user’s title and manager changes, what type of rule would handle this?

A

This mover scenario is handled via a User Update Rule

79
Q

What type of rule would handle a leaver scenario, including offboarding user and transferring any possible role owndersips?

A

User update rule

80
Q

What can a user request for?

A

Applications
Roles
Emergency Roles
Emergency IDs
Group Management
Service account management

81
Q

What are the most common requests from a governance perspective?

A

Role management request & user management request

82
Q

What are the three high-level parts of an access request (assignment) flow?

A
  1. End user submits the access request
  2. Approver approves the request
  3. The request is fulfilled in the target application
83
Q

How is fulfillment for an approved access request completed for a connected app vs a disconnected app?

A

For a connected app, the access is automatically provisioned and fulfilled through connectors.

For a disconnected app, Saviynt creates a ticket in an external ITSM, such as ServiceNow

84
Q

What are three types of access requests?

A

application requests, role requests and bulk requests

85
Q

What can an application request be for?

A

Application access requests can be for an account, entitlement or application role of an application.

86
Q

What is an enterprise role request?

A

An enterprise role request is a request for entitlements that span across multiple endpoints (target applications).

87
Q

How does one submit a new access request?

A

From the home page, click the request new access tile

88
Q

Request history tile shows you what?

A

The request history tile shows you the status of current requests. If you have permission, you can view others’ requests in addition to your own.

89
Q

Where you can see requests that have not yet been handled?

A

Click the Pending Approvals tile to see pending approvals.

90
Q

What is Saviynt’s Smart Review in the context of access requests?

A

Smart Review gives you a little bit of automation and intelligence on a request. Smart Review automatically identifies all requests that are safe and approves them.

91
Q

Where in Saviynt would you create a job to pick up all pending tasks?

A

You can create a job in the job control panel to pick up all the pending tasks. You can schedule the job to run daily, hourly, every X number of minutes, or based on a Cron expression.

92
Q

Where does a Saviynt administrator configure settings for an appliation request?

A

Admin -> Identity Repository -> Security System -> select the application.
Next assign a workflow to the application. You can have separate workflows for access being added and access being removed.

93
Q

How does one make a role requestable?

A

To make a role requestable, set the request option to something else besides “None”.

94
Q

What is a workflow?

A

A workflow is the approval/reject process through which a request flows after the request is submitted for approval to the manager or resource owner.

95
Q

What variable is used to check violations for SOX compliance Workflow(s)?

A

SOXCRITICALCOUNT

96
Q

True of false: A workflow can be reused and assigned to multiple applications.

A

True

97
Q

What are the steps in the GUI to create an new workflow?

A

Admin -> Workflows -> Workflow List -> Actions -> Create New Workflow

98
Q

When creating a new workflow, what does a workflow begin with?

A

A workflow begins with a “start” event.

99
Q

A workflow is only activated once “this” has happened.

A

A Workflow is only activated once it has been approved.

100
Q

What are two things that should be done when finished creating a workflow?

A

Click “Send for approval” when you are done constructing a workflow. You can also specify an owner for the workflow.

101
Q

What does “Workflow accepted and loaded” mean?

A

“Workflow accepted and loaded” means that the workflow is active

102
Q

What does a green check mark for a workflow mean?

A

A green check mark means a workflow is ready to use and can be assigned to applications.

103
Q

What are four disciplines that governance, risk and compliance spans?

A

Enterprise risk managment, audit management (Sarbannes Oxley testing), compliance management (e.g. GPDR, NIST), access control

104
Q

True or false: Saviynt provides convergence of IDM and GRC

A

True

105
Q

Does Saviynt provide coarse-grained or fine-grained visibility into entitlements?

A

Saviynt provides fine-grained visibility into entitlements

106
Q

Where can Saviynt’s segregation of duties (SOD) capabilities be used?

A

Saviynt’s segregation of duties (SOD) capabilities be used used in a preventative manner (e.g. before granting access), or in a detective manner (if violation already exists).

107
Q

What are three Saviynt segregation of duties (SOD) objects?
page 61

A

Functions, risks, and rulesets

108
Q

What is a ruleset in the context of Separation of Duties for Saviynt?

A

A ruleset is a list containing all the risk definitions. You can go to rulesets in the SOD module to see the predefined rulesets for various applications.

109
Q

What are the four priority levels you can set for a risk definition in Saviynt SOD rulesets?

A

You can set the priority of the risk here to low, medium, high or critical.

110
Q

What is preventative SOD analysis in Saviynt?

A

Preventative SOD analysis is a proactive process that ensures the risks defined in a ruleset are not violated or mitigated while requesting access via Saviynt.

SOD violation can be viewed by the requestor at the time of the request, and by the approver at the approval level.

111
Q

What two user interface settings settings need to be turned on for preventative SOD configuration?

A

The following two user interface settings settings need to be turned on for preventative SOD configuration for access requests:

“Show SOD in Request”
“Evaluate SODs in Access Request”

112
Q

Where does a risk and compliance team member or Saviynt admin view detected SOD violations.

A
113
Q

What is detective SOD analysis designed in Saviynt to do?

A

Detective SOD analysis is designed in Saviynt to identity conflicts or violations after they have occurred according to pre-defined rulesets.

  • Any possibly violations can be monitored in SOD Workbench.
  • Violations can be remediated by removing the conflicting access, or the violations can be accepted for a limited time by associating mitigating control
114
Q

Where can you go in the Saviynt SOD module to see the results of an SOD evaluation job?

A

In SOD module, go to SOD Violations to see the results of the SOD Evaluation job (AKA SOD Violation workbench)

115
Q

What do Smart Filters do for SOD in User Access Reviews?

A

Smart Filters allow you to quickly focus on the riskiest access for User Access Reviews. Saviynt can automatically remove revoked access.

116
Q

What can you do for a detected SOD violation if you want to accept a risk for a period of time?

A

You can select mitigating controls for detective SOD violation if you want to accept a risk for a period of time. Once the expiration date has passed, the violation is moved to an open state again.

117
Q

What are certifications in Saviynt?

A

Certification is a process by which a responsible party or certifier insures that people and resources are granted access only when absolutely required for performing a function. Certification requires a primary certifier / owner of the object.

118
Q

What are campaigns in Saviynt?

A

Campaigns allow you to group similar access reviews together in Saviynt.

119
Q

What are the three parts of a campaign lifecycle?

A
  1. Preview & launch
  2. Manage
  3. Review Certification
120
Q

Where do you go in the interface to get to a campaign list?

A

Waffle button at top right - > Certifications -> Campaign List

121
Q

Where can you set up the defaults for campaign settings?

A

Global Configurations is the central place for managing configurations of all modules, including all default settings for campaigns.

122
Q

What does the Analytics piece of Saviynt Enterprise Identity Cloud all users to do?

A

Analytics allows users to create reports using custom queries against the Saviynt database.

123
Q

What kind of action could be available from actionable Saviynt reports?

A

You could revoke access directly from the reports page. You can map orphan accounts to specific users.

124
Q

What is data analyzer?

A

Data analyzer helps you to analyze the data stored in Saviynt Enterprise Identity Cloud. Data Analyzer accesses the database schema in read-only mode, and provides a SQL builder to write your custom SQL queries if desired. Top 100 results are displayed from the database.

125
Q

What is the Control Center?

A

The Control Center allows customers to meaningfully organize and visualize controls that are shipped, pre-packaged, or built by them. Three components of Control Center are topics, books & KPIs. KPIs can be positive or negative.

126
Q
A

Saviynt Identity Governance & Administration (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions