Free SailPoint Identity-Security-Administrator Practice Exam with Questions & Answers | Set: 3

Yes, when the user's application access is governed through attribute-driven role assignment, a department change can trigger deprovisioning of access that is no longer appropriate. Identity Security Cloud roles can use mapped identity attributes such as Department as membership criteria. During identity processing, SailPoint evaluates whether the identity continues to satisfy those criteria.

If the user moves to another department and consequently ceases to satisfy the role's assignment criteria, the identity is removed from the role. SailPoint explicitly documents that when identities are removed from roles because of assignment-criteria changes, access assigned by those roles is removed or deprovisioned , unless the same access is independently provided through another role or assignment.

This implements birthright and role-based lifecycle governance: business changes such as department transfers should automatically cause obsolete access to be removed while new access appropriate to the destination department can be provisioned. SailPoint even provides a workflow template specifically addressing identity department changes and reassessment of old versus new access.

Thus, a department change is a valid deprovisioning trigger when the former application's access derives from criteria that the identity no longer satisfies.

Study Guide Reference: Provisioning — Automated Role Assignment, Attribute Changes, Role Deprovisioning and Department-Based Access Lifecycle.

No. Current Identity Security Cloud behavior does not automatically assign sp:scopes:all when an administrator or user creates a Personal Access Token without explicitly selecting scopes. SailPoint documents that when no scopes are selected, the default scope is assigned. That default provides permission only for API endpoints that do not require authorization; it is not equivalent to unrestricted access under sp:scopes:all.

The sp:scopes:all scope must be intentionally selected when required. Even then, it does not grant arbitrary privileges beyond the token owner's authority. Instead, it authorizes API scopes that are available through the user levels assigned to the user who created the PAT. Consequently, PAT permissions remain bounded by that identity's effective Identity Security Cloud privileges.

This behavior supports the principle of least privilege. SailPoint recommends selecting only the scopes necessary for the application or integration using the token rather than broadly assigning sp:scopes:all.

Therefore, leaving all scope checkboxes unselected does not implicitly grant all available API scopes.

Study Guide Reference: Platform — Personal Access Tokens, OAuth/API Scopes, sp:scopes:all and Least-Privilege API Authentication.

===============

The statement is valid. Multi-Factor Authentication (MFA) strengthens authentication by requiring more than a single verification mechanism before access is granted. Authentication factors are generally categorized as something the user knows, something the user possesses, or something the user inherently is. Requiring multiple factors substantially reduces the effectiveness of a compromised password because possession of that password alone is insufficient to complete authentication.

Identity Security Cloud supports MFA through an external authenticator application. When MFA is configured for an Identity Profile, affected users register an authenticator and subsequently provide a generated verification code during authentication. SailPoint also distinguishes sign-in MFA from two-factor verification used for password resets and account unlocking, where administrators can explicitly require users to complete two configured verification methods.

Therefore, the video's characterization of MFA as requiring two or more forms of verification correctly reflects the underlying security principle. MFA should not be confused with authorization: authentication establishes identity, whereas authorization determines what authenticated identities are permitted to access.

Study Guide Reference: Access Management — Multifactor Authentication, Authentication Factors, Strong Authentication and Identity Profile Sign-In Methods.

===============

This is not the primary purpose of an Identity Profile. In Identity Security Cloud, an Identity Profile establishes how identities are created and governed from an authoritative source . It determines the authoritative source associated with a population, maps source account attributes into identity attributes, defines authentication and security settings, and configures lifecycle-state behavior. SailPoint states that configuring an Identity Profile makes the associated source authoritative and creates identities from accounts on that source.

Assigning permissions based on business roles belongs instead to the access model . Roles can bundle access profiles and associated entitlements and can be automatically assigned to identities by Standard Criteria or by explicitly selecting identities through an Identity List.

An Identity Profile may indirectly affect access through lifecycle-state provisioning, but this is materially different from assigning specific permissions based on roles. Consequently, the proposed statement confuses identity population and lifecycle configuration with role-based access assignment.

Study Guide Reference: Identity and Lifecycle Management — Identity Profiles, Authoritative Sources, Identity Attribute Mapping and Lifecycle Configuration.

===============

The statement is incorrect. A SaaS-based application does not inherently require a "cloud-based VA." Identity Security Cloud supports SaaS connectors that can connect supported cloud applications directly without requiring the customer to deploy a Virtual Appliance cluster.

SailPoint explicitly states that organizations can use a SaaS connector when they want to upload data to Identity Security Cloud from a source without a Virtual Appliance cluster . In contrast, VA-based connectors are used when direct connector communication must occur from the customer's controlled environment.

Furthermore, a SailPoint VA is not normally a SailPoint-hosted cloud appliance. SailPoint provides the virtual appliance image, but the VA is deployed on infrastructure procured or controlled by the customer. SailPoint manages and updates the appliance software while the customer provides the hosting environment and network connectivity.

Some cloud-hosted applications can still use VA-based connectors depending on network topology and connector design, but being a SaaS application alone does not impose a VA requirement.

Study Guide Reference: Virtual Appliances — VA-Based versus SaaS Connectors, VA Deployment Architecture and Cloud Application Connectivity.

===============

The statement does not accurately describe how governance-group approval and escalation operate. When a governance group is configured as an approver, the request is associated with the group's members, and a member of that governance group can perform the approval on behalf of the group. The system is not designed to send the request exclusively to the manager of one active group member.

Escalation behavior is also broader than the proposed statement suggests. SailPoint documents that when governance-group approvals are escalated to a manager level, the request can be escalated to each member's manager . If a particular member does not have a manager, that member's approval can remain assigned while other members' assignments are escalated. If none of the members has a manager, the applicable approvals can progress to the configured fallback approver.

Therefore, "only to the manager of an active member" incorrectly reduces a multi-member governance-group escalation process to one manager and does not reflect the documented routing behavior.

Study Guide Reference: Access Management — Governance Group Approvals, Escalation Chains, Access Request Reviewers.

===============

The statement is incorrect because Governance Groups are not restricted to serving only as the primary owner of a Separation of Duties policy. Identity Security Cloud provides multiple ownership and governance assignments within SoD policy configuration.

For the Policy Owner , an administrator can select either an individual identity or a Governance Group. A policy can additionally have up to ten co-owners, and those co-owners may also include individuals or Governance Groups. Furthermore, the Violation Owner —the party responsible for handling violations generated by the policy—can be configured as an individual, an identity's manager, a Governance Group, or no explicitly selected owner, in which case responsibility can fall to the policy owner. SailPoint's current policy configuration documentation explicitly identifies these distinct ownership options.

Governance Groups are also used outside SoD policies. They can participate in access-request approvals, source ownership/governance, certification-related responsibilities, and scoped administration.

Therefore, saying Governance Groups can only be assigned as policy owners incorrectly limits their supported governance functions.

Study Guide Reference: Supporting Governance — Governance Groups, SoD Policy Ownership, Co-Owners and Violation Ownership.

===============

1. An IT company grants system administrators elevated permissions to manage critical servers and network configurations. These administrators use unique, secure credentials and multi-factor authentication to access sensitive systems, ensuring that only qualified personnel can perform high-risk tasks.

Select a match:

Answer: Privileged Access

2. A payroll administrator at a financial services company is responsible for processing employee salaries. Due to staffing shortages, they are also given approval access for salary disbursements, meaning they can both enter and approve payroll transactions.

Select a match:

Answer: Separation of Duties (SOD)

3. A customer support agent in a healthcare company accesses a patient's full medical history and Social Security number to verify their identity for a simple billing inquiry.

Select a match:

Answer: Personally Identifiable Information (PII)

The first scenario represents Privileged Access because system administrators hold elevated permissions that allow them to perform sensitive, high-impact operations on critical infrastructure. SailPoint identifies privileged entitlements as access that can expose sensitive data or create elevated security risk, making stronger controls such as MFA and dedicated credentials appropriate.

The second scenario represents Separation of Duties (SOD) . Allowing the same payroll administrator both to enter payroll transactions and approve salary disbursements creates conflicting responsibilities. SailPoint's SoD model specifically exists to prevent one identity from possessing combinations of access that allow them to initiate and independently authorize sensitive business transactions.

The third scenario involves Personally Identifiable Information (PII) because medical information combined with a Social Security number directly exposes sensitive information associated with an identifiable individual.

Study Guide Reference: Supporting Governance — Separation of Duties, Privileged Access, Sensitive Data and Identity Governance Controls.

The statement is incorrect. A disabled role is not the appropriate state for validating actual automated role assignment through identity processing. Identity Security Cloud documents that disabling a role prevents future automated assignment and removes the role association from identities. Consequently, keeping the role disabled and performing identity processing does not provide a valid operational test of whether the configured membership criteria will assign the role as intended.

For an automatically assigned role, administrators define the assignment criteria, configure the required access, and enable the role. Identity Security Cloud then evaluates identities against the assignment criteria during identity processing. An administrator can manually initiate this evaluation by selecting Apply Changes from the Roles page. Identities satisfying the criteria receive the role and its configured access; identities that no longer satisfy the criteria can have the assignment removed.

Administrators should carefully validate role criteria before broad production application, but disabling the role specifically prevents it from functioning as an automated role assignment.

Study Guide Reference: Access Management — Role Management, Role Assignment Criteria, Enabling Roles and Identity Processing.

===============