Pass the SailPoint Professional Identity-Security-Administrator Questions and answers with Dumpstech

Resetting the source and re-aggregating users is not the appropriate initial remediation. Aggregation is primarily an inbound data collection process: it reads account information from the source into Identity Security Cloud. It does not, by itself, perform the outbound disable operation that should occur when an identity enters the Terminated lifecycle state.

The administrator should first verify that the affected identities actually entered the expected lifecycle state and that the Terminated lifecycle-state configuration specifies that the database source account is to be disabled. SailPoint allows a lifecycle state to enable, disable, or delete accounts on selected sources. The source must also support the required account-disable operation.

The administrator should then review provisioning/account activity for failures and validate that provisioning is enabled and operating correctly for the database connector. Re-aggregation could later be useful to confirm the source's actual account state, but resetting the entire source is unnecessarily disruptive and does not correct the root cause of a failed lifecycle provisioning operation.

Therefore, the proposed troubleshooting action does not directly address why the Terminated lifecycle event failed to disable the account.

Study Guide Reference: Provisioning — Lifecycle-State Provisioning, Account Disable Operations, Provisioning Troubleshooting and Source Aggregation.

===============

Gather data from requestor to build search query.

Run the query to gather results.

Save and name the search query.

Schedule saved search query on a month cadence as requested.

The sequence follows the correct Identity Security Cloud Search workflow. First, the administrator must gather the audit requirements from the requestor, including which distribution list, identities, access attributes, or other conditions must be evaluated. Those requirements are then translated into an appropriate Search query. Second, the query must be executed so the administrator can confirm that it returns the intended records before automating it.

After validating the output, the administrator saves and names the query. Identity Security Cloud requires the query to exist as a saved search before a recurring subscription can be configured. Finally, the saved search is scheduled according to the requested monthly cadence. SailPoint supports subscriptions to saved searches with Daily, Weekly, and Monthly schedules and allows administrators to specify the numerical days of the month and execution times. Therefore, scheduling must occur after the query has been constructed, tested, and saved.

Study Guide Reference: Platform — Search, Building Search Queries, Saved Searches, Search Subscriptions and Scheduled Reporting.

Yes. This is a classic Separation of Duties scenario. The individual requesting a significant system configuration change should not also possess the authority to independently approve that same change. Combining requester and approver responsibilities eliminates an important independent-control checkpoint and allows one person to initiate and authorize a potentially high-impact administrative operation.

SailPoint's official SoD guidance specifically uses major system configuration changes as an example: significant configuration changes should be approved by someone other than the person requesting the change. SoD policies are designed to identify and govern combinations of access that would enable such conflicting responsibilities.

From a governance perspective, the requester initiates the business or technical need, while an independent reviewer determines whether the requested change is appropriate, authorized, and sufficiently controlled. Separating these functions reduces fraud, accidental misconfiguration, privilege abuse, and unauthorized system modification. Where conflicting access already exists, Identity Security Cloud can identify the associated SoD violation for investigation and remediation.

Therefore, allowing the requester to approve their own major system change represents exactly the type of control conflict that SoD is intended to prevent.

Study Guide Reference: Supporting Governance — Separation of Duties, Requester/Approver Conflicts, Internal Controls and SoD Policy Enforcement.

===============

This is a valid use of Approval Management. A pending access request can become operationally blocked if the assigned reviewer—for example, the requester's manager—is unavailable. Administrators need a mechanism to prevent governance processes from stalling because of absence, organizational changes, or incorrect assignment.

Identity Security Cloud allows administrators to locate a pending access request and reassign its review responsibility to another suitable identity. The new reviewer becomes the current approver and can continue the approval process. Reassignment is recorded as part of the request's processing history, preserving accountability and auditability.

The same principle is also available to reviewers in appropriate circumstances: an assigned reviewer can reassign a request when another user is better suited to make the decision. For administrators, Approval Management provides centralized visibility and control over pending requests across the tenant. SailPoint explicitly documents that administrators can reassign requests and that reassignment is intended to maintain the timely flow of governance processes.

Study Guide Reference: Access Management — Approval Management, Reassigning Access Requests, Pending Approval Administration.

===============

The statement is correct. During an Identity Security Cloud certification, the reviewer evaluates each required access item and records the appropriate decision—for example, approving or revoking access. The certification cannot be properly completed while required review items remain undecided.

SailPoint's current user documentation states that after the reviewer has reviewed each item , the reviewer is taken to the sign-off page to complete the certification. The reviewer then selects Finish to submit the decisions and move the certification into the completed state. SailPoint's certification overview likewise describes the sequence as reviewing assigned access, approving or revoking items, and then signing off on those decisions.

Sign-off has governance significance beyond the user-interface transition. Revocation decisions that have not been signed off are not treated as finalized remediation instructions. SailPoint explicitly warns that unsigned revoke decisions are not applied and can be treated as undecided when a campaign is administratively completed.

Therefore, completion of the required decisions is the prerequisite that brings the reviewer to the certification sign-off stage.

Study Guide Reference: Supporting Governance — Access Certifications, Review Decisions, Certification Sign-Off and Campaign Completion.

===============

The statement is valid for identities whose role assignment is actively enforcing the role's access. Identity Security Cloud roles represent collections of access that can include entitlements and access profiles. When role access is expanded, the role's existing members are expected to receive the additional required access so their actual source access continues to satisfy the role definition.

Role configuration changes are not necessarily applied to every identity immediately at the moment the administrator saves the role. SailPoint states that access additions are handled by identity processing . Administrators can select Apply Changes on the Roles page to initiate processing across identities, or the change can be applied when relevant identity processing subsequently occurs. During that processing, the system recalculates the role-based access requirements and provisions new access to applicable source accounts.

This behavior is important to understand operationally: editing a role changes its access model, and Identity Security Cloud must then propagate those additions to identities holding the role.

Study Guide Reference: Access Management — Roles, Managing Role Access, Role Change Processing and Automated Provisioning.

===============

The statement is incorrect because Identity Security Cloud Search and reporting are not restricted to identity records. Search supports multiple governance data categories, and scheduled saved-search subscriptions can return records from the results tab associated with the saved search.

Searchable information includes identities as well as other important governance objects and operational records, including entitlements, access profiles, roles, events, and account activity. Audit reporting itself is implemented through Search, demonstrating that reporting extends well beyond identity queries. For example, administrators can investigate authentication events, provisioning activity, source-related events, access-request activity, and other audit information.

When a saved search is subscribed to, Identity Security Cloud generates recurring results based on the tab selected when the search was saved. Therefore, restricting scheduled reporting conceptually to identity-only searches would remove substantial audit and governance functionality that the platform expressly supports. SailPoint's documentation describes both the multiple Search data models and the ability of scheduled searches to return results from the selected results tab.

Study Guide Reference: Platform — Search Data Models, Saved Searches, Reporting and Scheduled Search Subscriptions.

The statement correctly describes Identity Security Cloud's default self-approval prevention behavior when the requester is assigned as an individual reviewer . SailPoint does not normally permit a person to approve their own access request. This applies whether the request is submitted directly for themselves or whether the affected access recipient otherwise appears as a reviewer in the approval sequence.

When the requester or recipient is assigned an approval directly as an individual, Identity Security Cloud automatically reassigns that review responsibility to the individual's manager . If a valid manager is unavailable, the system can continue through alternative fallback mechanisms, eventually reaching an administrator when necessary.

There is an important distinction for Governance Groups: if the requester belongs to a Governance Group configured as reviewer, the requester is normally omitted while other group members remain eligible to approve. Only when that user is effectively the group's sole valid reviewer does manager reassignment occur.

An optional API setting can permit auto-approval for individual reviewers, but the default behavior described by the scenario is manager reassignment.

Study Guide Reference: Access Management — Preventing Self-Approval, Approval Reassignment, Manager Review and Access Request Governance.

===============

Yes. This is an appropriate scenario for applying Separation of Duties (SoD). The fundamental purpose of SoD is to prevent a single identity from accumulating combinations of privileges that provide excessive control over a sensitive business or technical process. Assigning one person responsibility for user administration, application administration, and data backup management creates significant concentration of privilege. Such a person could potentially create or modify accounts, change application configuration or permissions, and manipulate or restore protected data without independent oversight.

Identity Security Cloud supports SoD policies by defining two sets of conflicting access. A violation occurs when an identity possesses qualifying access from both sides of the policy. Administrators can then investigate, remediate, or formally manage exceptions. SailPoint describes SoD as an internal control intended to reduce risk by preventing identities from possessing inappropriate combinations of access.

Therefore, separating these powerful administrative capabilities among different responsible individuals is consistent with least privilege and defense-in-depth governance.

Study Guide Reference: Supporting Governance — Separation of Duties, Conflicting Access, SoD Policies and Privileged Access Governance.

===============

This statement is correct and closely matches SailPoint's official definition of a source. Identity Security Cloud does not treat an external enterprise system itself as being physically contained within the tenant. Instead, it creates a source definition representing that application, database, directory, HR system, or other managed environment.

The source definition supplies the governance context through which Identity Security Cloud interacts with the underlying system. A connector gathers account and access information and associates that data with the source. Identity Security Cloud can then correlate source accounts to identities, aggregate entitlements, model access, perform certifications, support access requests, and—in the case of writable connectors—provision changes back to the external system.

SailPoint's current source-management documentation explicitly defines a source as the Identity Security Cloud representation of a third-party enterprise application, database, or directory-management system maintaining its own user accounts or personnel records.

This distinction between source and connector is important: the source is the governed system representation, while the connector provides the technical mechanism used to communicate with that system.

Study Guide Reference: Sources — Source Definitions, Connector Definitions, Source Accounts and Enterprise System Integration.

===============