Identity-Security-Administrator SailPoint Certified Identity Security Administrator Questions and Answers

This is an essential and valid troubleshooting step. Lifecycle-state provisioning is triggered according to the lifecycle state calculated for an identity. If Identity Security Cloud does not actually consider the affected user to be in the Terminated state, the account-disable operations configured for that lifecycle state will not be initiated.

The administrator should therefore inspect the identity and confirm that its Lifecycle State value resolves to Terminated. If it does not, the next investigation should focus on the identity profile's lifecycle-state configuration, authoritative source attribute mapping, transforms or rules used to calculate lifecycle state, and whether the identity has been properly reprocessed after the source data changed.

Once an identity enters the configured lifecycle state, Identity Security Cloud can apply account actions defined under Settings for Previous Accounts , including disabling accounts across all sources or specified sources. SailPoint specifically uses Terminated and Archived states as examples where access removal and account disablement are commonly configured.

Consequently, validating the identity's actual lifecycle-state value is one of the first diagnostic checks that should be performed before investigating downstream connector or provisioning failures.

Study Guide Reference: Identity and Lifecycle Management — Lifecycle States, Terminated Identities, Lifecycle Attribute Calculation and Account Actions.

===============

This is a valid troubleshooting approach. An Active Directory provisioning failure such as "There is no such object on the server" indicates that the connector attempted an operation against an object or directory reference that Active Directory could not resolve. Potential causes include an account or group being deleted or moved, an outdated distinguished name, an invalid entitlement reference, replication timing, or a provisioning operation targeting an object that no longer exists.

Searching SailPoint's technical knowledge and community resources for the exact connector error is therefore useful because connector-specific errors often have previously documented causes, configuration considerations, and remediation patterns. This should complement—not replace—tenant-side investigation. An administrator should correlate the error with provisioning activity, source information, account state, and the target system. Identity Security Cloud provides Search and audit information for investigating provisioning activity, while SailPoint technical resources provide additional connector-specific context. Current SailPoint documentation explicitly identifies provisioning activity as auditable and searchable.

Study Guide Reference: Provisioning — Troubleshooting Provisioning Errors, Active Directory Connector Operations, SailPoint Support Resources.

===============

This is an appropriate diagnostic method within the Search model represented by the course scenario. The query narrows the investigation to events associated with provisioning, filters for events containing errors, constrains the timeframe to the date on which the failure occurred, and associates the result with the affected identity, Clarence.Harper. Opening the corresponding event allows the administrator to investigate the contextual information associated with the failed provisioning operation.

The underlying troubleshooting principle remains central to Identity Security Cloud administration: provisioning failures should be correlated with audit events and account activity rather than evaluated only from the short error message shown in a dashboard. SailPoint Search contains audit-event information and supports filtering against event data. Event records can provide operation details, status, target information, source context, and additional attributes. SailPoint also provides a Provisioning Activity audit-report capability specifically for reviewing provisioning events.

Study Guide Reference: Provisioning — Monitoring Provisioning, Search and Audit Events, Troubleshooting Failed Provisioning Operations.

===============

Waiting for an identity refresh is not the correct remediation for a missing source entitlement. Identity processing and entitlement aggregation perform different functions. Identity processing recalculates identity-related information and access relationships based on information already known to Identity Security Cloud; it does not independently discover a newly created entitlement that has never been successfully loaded from the external source.

New entitlement objects are discovered through entitlement aggregation or through supported account aggregation behavior, depending on the source and connector. SailPoint defines entitlement aggregation as the process of loading entitlement data from an external source into Identity Security Cloud. The completed aggregation records how many entitlements were discovered.

If an expected entitlement is absent, the administrator should inspect the source's entitlement configuration and schema, review aggregation status/history, confirm that the external entitlement exists, and run or troubleshoot an entitlement aggregation. SailPoint's troubleshooting guidance specifically directs administrators to perform entitlement aggregation when entitlement metadata is not being imported correctly.

Study Guide Reference: Sources — Entitlement Aggregation, Entitlement Schemas, Aggregation Troubleshooting and Identity Processing.

The statement does not accurately describe how governance-group approval and escalation operate. When a governance group is configured as an approver, the request is associated with the group's members, and a member of that governance group can perform the approval on behalf of the group. The system is not designed to send the request exclusively to the manager of one active group member.

Escalation behavior is also broader than the proposed statement suggests. SailPoint documents that when governance-group approvals are escalated to a manager level, the request can be escalated to each member's manager . If a particular member does not have a manager, that member's approval can remain assigned while other members' assignments are escalated. If none of the members has a manager, the applicable approvals can progress to the configured fallback approver.

Therefore, "only to the manager of an active member" incorrectly reduces a multi-member governance-group escalation process to one manager and does not reflect the documented routing behavior.

Study Guide Reference: Access Management — Governance Group Approvals, Escalation Chains, Access Request Reviewers.

===============

The statement is correct. Identity Security Cloud workflows consist of triggers, actions, operators, and control-flow relationships. Each workflow action requires a name that uniquely identifies the step within that workflow. The name is operationally significant because subsequent steps and conditional logic reference workflow actions by their names.

SailPoint specifically documents that every workflow action has a name and that the action name must be unique within the workflow so it can be referenced correctly in next-step definitions and conditional logic. The workflow builder can automatically generate the initial name based on the action type, but administrators can rename steps where clearer naming improves workflow readability.

If two workflow actions shared the same underlying step name, references could become ambiguous and workflow execution could not reliably determine which action's output or transition was intended. This is particularly important because action output becomes part of the workflow data flow and can be referenced by later steps.

Therefore, uniqueness is a functional requirement rather than merely a user-interface naming preference.

Study Guide Reference: Platform — Workflows, Workflow Actions, Step Names, Data Flow and Conditional Logic.

===============

Yes. Removing the @entitlements(name:Manager_Access) portion produces a valid identity-oriented query structure. Identity Search supports the @access(...) nested object because an identity can possess multiple access items. SailPoint specifically documents @access(displayName:...) for identifying identities that possess a named access item and @access(source.name:...) for locating identities whose access originates from a particular source. Nested access queries can be combined with ordinary identity fields by using Boolean operators.

The remaining query therefore applies three conditions correctly: the identity must have been created during the specified 24-hour range, and the identity must satisfy either the New_Hire_Access condition or the Acme_HRMS source-access condition.

The problem with the original expression is the @entitlements(...) nested object. In SailPoint's searchable data models, @entitlements is used when examining objects such as access profiles or roles that contain entitlements; it is not the appropriate nested object for identity-level access searches. Identity-level entitlement holdings are searched through @access(...).

Study Guide Reference: Platform — Search, Nested Queries, Identity Access Fields and Boolean Query Construction.

===============

This is a valid troubleshooting action. Identity Security Cloud provides administrators with centralized visibility into pending access requests through Approval Management / Approvals Administration . An administrator can select an access request and inspect its processing details rather than relying only on the status visible to the requester.

The request's Process view displays the progression of the approval and provisioning workflow. It identifies completed, active, and future steps and can show which approver or governance group currently owns an outstanding review. Where multiple reviewers are involved, administrators can expand approval stages to inspect individual reviewer status. The Assignees information also identifies who is currently responsible for approving the request.

This makes the administrative view particularly useful when a request appears "stuck." The administrator can determine whether it is waiting for approval, escalation, provisioning, or another processing stage and then take an appropriate supported action such as reminding or reassigning an approver.

Therefore, reviewing the request's administrative process flow is an appropriate first-line diagnostic step.

Study Guide Reference: Access Management — Approvals Administration, Tracking Access Requests, Approval Workflow and Pending Request Troubleshooting.

===============

This statement is incorrect. When a role uses Identity List as its assignment type, Identity Security Cloud expects administrators to explicitly search for and select individual identities that should receive the role. SailPoint's documented procedure is to select Identity List, search for a specific identity in Add Identities , add that identity, and repeat the process for additional identities. Identity List therefore functions as an explicit membership list rather than a pattern-based membership rule.

Wildcards such as * and ? are valid in Identity Security Cloud Search queries for supported text fields. For example, Search can use patterns to find records whose names match a particular character sequence. However, that Search capability must not be confused with role Identity List assignment criteria.

If dynamic membership is required, administrators should use Standard Criteria , where identity attributes, account attributes, or entitlements can be evaluated through supported comparison operators. Identity List is appropriate when named identities are deliberately selected.

Study Guide Reference: Access Management — Roles, Automated Role Assignment, Identity List, Standard Criteria and Search Wildcards.

===============

This approach satisfies the stated provisioning requirements. Identity Security Cloud roles can use identity attributes such as department as assignment criteria. Therefore, a standard role can be configured so that identities whose department equals Finance automatically qualify for the role, regardless of whether their employment type is employee or contractor.

The role can then contain the Office 365 E3 entitlement, either directly or through an appropriate access profile. When an identity satisfies role membership criteria, Identity Security Cloud automatically assigns the role and provisions its associated access to the identity's applicable source account. When the identity ceases to meet the criteria, the role and associated provisioned access can be removed.

This design does not indiscriminately assign a default Office 365 license to contractors throughout the organization. It targets Finance identities and grants the specific E3 access required by the scenario. It also avoids deliberately assigning both the default license and E3 license to the same Finance identity.

Study Guide Reference: Provisioning — Automated Role Assignment, Identity Attribute Criteria, Role-Based Provisioning and Entitlement Assignment.

===============

This approach is valid because Identity Security Cloud supports search-driven certification campaigns focused specifically on access items. An administrator can select Access Items , choose All Access Items Returned by a Query , and use Search to identify privileged entitlements, access profiles, or roles. The privileged:true field is supported for access-item data and identifies access designated as privileged. Identities possessing the selected access items are then included in the campaign.

The reviewer configuration also meets the requirement. For appropriate search-based certification types, Manager can be selected as the reviewer. Identity Security Cloud then assigns each identity's access review to that identity's manager. Therefore, managers review the privileged access belonging to their own subordinates rather than having a single central certifier review the entire population. If an identity has no manager, SailPoint provides fallback handling by assigning the certification to the campaign creator.

This combines privileged-access filtering with manager-based governance and directly satisfies the scenario.

Study Guide Reference: Supporting Governance — Search-Based Certification Campaigns, Access Item Certifications, Privileged Access and Manager Reviews.

===============

This is a valid troubleshooting action. Identity Security Cloud depends on the source's entitlement schema to understand what entitlement objects and attributes should be collected. If the schema or entitlement-type configuration is incorrect, a newly created entitlement might not be recognized correctly during aggregation.

In the current Identity Security Cloud interface, this functionality is represented under Entitlement Management > Entitlement Types and Schemas . Each entitlement type has a schema that defines attributes such as its identifier, name, display name, description, and other source-specific properties. The account schema also identifies which account attributes represent entitlements. Consequently, schema configuration directly affects how source entitlement information is interpreted and linked to accounts.

Administrators should therefore confirm that the expected entitlement type exists, verify that its entitlement ID and entitlement-name attributes are mapped correctly, and then perform an entitlement aggregation. SailPoint specifically recommends examining and correcting entitlement schema mappings when entitlement information is not being aggregated correctly.

Study Guide Reference: Sources — Entitlement Types and Schemas, Entitlement Aggregation, Source Entitlement Configuration.

===============

The statement is false. Identity Security Cloud distinguishes between defining an identity attribute for the tenant and mapping that attribute within a specific identity profile. When an administrator creates a new custom identity attribute from the mappings configuration of an identity profile, the attribute itself becomes available across all identity profiles in the tenant .

SailPoint explicitly states that any identity attribute added under any identity profile appears in all identity profiles. However, administrators do not have to map or use that attribute in every profile. Each identity profile can define its own mapping because different identity populations can obtain attribute values from different authoritative or secondary sources.

For example, a custom Employee Region attribute could be mapped from an HR source for employees while being mapped from Active Directory for contractors—or left unmapped in a profile where it is unnecessary. This distinction is essential: the attribute definition is tenant-wide, whereas the mapping and resulting value are identity-profile-specific.

Therefore, claiming that the custom attribute applies only to the identity profile where it was created is incorrect.

Study Guide Reference: Identity and Lifecycle Management — Identity Profiles, Custom Identity Attributes and Attribute Mappings.

===============

The statement is valid in the Identity Security Cloud source model. A source represents an external enterprise system that maintains accounts or personnel records. Those source accounts are aggregated into Identity Security Cloud so they can be correlated with identities and governed.

SailPoint's official definition states that a source represents a third-party enterprise application, database, or directory-management system maintaining its own set of user accounts or personnel records. For example, an Active Directory source can contain directory user accounts, while a database source might expose database accounts and a SaaS source might contain application-specific user objects.

This distinction between an identity and a source account is fundamental. One Identity Security Cloud identity can be correlated to accounts across multiple sources. The identity represents the person or governed entity, whereas each source account represents that identity's presence in a particular external system.

During aggregation, Identity Security Cloud loads account attributes and associated access from the source, correlates those accounts to identities, and uses the resulting relationships for provisioning, access modeling, certifications, and governance.

Study Guide Reference: Sources — Sources and Connectors, Source Accounts, Account Aggregation and Identity Correlation.

===============

The statement is not valid in the normal Identity Security Cloud identity model. An authoritative source is specifically used to establish identities. When a source is associated with an identity profile and thereby designated as authoritative, Identity Security Cloud creates an identity from each qualifying authoritative account. The authoritative account therefore forms the identity's authoritative foundation rather than behaving as an ordinary account that must subsequently be correlated to an existing identity.

Uncorrelated accounts normally arise from non-authoritative or secondary sources when Identity Security Cloud cannot match an aggregated account to an existing authoritative identity by using configured correlation criteria. SailPoint defines an uncorrelated account as an account that has not been linked to an authoritative identity. Such accounts must be resolved before their associated access can be properly governed.

Although unusual administrative edge cases can affect existing authoritative-account associations, this does not change the fundamental certification concept: authoritative accounts establish identities, while correlation attaches accounts from other sources to those identities.

Study Guide Reference: Identity and Lifecycle Management — Authoritative Sources, Identity Profiles, Account Correlation and Uncorrelated Accounts.

===============

This can be a valid reason, depending on the manager-review campaign mechanism being used. In a search-based certification campaign where Manager is selected as the reviewer, Identity Security Cloud determines the reviewer from each identity's manager relationship. If an identity does not have a manager defined, SailPoint documents that the certification is reassigned to the creator of the campaign . If the campaign creator is an administrator, the certification therefore appears assigned to that administrator instead of a manager.

The absence of a manager can originate from authoritative HR data, an incomplete manager attribute mapping, failed manager correlation, or otherwise missing manager information on the identity.

A distinction is important: traditional Manager Campaigns require identities to have managers defined and identities without managers are normally excluded. SailPoint recommends using a Search-based campaign with Manager selected as reviewer when identities without managers must still be included.

Given the scenario explicitly states that the certification was reassigned to an admin, missing manager information is therefore a technically valid explanation for the observed fallback assignment.

Study Guide Reference: Supporting Governance — Certifications, Manager Review, Search-Based Campaigns and Identities Without Managers.

===============

This action is valid. In Identity Security Cloud, the health state of an individual Virtual Appliance is exposed through VA status and alert indicators. A VA displaying a Connected status is operating normally and maintaining communication with the SailPoint tenant. Therefore, when an administrator reviews the appliances in a VA cluster and encounters a VA whose status is Connected, no remediation is required for that particular appliance.

The administrator should continue reviewing the remaining VAs because cluster health depends on the operational state of all participating appliances. Other statuses can require intervention. For example, an inactive or disconnected appliance can indicate network, configuration, certificate, or service-related problems. Warning and error indicators should be investigated to determine whether restart, connectivity troubleshooting, configuration correction, or escalation is required.

Consequently, treating a Connected VA as healthy and proceeding to inspect the next appliance is the correct operational response.

Study Guide Reference: Virtual Appliances — Monitoring Virtual Appliance Health, VA Status and Alert Messages.

===============

The statement is incorrect. A disabled role is not the appropriate state for validating actual automated role assignment through identity processing. Identity Security Cloud documents that disabling a role prevents future automated assignment and removes the role association from identities. Consequently, keeping the role disabled and performing identity processing does not provide a valid operational test of whether the configured membership criteria will assign the role as intended.

For an automatically assigned role, administrators define the assignment criteria, configure the required access, and enable the role. Identity Security Cloud then evaluates identities against the assignment criteria during identity processing. An administrator can manually initiate this evaluation by selecting Apply Changes from the Roles page. Identities satisfying the criteria receive the role and its configured access; identities that no longer satisfy the criteria can have the assignment removed.

Administrators should carefully validate role criteria before broad production application, but disabling the role specifically prevents it from functioning as an automated role assignment.

Study Guide Reference: Access Management — Role Management, Role Assignment Criteria, Enabling Roles and Identity Processing.

===============

The statement is incorrect because Governance Groups are not restricted to serving only as the primary owner of a Separation of Duties policy. Identity Security Cloud provides multiple ownership and governance assignments within SoD policy configuration.

For the Policy Owner , an administrator can select either an individual identity or a Governance Group. A policy can additionally have up to ten co-owners, and those co-owners may also include individuals or Governance Groups. Furthermore, the Violation Owner —the party responsible for handling violations generated by the policy—can be configured as an individual, an identity's manager, a Governance Group, or no explicitly selected owner, in which case responsibility can fall to the policy owner. SailPoint's current policy configuration documentation explicitly identifies these distinct ownership options.

Governance Groups are also used outside SoD policies. They can participate in access-request approvals, source ownership/governance, certification-related responsibilities, and scoped administration.

Therefore, saying Governance Groups can only be assigned as policy owners incorrectly limits their supported governance functions.

Study Guide Reference: Supporting Governance — Governance Groups, SoD Policy Ownership, Co-Owners and Violation Ownership.

===============

This statement accurately describes core Identity Governance and Administration capabilities. Effective IGA provides centralized visibility into identities, accounts, entitlements, roles, applications, and the relationships between identities and their access. This allows security and governance teams to determine who has access, how that access was obtained, whether it remains appropriate, and where excessive or conflicting privileges exist.

IGA also provides policy-driven control. Organizations can implement lifecycle-based provisioning and deprovisioning, access-request approvals, role-based access, periodic certification campaigns, privileged-access governance, and Separation of Duties policies. These mechanisms enable organizations to enforce least privilege while maintaining an auditable record of access-related decisions.

SailPoint describes IGA as providing visibility and oversight of user access across systems and applications while strengthening security through policy-based controls, access reviews, provisioning automation, and SoD. SailPoint also describes its identity-security capabilities as providing detailed visibility into identities, access privileges, and policies throughout an organization.

Therefore, access visibility combined with policy-based governance is a defining IGA capability.

Study Guide Reference: General knowledge for Identity Security Administrators — IGA Fundamentals, Access Visibility, Governance Policies, Least Privilege and Access Controls.

===============

The statement is correct. Identity Security Cloud allows administrators to configure a requestable role so that reviewers must provide justification when denying the requested access.

When configuring a role for access requests, administrators can enable the role for requests, define its approval process, and configure Require Comments behavior. SailPoint specifically provides an option named When a reviewer denies the request . Enabling this setting requires the reviewer to enter a comment or reason when rejecting the role request.

This requirement strengthens governance and auditability. A denial without explanation provides limited evidence about why the access was considered inappropriate. Requiring a comment records the business or security reasoning behind the decision, which can later assist administrators, access owners, auditors, and compliance personnel in understanding the approval history.

Comment requirements can also be configured at other stages, including when the requester submits the access request. Similar denial-comment controls exist for directly requestable entitlements.

Therefore, requiring a reviewer to document the reason for rejection is a supported role-request configuration.

Study Guide Reference: Access Management — Requestable Roles, Approval Processes, Require Comments and Access Request Governance.

The statement is incorrect. A role does not have to be requestable in Identity Security Cloud. Requestability is an optional capability used when organizations want users to obtain a role through the Request Center.

Roles can instead be assigned automatically according to Standard Criteria or an Identity List. When an identity satisfies automated assignment conditions, the role and associated access can be granted through identity processing without the user submitting an access request.

SailPoint specifically states that organizations can allow users to request roles when the role cannot easily be auto-assigned or when someone who does not meet its ordinary assignment criteria might legitimately require the access. To enable this behavior, an administrator edits the role's Access Requests configuration and turns on Allow Access Requests . The presence of an enable/disable setting itself demonstrates that requestability is optional rather than mandatory.

A role can therefore exist purely as automatically assigned business access, purely as requestable access where appropriate, or be configured according to the organization's access-governance design.

Study Guide Reference: Access Management — Roles, Access Requests, Requestable Roles and Automated Role Assignment.

===============

The statement correctly describes Identity Security Cloud's default self-approval prevention behavior when the requester is assigned as an individual reviewer . SailPoint does not normally permit a person to approve their own access request. This applies whether the request is submitted directly for themselves or whether the affected access recipient otherwise appears as a reviewer in the approval sequence.

When the requester or recipient is assigned an approval directly as an individual, Identity Security Cloud automatically reassigns that review responsibility to the individual's manager . If a valid manager is unavailable, the system can continue through alternative fallback mechanisms, eventually reaching an administrator when necessary.

There is an important distinction for Governance Groups: if the requester belongs to a Governance Group configured as reviewer, the requester is normally omitted while other group members remain eligible to approve. Only when that user is effectively the group's sole valid reviewer does manager reassignment occur.

An optional API setting can permit auto-approval for individual reviewers, but the default behavior described by the scenario is manager reassignment.

Study Guide Reference: Access Management — Preventing Self-Approval, Approval Reassignment, Manager Review and Access Request Governance.

===============

No. The term Directory Connection does not mean that Identity Security Cloud reads authentication credentials from an encrypted file stored in a filesystem directory. Directory Connection is SailPoint's pass-through authentication mechanism. For an identity profile configured with this sign-in method, administrators select an aggregated authentication source that corresponds to the identities in that profile. Users then authenticate by using the network password associated with their account on that source.

During authentication, Identity Security Cloud relies on the configured external directory source to validate the user's credentials. This is particularly common with enterprise directory systems such as Active Directory. The mechanism therefore enables users to use their organizational network credentials rather than maintaining an independent Identity Security Cloud password.

A prerequisite is that the authentication source and relevant accounts have been aggregated. An identity must also have an appropriately correlated account on the configured authentication source; otherwise authentication-source mismatch errors can occur.

No encrypted credential file in a local folder forms part of the documented Directory Connection authentication architecture.

Study Guide Reference: Access Management — Sign-In Methods, Directory Connection, Pass-Through Authentication and Authentication Sources.

This statement is correct and closely matches SailPoint's official definition of a source. Identity Security Cloud does not treat an external enterprise system itself as being physically contained within the tenant. Instead, it creates a source definition representing that application, database, directory, HR system, or other managed environment.

The source definition supplies the governance context through which Identity Security Cloud interacts with the underlying system. A connector gathers account and access information and associates that data with the source. Identity Security Cloud can then correlate source accounts to identities, aggregate entitlements, model access, perform certifications, support access requests, and—in the case of writable connectors—provision changes back to the external system.

SailPoint's current source-management documentation explicitly defines a source as the Identity Security Cloud representation of a third-party enterprise application, database, or directory-management system maintaining its own user accounts or personnel records.

This distinction between source and connector is important: the source is the governed system representation, while the connector provides the technical mechanism used to communicate with that system.

Study Guide Reference: Sources — Source Definitions, Connector Definitions, Source Accounts and Enterprise System Integration.

===============

The statement is incorrect. Identity Security Cloud does not use majority voting within a Governance Group for an access-request approval step. When a Governance Group is configured as a reviewer, only one eligible member of that Governance Group is required to approve or deny the request on behalf of the group .

SailPoint explains that when an access request reaches a Governance Group, its members receive the applicable review assignment. Once one member makes the decision, the review is treated as completed for that Governance Group and disappears from the other members' pending approval lists.

This should not be confused with a multi-step approval process containing several separate reviewers. If the access item is configured with multiple required reviewer stages, each required stage must approve before provisioning occurs. However, a Governance Group itself represents one reviewer stage, and that stage does not require approval from 50%, a majority, or every member.

Therefore, requiring a majority of Governance Group members is not how standard Identity Security Cloud Governance Group approvals operate.

Study Guide Reference: Access Management — Governance Group Approvals, Access Requests, Multi-Approver Processes and Group Review Decisions.

===============