Free SailPoint Identity-Security-Administrator Practice Exam with Questions & Answers

Yes. This is a classic Separation of Duties scenario. The individual requesting a significant system configuration change should not also possess the authority to independently approve that same change. Combining requester and approver responsibilities eliminates an important independent-control checkpoint and allows one person to initiate and authorize a potentially high-impact administrative operation.

SailPoint's official SoD guidance specifically uses major system configuration changes as an example: significant configuration changes should be approved by someone other than the person requesting the change. SoD policies are designed to identify and govern combinations of access that would enable such conflicting responsibilities.

From a governance perspective, the requester initiates the business or technical need, while an independent reviewer determines whether the requested change is appropriate, authorized, and sufficiently controlled. Separating these functions reduces fraud, accidental misconfiguration, privilege abuse, and unauthorized system modification. Where conflicting access already exists, Identity Security Cloud can identify the associated SoD violation for investigation and remediation.

Therefore, allowing the requester to approve their own major system change represents exactly the type of control conflict that SoD is intended to prevent.

Study Guide Reference: Supporting Governance — Separation of Duties, Requester/Approver Conflicts, Internal Controls and SoD Policy Enforcement.

===============

Yes. Checking these mapped attributes is a primary troubleshooting action for an Identity Exception. Identity Security Cloud defines User Name (uid) , Work Email (email) , and Last Name (lastname) as required identity attributes. Every identity profile must contain mappings for these attributes, and none of the resulting identity values can be null. User Name carries the additional requirement of being unique across identities in the tenant.

When an authoritative-source account is missing one or more required values during aggregation, Identity Security Cloud generates an Identity Exception instead of creating the identity normally. A duplicate User Name can also produce an exception. The administrator should therefore inspect the Identity Exceptions report, identify which required attribute is absent or invalid, and verify the corresponding source-account data and identity-profile mappings.

SailPoint's documented remediation is to correct the problematic source information and then aggregate the source again, either manually or through the next scheduled aggregation. If direct mapping cannot generate a required value, a transform or supported rule can derive it.

Study Guide Reference: Identity and Lifecycle Management — Identity Profiles, Required Identity Attributes, Identity Exceptions and Attribute Mappings.

===============

This is a valid and specifically documented cause of missing entitlements during flat-file aggregation. When multiple rows represent different entitlements belonging to the same account, Identity Security Cloud expects the rows for that account to be grouped together according to the account identifier.

SailPoint's aggregation troubleshooting documentation explicitly addresses the condition in which only one or an incomplete set of entitlements is aggregated for accounts from a delimited file. The documented remediation is to ensure that the file is sorted by account ID . SailPoint's Generic Flat File prerequisites similarly state that all accounts and entitlements must be sorted by the account name so that all entitlement rows for an account appear together.

This requirement matters because the aggregation parser must correctly recognize consecutive records as belonging to the same logical account while assembling its multi-valued entitlement attributes. If the same account appears in separated regions of the file, the complete entitlement set may not be assembled as expected.

Therefore, sorting and grouping all rows for each account together is a fundamental preprocessing requirement when supplying multi-valued entitlement information through flat files.

Study Guide Reference: Sources — Flat File Aggregation, Delimited Files, Multi-Valued Entitlements and Aggregation Troubleshooting.

===============

1. Section of the UI that allows users to ask for access.

Select a match:

Answer: Request Center

2. Provide an interface to read user account data and provision changes from Identity Security Cloud to target systems and applications.

Select a match:

Answer: Direct Connection

3. A ticket is created in ServiceNow and assigned to the operations team that manages the source application.

Select a match:

Answer: Service Desk Integration

4. A task is created and assigned to a source owner to provision the users' access being requested.

Select a match:

Answer: Manual work Item

Request Center is the end-user interface through which users browse and request configured roles, access profiles, and entitlements. Direct Connection represents the connection model through which Identity Security Cloud communicates with a managed source and, when provisioning is supported and enabled, performs changes directly rather than requiring manual intervention. SailPoint distinguishes directly connected sources from flat-file/manual provisioning sources.

Service Desk Integration is appropriate when fulfillment is delegated to an external service-management platform such as ServiceNow. The resulting ticket is routed to the operational team responsible for implementing the requested change. Manual work Item applies when Identity Security Cloud cannot automatically provision the requested change; instead, a provisioning task is assigned to the responsible source or entitlement owner for completion outside the automated connector path. SailPoint explicitly documents manual provisioning tasks for sources that cannot be automatically written to.

Study Guide Reference: Provisioning — Provisioning Methods, Direct Connections, Manual Provisioning, Service Desk Integration and Request Center.

This statement accurately describes one of the principal purposes of the Virtual Appliance. Identity Security Cloud is a SaaS platform, but many enterprise identity sources are located inside customer-controlled networks and cannot safely accept direct inbound connections from an external cloud service. The VA provides the secure intermediary required for these integrations.

SailPoint defines the VA as a Linux-based virtual machine deployed on the customer's infrastructure that connects Identity Security Cloud to organizational sources and applications through supported APIs, connectors, and integrations. The architecture is designed around outbound-only communication from the VA toward SailPoint's cloud environment. SailPoint does not initiate a direct inbound connection to the VA.

This architecture enables account and entitlement aggregation, account correlation support, provisioning, password-related operations, and other connector activities against internal sources while avoiding the need to expose those systems directly through the firewall.

SaaS connectors can eliminate the VA requirement for supported cloud services, but VA-based connectors remain fundamental when direct customer-network connectivity is required.

Study Guide Reference: Virtual Appliances — VA Purpose, On-Premises Source Connectivity, Outbound-Only Architecture and Source Integration.

===============

The statement is valid. A Governance Group is intended to provide a collection of identities that can make governance decisions about access. If the group has no valid members, there is nobody within that group who can perform the required approval action.

SailPoint explicitly states that before a Governance Group reviews access, it must be configured and have members . When the Governance Group's turn arrives during an access request or certification, its members receive notification and any eligible member can act on behalf of the group.

Identity Security Cloud has fallback and reassignment mechanisms for situations where reviewers cannot be resolved, but administrators should not design approval configurations around an empty Governance Group. Doing so creates unnecessary routing failures, escalation, or reassignment and weakens the intended ownership model.

The recommended governance model is therefore to create the group, assign appropriate responsible identities as members, maintain membership as organizational responsibilities change, and only then use that group as a reviewer, owner, or governance decision point.

Study Guide Reference: Access Management — Governance Groups, Group Membership, Access Request Reviewers and Approval Configuration.

===============

This statement is correct and closely matches SailPoint's official definition of a source. Identity Security Cloud does not treat an external enterprise system itself as being physically contained within the tenant. Instead, it creates a source definition representing that application, database, directory, HR system, or other managed environment.

The source definition supplies the governance context through which Identity Security Cloud interacts with the underlying system. A connector gathers account and access information and associates that data with the source. Identity Security Cloud can then correlate source accounts to identities, aggregate entitlements, model access, perform certifications, support access requests, and—in the case of writable connectors—provision changes back to the external system.

SailPoint's current source-management documentation explicitly defines a source as the Identity Security Cloud representation of a third-party enterprise application, database, or directory-management system maintaining its own user accounts or personnel records.

This distinction between source and connector is important: the source is the governed system representation, while the connector provides the technical mechanism used to communicate with that system.

Study Guide Reference: Sources — Source Definitions, Connector Definitions, Source Accounts and Enterprise System Integration.

===============

The statement is correct. Identity Security Cloud allows administrators to configure a requestable role so that reviewers must provide justification when denying the requested access.

When configuring a role for access requests, administrators can enable the role for requests, define its approval process, and configure Require Comments behavior. SailPoint specifically provides an option named When a reviewer denies the request . Enabling this setting requires the reviewer to enter a comment or reason when rejecting the role request.

This requirement strengthens governance and auditability. A denial without explanation provides limited evidence about why the access was considered inappropriate. Requiring a comment records the business or security reasoning behind the decision, which can later assist administrators, access owners, auditors, and compliance personnel in understanding the approval history.

Comment requirements can also be configured at other stages, including when the requester submits the access request. Similar denial-comment controls exist for directly requestable entitlements.

Therefore, requiring a reviewer to document the reason for rejection is a supported role-request configuration.

Study Guide Reference: Access Management — Requestable Roles, Approval Processes, Require Comments and Access Request Governance.

Yes. This is an appropriate scenario for applying Separation of Duties (SoD). The fundamental purpose of SoD is to prevent a single identity from accumulating combinations of privileges that provide excessive control over a sensitive business or technical process. Assigning one person responsibility for user administration, application administration, and data backup management creates significant concentration of privilege. Such a person could potentially create or modify accounts, change application configuration or permissions, and manipulate or restore protected data without independent oversight.

Identity Security Cloud supports SoD policies by defining two sets of conflicting access. A violation occurs when an identity possesses qualifying access from both sides of the policy. Administrators can then investigate, remediate, or formally manage exceptions. SailPoint describes SoD as an internal control intended to reduce risk by preventing identities from possessing inappropriate combinations of access.

Therefore, separating these powerful administrative capabilities among different responsible individuals is consistent with least privilege and defense-in-depth governance.

Study Guide Reference: Supporting Governance — Separation of Duties, Conflicting Access, SoD Policies and Privileged Access Governance.

===============

The statement accurately describes the cryptographic trust model underlying SAML federation. In a typical SAML configuration, the Identity Provider (IdP) authenticates the user and issues a SAML assertion. The Service Provider (SP) validates the assertion, particularly its digital signature, by using certificate/public-key information associated with the trusted IdP. Private keys remain protected by their owners; the corresponding certificates containing public keys can be exchanged through configuration or SAML metadata.

For Identity Security Cloud operating as a SAML Service Provider, SailPoint requires administrators to obtain the IdP's signing certificate and configure it in Identity Security Cloud. SailPoint also provides Service Provider metadata that can be supplied to the IdP. This establishes the federation relationship and allows the participating systems to validate SAML messages according to the configured trust model. The critical concept is that passwords are not shared between the IdP and SP. Authentication assertions are trusted because they originate from an established federation partner and can be cryptographically validated.

Study Guide Reference: Access Management — Authentication Methods, SAML Federation, Identity Provider and Service Provider Trust.

===============