Identity-Security-Administrator Exam Dumps - SailPoint Professional Questions and Answers

Yes. Removing the @entitlements(name:Manager_Access) portion produces a valid identity-oriented query structure. Identity Search supports the @access(...) nested object because an identity can possess multiple access items. SailPoint specifically documents @access(displayName:...) for identifying identities that possess a named access item and @access(source.name:...) for locating identities whose access originates from a particular source. Nested access queries can be combined with ordinary identity fields by using Boolean operators.

The remaining query therefore applies three conditions correctly: the identity must have been created during the specified 24-hour range, and the identity must satisfy either the New_Hire_Access condition or the Acme_HRMS source-access condition.

The problem with the original expression is the @entitlements(...) nested object. In SailPoint's searchable data models, @entitlements is used when examining objects such as access profiles or roles that contain entitlements; it is not the appropriate nested object for identity-level access searches. Identity-level entitlement holdings are searched through @access(...).

Study Guide Reference: Platform — Search, Nested Queries, Identity Access Fields and Boolean Query Construction.

===============

Gather data from requestor to build search query.

Run the query to gather results.

Save and name the search query.

Schedule saved search query on a month cadence as requested.

The sequence follows the correct Identity Security Cloud Search workflow. First, the administrator must gather the audit requirements from the requestor, including which distribution list, identities, access attributes, or other conditions must be evaluated. Those requirements are then translated into an appropriate Search query. Second, the query must be executed so the administrator can confirm that it returns the intended records before automating it.

After validating the output, the administrator saves and names the query. Identity Security Cloud requires the query to exist as a saved search before a recurring subscription can be configured. Finally, the saved search is scheduled according to the requested monthly cadence. SailPoint supports subscriptions to saved searches with Daily, Weekly, and Monthly schedules and allows administrators to specify the numerical days of the month and execution times. Therefore, scheduling must occur after the query has been constructed, tested, and saved.

Study Guide Reference: Platform — Search, Building Search Queries, Saved Searches, Search Subscriptions and Scheduled Reporting.

The statement accurately describes the cryptographic trust model underlying SAML federation. In a typical SAML configuration, the Identity Provider (IdP) authenticates the user and issues a SAML assertion. The Service Provider (SP) validates the assertion, particularly its digital signature, by using certificate/public-key information associated with the trusted IdP. Private keys remain protected by their owners; the corresponding certificates containing public keys can be exchanged through configuration or SAML metadata.

For Identity Security Cloud operating as a SAML Service Provider, SailPoint requires administrators to obtain the IdP's signing certificate and configure it in Identity Security Cloud. SailPoint also provides Service Provider metadata that can be supplied to the IdP. This establishes the federation relationship and allows the participating systems to validate SAML messages according to the configured trust model. The critical concept is that passwords are not shared between the IdP and SP. Authentication assertions are trusted because they originate from an established federation partner and can be cryptographically validated.

Study Guide Reference: Access Management — Authentication Methods, SAML Federation, Identity Provider and Service Provider Trust.

===============

Yes. This is an appropriate scenario for applying Separation of Duties (SoD). The fundamental purpose of SoD is to prevent a single identity from accumulating combinations of privileges that provide excessive control over a sensitive business or technical process. Assigning one person responsibility for user administration, application administration, and data backup management creates significant concentration of privilege. Such a person could potentially create or modify accounts, change application configuration or permissions, and manipulate or restore protected data without independent oversight.

Identity Security Cloud supports SoD policies by defining two sets of conflicting access. A violation occurs when an identity possesses qualifying access from both sides of the policy. Administrators can then investigate, remediate, or formally manage exceptions. SailPoint describes SoD as an internal control intended to reduce risk by preventing identities from possessing inappropriate combinations of access.

Therefore, separating these powerful administrative capabilities among different responsible individuals is consistent with least privilege and defense-in-depth governance.

Study Guide Reference: Supporting Governance — Separation of Duties, Conflicting Access, SoD Policies and Privileged Access Governance.

===============

The statement is not valid in the normal Identity Security Cloud identity model. An authoritative source is specifically used to establish identities. When a source is associated with an identity profile and thereby designated as authoritative, Identity Security Cloud creates an identity from each qualifying authoritative account. The authoritative account therefore forms the identity's authoritative foundation rather than behaving as an ordinary account that must subsequently be correlated to an existing identity.

Uncorrelated accounts normally arise from non-authoritative or secondary sources when Identity Security Cloud cannot match an aggregated account to an existing authoritative identity by using configured correlation criteria. SailPoint defines an uncorrelated account as an account that has not been linked to an authoritative identity. Such accounts must be resolved before their associated access can be properly governed.

Although unusual administrative edge cases can affect existing authoritative-account associations, this does not change the fundamental certification concept: authoritative accounts establish identities, while correlation attaches accounts from other sources to those identities.

Study Guide Reference: Identity and Lifecycle Management — Authoritative Sources, Identity Profiles, Account Correlation and Uncorrelated Accounts.

===============

This approach is valid because Identity Security Cloud supports search-driven certification campaigns focused specifically on access items. An administrator can select Access Items , choose All Access Items Returned by a Query , and use Search to identify privileged entitlements, access profiles, or roles. The privileged:true field is supported for access-item data and identifies access designated as privileged. Identities possessing the selected access items are then included in the campaign.

The reviewer configuration also meets the requirement. For appropriate search-based certification types, Manager can be selected as the reviewer. Identity Security Cloud then assigns each identity's access review to that identity's manager. Therefore, managers review the privileged access belonging to their own subordinates rather than having a single central certifier review the entire population. If an identity has no manager, SailPoint provides fallback handling by assigning the certification to the campaign creator.

This combines privileged-access filtering with manager-based governance and directly satisfies the scenario.

Study Guide Reference: Supporting Governance — Search-Based Certification Campaigns, Access Item Certifications, Privileged Access and Manager Reviews.

===============

This is a valid network-isolation troubleshooting step. Virtual Appliances depend on continuous outbound network connectivity to Identity Security Cloud. A VPN, firewall, proxy, routing policy, or network-security device positioned in the communication path can prevent the VA from reaching required SailPoint endpoints even when the VA itself is otherwise healthy.

Testing connectivity with and without the VPN helps determine whether the VPN path, its routing tables, security policies, DNS handling, or tunnel configuration is responsible for the failure. SailPoint requires VA outbound connectivity, including HTTPS communication over TCP port 443, and documents network connectivity as a primary dependency for proper VA operation. Network connectivity errors should therefore be investigated by validating the path between the appliance and required endpoints.

This does not mean permanently bypassing required enterprise security controls. The objective is diagnostic isolation: establish whether connectivity succeeds when the suspected network component is removed from the path, then correct the underlying VPN or routing configuration.

Study Guide Reference: Virtual Appliances — VA Network Troubleshooting, Outbound Connectivity, VPN and Firewall Configuration.

===============

1. Section of the UI that allows users to ask for access.

Select a match:

Answer: Request Center

2. Provide an interface to read user account data and provision changes from Identity Security Cloud to target systems and applications.

Select a match:

Answer: Direct Connection

3. A ticket is created in ServiceNow and assigned to the operations team that manages the source application.

Select a match:

Answer: Service Desk Integration

4. A task is created and assigned to a source owner to provision the users' access being requested.

Select a match:

Answer: Manual work Item

Request Center is the end-user interface through which users browse and request configured roles, access profiles, and entitlements. Direct Connection represents the connection model through which Identity Security Cloud communicates with a managed source and, when provisioning is supported and enabled, performs changes directly rather than requiring manual intervention. SailPoint distinguishes directly connected sources from flat-file/manual provisioning sources.

Service Desk Integration is appropriate when fulfillment is delegated to an external service-management platform such as ServiceNow. The resulting ticket is routed to the operational team responsible for implementing the requested change. Manual work Item applies when Identity Security Cloud cannot automatically provision the requested change; instead, a provisioning task is assigned to the responsible source or entitlement owner for completion outside the automated connector path. SailPoint explicitly documents manual provisioning tasks for sources that cannot be automatically written to.

Study Guide Reference: Provisioning — Provisioning Methods, Direct Connections, Manual Provisioning, Service Desk Integration and Request Center.

Yes, when the user's application access is governed through attribute-driven role assignment, a department change can trigger deprovisioning of access that is no longer appropriate. Identity Security Cloud roles can use mapped identity attributes such as Department as membership criteria. During identity processing, SailPoint evaluates whether the identity continues to satisfy those criteria.

If the user moves to another department and consequently ceases to satisfy the role's assignment criteria, the identity is removed from the role. SailPoint explicitly documents that when identities are removed from roles because of assignment-criteria changes, access assigned by those roles is removed or deprovisioned , unless the same access is independently provided through another role or assignment.

This implements birthright and role-based lifecycle governance: business changes such as department transfers should automatically cause obsolete access to be removed while new access appropriate to the destination department can be provisioned. SailPoint even provides a workflow template specifically addressing identity department changes and reassessment of old versus new access.

Thus, a department change is a valid deprovisioning trigger when the former application's access derives from criteria that the identity no longer satisfies.

Study Guide Reference: Provisioning — Automated Role Assignment, Attribute Changes, Role Deprovisioning and Department-Based Access Lifecycle.