Authentic SailPoint Certification Exam Identity-Security-Administrator Questions Answers

This is a valid network-isolation troubleshooting step. Virtual Appliances depend on continuous outbound network connectivity to Identity Security Cloud. A VPN, firewall, proxy, routing policy, or network-security device positioned in the communication path can prevent the VA from reaching required SailPoint endpoints even when the VA itself is otherwise healthy.

Testing connectivity with and without the VPN helps determine whether the VPN path, its routing tables, security policies, DNS handling, or tunnel configuration is responsible for the failure. SailPoint requires VA outbound connectivity, including HTTPS communication over TCP port 443, and documents network connectivity as a primary dependency for proper VA operation. Network connectivity errors should therefore be investigated by validating the path between the appliance and required endpoints.

This does not mean permanently bypassing required enterprise security controls. The objective is diagnostic isolation: establish whether connectivity succeeds when the suspected network component is removed from the path, then correct the underlying VPN or routing configuration.

Study Guide Reference: Virtual Appliances — VA Network Troubleshooting, Outbound Connectivity, VPN and Firewall Configuration.

===============

This approach is valid because Identity Security Cloud supports search-driven certification campaigns focused specifically on access items. An administrator can select Access Items , choose All Access Items Returned by a Query , and use Search to identify privileged entitlements, access profiles, or roles. The privileged:true field is supported for access-item data and identifies access designated as privileged. Identities possessing the selected access items are then included in the campaign.

The reviewer configuration also meets the requirement. For appropriate search-based certification types, Manager can be selected as the reviewer. Identity Security Cloud then assigns each identity's access review to that identity's manager. Therefore, managers review the privileged access belonging to their own subordinates rather than having a single central certifier review the entire population. If an identity has no manager, SailPoint provides fallback handling by assigning the certification to the campaign creator.

This combines privileged-access filtering with manager-based governance and directly satisfies the scenario.

Study Guide Reference: Supporting Governance — Search-Based Certification Campaigns, Access Item Certifications, Privileged Access and Manager Reviews.

===============

The statement is not valid in the normal Identity Security Cloud identity model. An authoritative source is specifically used to establish identities. When a source is associated with an identity profile and thereby designated as authoritative, Identity Security Cloud creates an identity from each qualifying authoritative account. The authoritative account therefore forms the identity's authoritative foundation rather than behaving as an ordinary account that must subsequently be correlated to an existing identity.

Uncorrelated accounts normally arise from non-authoritative or secondary sources when Identity Security Cloud cannot match an aggregated account to an existing authoritative identity by using configured correlation criteria. SailPoint defines an uncorrelated account as an account that has not been linked to an authoritative identity. Such accounts must be resolved before their associated access can be properly governed.

Although unusual administrative edge cases can affect existing authoritative-account associations, this does not change the fundamental certification concept: authoritative accounts establish identities, while correlation attaches accounts from other sources to those identities.

Study Guide Reference: Identity and Lifecycle Management — Authoritative Sources, Identity Profiles, Account Correlation and Uncorrelated Accounts.

===============