Free SailPoint Identity-Security-Administrator Practice Exam with Questions & Answers | Set: 2

This is an appropriate diagnostic method within the Search model represented by the course scenario. The query narrows the investigation to events associated with provisioning, filters for events containing errors, constrains the timeframe to the date on which the failure occurred, and associates the result with the affected identity, Clarence.Harper. Opening the corresponding event allows the administrator to investigate the contextual information associated with the failed provisioning operation.

The underlying troubleshooting principle remains central to Identity Security Cloud administration: provisioning failures should be correlated with audit events and account activity rather than evaluated only from the short error message shown in a dashboard. SailPoint Search contains audit-event information and supports filtering against event data. Event records can provide operation details, status, target information, source context, and additional attributes. SailPoint also provides a Provisioning Activity audit-report capability specifically for reviewing provisioning events.

Study Guide Reference: Provisioning — Monitoring Provisioning, Search and Audit Events, Troubleshooting Failed Provisioning Operations.

===============

This is a valid integration approach. Identity Security Cloud does not require every authoritative source to correspond to a purpose-built SaaS connector. For custom or legacy systems, generic integration mechanisms can expose the authoritative account or personnel information needed to construct identities.

A Delimited File source can load account information exported from a system into Identity Security Cloud. SailPoint describes the Delimited File connector as a general-purpose mechanism that reads account data from files and supports customizable account schemas. A database-backed custom HR application can instead be integrated through an appropriate JDBC/database connector when its personnel information is accessible through relational tables.

After creating the source, an Identity Profile can be associated with it to make that source authoritative. SailPoint states that when a source is configured as authoritative through an Identity Profile, an Identity Security Cloud identity is created for each applicable authoritative account.

The administrator must still design a reliable schema, uniquely identify contractors, configure required identity attributes, and determine suitable correlation and lifecycle mappings. Nevertheless, Delimited File and JDBC-style integrations are legitimate approaches for legacy authoritative data.

Study Guide Reference: Sources — Authoritative Sources, Generic Connectors, Delimited File Integration, JDBC Integration and Identity Profiles.

===============

The statement is too absolute. Identity Governance and Administration platforms substantially automate and streamline access governance processes, but they do not necessarily eliminate human judgment or fully automate every review, approval, and audit activity.

For example, an IGA platform can automatically generate access certification campaigns, identify the access requiring review, notify reviewers, record their decisions, perform supported remediation, and produce audit evidence. However, designated managers, application owners, source owners, or other certifiers are still commonly required to decide whether individual access should be retained or revoked. SailPoint describes certifications as processes in which designated certifiers review users' access and explicitly approve or revoke it.

Similarly, approval workflows automate routing and enforcement but can still require human authorization. Audit functionality generates searchable events, reports, and evidence, while auditors and compliance professionals still assess whether the organization's controls satisfy applicable requirements.

SailPoint describes IGA as streamlining certification and audit processes by automating reviews, notifications, and audit-ready reporting—not as eliminating every human governance decision.

Study Guide Reference: General knowledge for Identity Security Administrators — Identity Governance and Administration, Access Reviews, Approvals, Audit and Governance Automation.

===============

Certificate-based authentication is a valid authentication mechanism for verifying both user and device identities. It relies on Public Key Infrastructure (PKI), in which a trusted Certificate Authority issues a digital certificate containing the subject's public key and identifying information. During authentication, the certificate holder demonstrates possession of the corresponding private key, and the receiving system validates the certificate's trust chain, validity period, revocation status, intended use, and other policy requirements.

This model can authenticate individual users through certificates stored on smart cards, security tokens, or endpoint certificate stores. The same mechanism can authenticate managed computers, servers, and other devices by issuing device-specific certificates. Because the private key does not need to be transmitted to the authenticating service, certificate-based authentication provides stronger resistance to credential theft than reusable passwords when implemented correctly.

The statement therefore accurately describes a recognized authentication method applicable within broader enterprise identity and access-management architectures.

Study Guide Reference: Access Management — Authentication Methods, Certificate-Based Authentication, PKI and Strong Authentication.

===============

The statement is valid for identities whose role assignment is actively enforcing the role's access. Identity Security Cloud roles represent collections of access that can include entitlements and access profiles. When role access is expanded, the role's existing members are expected to receive the additional required access so their actual source access continues to satisfy the role definition.

Role configuration changes are not necessarily applied to every identity immediately at the moment the administrator saves the role. SailPoint states that access additions are handled by identity processing . Administrators can select Apply Changes on the Roles page to initiate processing across identities, or the change can be applied when relevant identity processing subsequently occurs. During that processing, the system recalculates the role-based access requirements and provisions new access to applicable source accounts.

This behavior is important to understand operationally: editing a role changes its access model, and Identity Security Cloud must then propagate those additions to identities holding the role.

Study Guide Reference: Access Management — Roles, Managing Role Access, Role Change Processing and Automated Provisioning.

===============

The statement is correct. During an Identity Security Cloud certification, the reviewer evaluates each required access item and records the appropriate decision—for example, approving or revoking access. The certification cannot be properly completed while required review items remain undecided.

SailPoint's current user documentation states that after the reviewer has reviewed each item , the reviewer is taken to the sign-off page to complete the certification. The reviewer then selects Finish to submit the decisions and move the certification into the completed state. SailPoint's certification overview likewise describes the sequence as reviewing assigned access, approving or revoking items, and then signing off on those decisions.

Sign-off has governance significance beyond the user-interface transition. Revocation decisions that have not been signed off are not treated as finalized remediation instructions. SailPoint explicitly warns that unsigned revoke decisions are not applied and can be treated as undecided when a campaign is administratively completed.

Therefore, completion of the required decisions is the prerequisite that brings the reviewer to the certification sign-off stage.

Study Guide Reference: Supporting Governance — Access Certifications, Review Decisions, Certification Sign-Off and Campaign Completion.

===============

Yes. Identity Security Cloud identity profiles support stronger verification for password-reset and account-unlock operations. When two-factor authentication is enabled for these functions, users must successfully complete two configured identity-verification methods before Identity Security Cloud permits the password reset operation. SailPoint explicitly documents this behavior under the identity profile's Password Reset and User Unlock settings.

Available verification methods can include a verification code or call to a configured phone number, a verification message delivered to an email address, security questions, Helpdesk-provided codes, or supported external MFA integrations. Administrators must ensure that the underlying identity attributes—such as phone numbers and email addresses—contain valid data when those methods are selected.

This password-reset authentication control should be distinguished from the Multifactor Authentication Sign-In Method , which uses an authenticator application to protect normal Identity Security Cloud sign-in. Both mechanisms strengthen authentication, but they protect different stages of account access.

Study Guide Reference: Access Management — Identity Profile Security Settings, Two-Factor Authentication, Password Reset and User Unlock Methods.

===============

The statement is incorrect. A role does not have to be requestable in Identity Security Cloud. Requestability is an optional capability used when organizations want users to obtain a role through the Request Center.

Roles can instead be assigned automatically according to Standard Criteria or an Identity List. When an identity satisfies automated assignment conditions, the role and associated access can be granted through identity processing without the user submitting an access request.

SailPoint specifically states that organizations can allow users to request roles when the role cannot easily be auto-assigned or when someone who does not meet its ordinary assignment criteria might legitimately require the access. To enable this behavior, an administrator edits the role's Access Requests configuration and turns on Allow Access Requests . The presence of an enable/disable setting itself demonstrates that requestability is optional rather than mandatory.

A role can therefore exist purely as automatically assigned business access, purely as requestable access where appropriate, or be configured according to the organization's access-governance design.

Study Guide Reference: Access Management — Roles, Access Requests, Requestable Roles and Automated Role Assignment.

===============

The proposed description is correct. Identity Security Cloud Search supports field-specific queries that allow administrators to search identity attributes directly. The expression attributes.location restricts the search to the location identity attribute rather than searching across all indexed identity fields.

The quotation marks around "sao paulo" indicate that the search engine should evaluate the value as a phrase. This means the query is intended to identify identities whose location attribute contains the phrase Sao Paulo rather than independently searching for the words sao and paulo in unrelated positions.

Field qualification is important when administrators need precise search results. Without the attributes.location prefix, a general search could potentially return matches from other searchable attributes or indexed properties. Combining the specific identity attribute with a quoted phrase produces a more targeted search result.

Therefore, the query accurately retrieves identities whose location information matches the Sao Paulo phrase.

Study Guide Reference: Platform — Identity Security Cloud Search, Building Search Queries, Identity Attribute Searches.

===============

This is not the standard Identity Security Cloud method for configuring role assignment criteria. Role membership can be automatically determined using defined identity or account-based criteria, or administrators can explicitly specify identities through an Identity List depending on the role configuration.

The Identity List mechanism is designed to identify users who should receive the role rather than create a separate universal exclusion list containing identities who must never receive it. When automatic assignment criteria are configured, identities satisfying those criteria can become role members based on the associated identity attributes, account attributes, or other supported conditions.

If a particular identity must not receive a role, administrators should design the role-assignment criteria so that the identity does not satisfy the required conditions or use another appropriate assignment strategy. Introducing an unsupported exclusion mechanism could create incorrect expectations about how role membership is calculated.

Roles are intended to package business-relevant access and automatically assign that access to identities meeting defined organizational criteria.

Study Guide Reference: Access Management — Roles, Role Assignment Criteria, Standard Criteria, Identity Lists.

===============