SailPoint Identity-Security-Administrator - SailPoint Certified Identity Security Administrator

This statement is incorrect. When a role uses Identity List as its assignment type, Identity Security Cloud expects administrators to explicitly search for and select individual identities that should receive the role. SailPoint's documented procedure is to select Identity List, search for a specific identity in Add Identities , add that identity, and repeat the process for additional identities. Identity List therefore functions as an explicit membership list rather than a pattern-based membership rule.

Wildcards such as * and ? are valid in Identity Security Cloud Search queries for supported text fields. For example, Search can use patterns to find records whose names match a particular character sequence. However, that Search capability must not be confused with role Identity List assignment criteria.

If dynamic membership is required, administrators should use Standard Criteria , where identity attributes, account attributes, or entitlements can be evaluated through supported comparison operators. Identity List is appropriate when named identities are deliberately selected.

Study Guide Reference: Access Management — Roles, Automated Role Assignment, Identity List, Standard Criteria and Search Wildcards.

===============

This is a valid and specifically documented cause of missing entitlements during flat-file aggregation. When multiple rows represent different entitlements belonging to the same account, Identity Security Cloud expects the rows for that account to be grouped together according to the account identifier.

SailPoint's aggregation troubleshooting documentation explicitly addresses the condition in which only one or an incomplete set of entitlements is aggregated for accounts from a delimited file. The documented remediation is to ensure that the file is sorted by account ID . SailPoint's Generic Flat File prerequisites similarly state that all accounts and entitlements must be sorted by the account name so that all entitlement rows for an account appear together.

This requirement matters because the aggregation parser must correctly recognize consecutive records as belonging to the same logical account while assembling its multi-valued entitlement attributes. If the same account appears in separated regions of the file, the complete entitlement set may not be assembled as expected.

Therefore, sorting and grouping all rows for each account together is a fundamental preprocessing requirement when supplying multi-valued entitlement information through flat files.

Study Guide Reference: Sources — Flat File Aggregation, Delimited Files, Multi-Valued Entitlements and Aggregation Troubleshooting.

===============

The statement is valid. In Identity Security Cloud, entitlements represent individual access rights or permissions that exist on connected sources. The specific form of an entitlement depends on the target system. Examples can include Active Directory groups, application roles, permission sets, security groups, database privileges, or other source-specific access constructs.

Entitlements form a fundamental layer of SailPoint's access model. Administrators can combine one or more entitlements from the same source into an access profile. Access profiles can then be incorporated into roles to create higher-level business access models.

Because SailPoint aggregates entitlement information from connected sources, administrators can govern these access rights through certifications, access requests, provisioning processes, role management, and policy analysis. Entitlement metadata can also provide meaningful descriptions and ownership information so reviewers understand the access being governed.

Therefore, describing entitlements as specific access rights on a source precisely reflects their role in Identity Security Cloud's access governance architecture.

Study Guide Reference: Access Management — Entitlements, Access Profiles, Roles and Access Model Fundamentals.

===============

The statement is incorrect. A source in Identity Security Cloud is not primarily a backup-storage repository. A source represents an enterprise system from which Identity Security Cloud obtains account, identity, and access information or to which it performs supported provisioning operations.

SailPoint defines a source as the Identity Security Cloud representation of a third-party enterprise application, database, or directory-management system that maintains its own accounts or personnel records. Connectors are used to interact with those systems so Identity Security Cloud can aggregate accounts and access rights and associate that information with identities.

Examples include Active Directory, HR applications, databases, SaaS platforms, and flat-file feeds. Depending on connector capabilities and configuration, a source can support account aggregation, entitlement aggregation, account creation and modification, enable/disable operations, password management, and entitlement provisioning.

Backup and disaster-recovery functions are separate concerns. Configuration Hub, for example, backs up supported Identity Security Cloud configuration objects , but that does not redefine enterprise sources as backup systems.

Study Guide Reference: Sources — Source Definitions, Connectors, Account and Entitlement Aggregation, Source Management.

===============

The statement is incorrect. Identity Security Cloud does not automatically transfer a departed reviewer's certification responsibilities to that reviewer's manager merely because of the reporting relationship. Certification ownership is explicitly assigned, and the authorized replacement process is reassignment rather than implicit managerial inheritance.

If the original reviewer cannot finish a certification, an administrator can reassign that pending certification to another qualified identity. Identity Security Cloud validates the reassignment to prevent the new reviewer from certifying their own access. A manager can also configure work reassignment for their team members when that functionality is enabled, but that still establishes an explicit reassignment rather than granting the manager unrestricted authority to enter every certification belonging to the employee.

After a campaign deadline, administrators also have campaign-level options for resolving undecided items, including completing the campaign according to the configured maintain-or-revoke behavior.

Therefore, the correct response to a departed reviewer is to use supported reassignment or campaign-completion procedures, not assume the reviewer's manager automatically acquires all pending certifications.

Study Guide Reference: Supporting Governance — Certification Reassignment, Work Reassignment, Campaign Deadlines and Reviewer Responsibilities.

===============

The statement is valid. A Governance Group is intended to provide a collection of identities that can make governance decisions about access. If the group has no valid members, there is nobody within that group who can perform the required approval action.

SailPoint explicitly states that before a Governance Group reviews access, it must be configured and have members . When the Governance Group's turn arrives during an access request or certification, its members receive notification and any eligible member can act on behalf of the group.

Identity Security Cloud has fallback and reassignment mechanisms for situations where reviewers cannot be resolved, but administrators should not design approval configurations around an empty Governance Group. Doing so creates unnecessary routing failures, escalation, or reassignment and weakens the intended ownership model.

The recommended governance model is therefore to create the group, assign appropriate responsible identities as members, maintain membership as organizational responsibilities change, and only then use that group as a reviewer, owner, or governance decision point.

Study Guide Reference: Access Management — Governance Groups, Group Membership, Access Request Reviewers and Approval Configuration.

===============

The statement is not accurate as written. Configuration Hub restoration does use a draft , but an administrator cannot simply add arbitrary missing configuration objects to an existing draft through the normal draft-editing process.

The supported restoration workflow is to select the required backup, create a deployment draft, review the differences between the backup and the live tenant, optionally edit supported object details or remove objects that should not be deployed, and then deploy the draft. Configuration Hub automatically evaluates dependencies and identifies reference issues while preparing the draft.

Current SailPoint documentation specifically states that administrators can edit JSON definitions of existing draft objects or remove objects/object types. If an administrator removes an object from the draft and later discovers that this was a mistake, the supported action is to create a new draft from the backup and start again . There is no general "add missing object" operation to repopulate an existing draft.

Therefore, reviewing the draft is correct, but the proposed mechanism of editing and adding missing objects makes the overall statement invalid.

Study Guide Reference: Platform — Configuration Hub, Backups, Configuration Drafts and Restoring Tenant Configuration.

===============

This is an essential and valid troubleshooting step. Lifecycle-state provisioning is triggered according to the lifecycle state calculated for an identity. If Identity Security Cloud does not actually consider the affected user to be in the Terminated state, the account-disable operations configured for that lifecycle state will not be initiated.

The administrator should therefore inspect the identity and confirm that its Lifecycle State value resolves to Terminated. If it does not, the next investigation should focus on the identity profile's lifecycle-state configuration, authoritative source attribute mapping, transforms or rules used to calculate lifecycle state, and whether the identity has been properly reprocessed after the source data changed.

Once an identity enters the configured lifecycle state, Identity Security Cloud can apply account actions defined under Settings for Previous Accounts , including disabling accounts across all sources or specified sources. SailPoint specifically uses Terminated and Archived states as examples where access removal and account disablement are commonly configured.

Consequently, validating the identity's actual lifecycle-state value is one of the first diagnostic checks that should be performed before investigating downstream connector or provisioning failures.

Study Guide Reference: Identity and Lifecycle Management — Lifecycle States, Terminated Identities, Lifecycle Attribute Calculation and Account Actions.

===============

The statement is valid. The Identity Security Cloud Active Directory connector supports substantial identity-lifecycle functionality, including account aggregation, creation, modification, entitlement management, password-related operations, and provisioning. SailPoint documents Active Directory account provisioning and the use of Identity Security Cloud provisioning policies to create and manage accounts on the directory.

Active Directory can also serve as an authentication source through Pass-Through Authentication (PTA) . With PTA configured for an identity profile, users can authenticate to Identity Security Cloud using the network password associated with their Active Directory account. Identity Security Cloud passes the authentication operation through to the configured directory source rather than requiring a separate local SailPoint password.

Therefore, the AD integration is not restricted to account aggregation or read-only identity data. It can participate in both authentication and lifecycle administration, including provisioning users and managing access. Appropriate service-account permissions, VA connectivity, and provisioning configuration are required.

Study Guide Reference: Sources — Active Directory Connector, Pass-Through Authentication, Account Aggregation and Provisioning.

===============

The statement accurately describes the function of an Identity Provider in a federated authentication architecture. An IdP authenticates users and provides trusted identity or authentication information to a Service Provider. This enables the Service Provider to rely on an established trust relationship instead of independently validating the user's primary credentials.

In a SAML-based implementation, the Identity Provider authenticates the user and generates a signed SAML assertion. The assertion contains information that allows the Service Provider to determine that the user's authentication has been successfully completed. Depending on configuration, additional identity attributes can also be included.

Identity Security Cloud can operate as a SAML Service Provider and rely on an organization's external Identity Provider for user authentication. This allows enterprises to centralize authentication and integrate SailPoint access with existing single sign-on infrastructure.

The critical concepts are trust, centralized authentication, and secure transfer of authentication assertions between the IdP and Service Provider. The proposed statement correctly identifies each of these fundamental IdP responsibilities.

Study Guide Reference: Access Management — Federated Identity, Identity Providers, SAML Authentication, Service Provider Integration.

===============