Pass the SailPoint Professional Identity-Security-Administrator Questions and answers with Dumpstech

No. Current Identity Security Cloud behavior does not automatically assign sp:scopes:all when an administrator or user creates a Personal Access Token without explicitly selecting scopes. SailPoint documents that when no scopes are selected, the default scope is assigned. That default provides permission only for API endpoints that do not require authorization; it is not equivalent to unrestricted access under sp:scopes:all.

The sp:scopes:all scope must be intentionally selected when required. Even then, it does not grant arbitrary privileges beyond the token owner's authority. Instead, it authorizes API scopes that are available through the user levels assigned to the user who created the PAT. Consequently, PAT permissions remain bounded by that identity's effective Identity Security Cloud privileges.

This behavior supports the principle of least privilege. SailPoint recommends selecting only the scopes necessary for the application or integration using the token rather than broadly assigning sp:scopes:all.

Therefore, leaving all scope checkboxes unselected does not implicitly grant all available API scopes.

Study Guide Reference: Platform — Personal Access Tokens, OAuth/API Scopes, sp:scopes:all and Least-Privilege API Authentication.

===============

The statement is incorrect. A disabled role is not the appropriate state for validating actual automated role assignment through identity processing. Identity Security Cloud documents that disabling a role prevents future automated assignment and removes the role association from identities. Consequently, keeping the role disabled and performing identity processing does not provide a valid operational test of whether the configured membership criteria will assign the role as intended.

For an automatically assigned role, administrators define the assignment criteria, configure the required access, and enable the role. Identity Security Cloud then evaluates identities against the assignment criteria during identity processing. An administrator can manually initiate this evaluation by selecting Apply Changes from the Roles page. Identities satisfying the criteria receive the role and its configured access; identities that no longer satisfy the criteria can have the assignment removed.

Administrators should carefully validate role criteria before broad production application, but disabling the role specifically prevents it from functioning as an automated role assignment.

Study Guide Reference: Access Management — Role Management, Role Assignment Criteria, Enabling Roles and Identity Processing.

===============

The statement correctly describes the communication model used by SailPoint Virtual Appliances. The critical architectural principle is that communication between a customer-hosted VA and Identity Security Cloud is initiated outbound from the VA . SailPoint does not establish unsolicited inbound connections from its cloud environment directly into the customer's VA.

SailPoint specifically documents that each VA makes continuous outbound-only calls to the cloud environment and polls the cluster queue for requested actions , including aggregation and provisioning work. The appliance retrieves the work assigned to its cluster, executes the appropriate connector operation against the customer source, and communicates the resulting information back to Identity Security Cloud.

This polling model is significant from a network-security perspective because customers do not need to create inbound firewall rules allowing Identity Security Cloud to initiate sessions into their internal environment. Instead, the VA requires appropriate outbound connectivity to SailPoint's required endpoints.

Therefore, describing VAs as initiating communication to their cluster queue accurately reflects the supported VA architecture.

Study Guide Reference: Virtual Appliances — VA Cluster Architecture, Cluster Queue Polling, Outbound-Only Communication and Connector Operations.

===============

The statement is explicitly incorrect. Identity Security Cloud allows users to hold multiple User Levels in many circumstances, and permissions from compatible User Levels are cumulative. However, SailPoint defines several combinations that cannot be assigned simultaneously because their delegated administrative scopes conflict.

One of the specifically prohibited combinations is Role Admin and Source Sub-Admin . SailPoint's User Level documentation lists this pair among the User Levels that cannot coexist on the same user. Other prohibited combinations include Role Sub-Admin with Source Admin, Role Sub-Admin with Role Admin, and Source Sub-Admin with Source Admin.

The distinction is important. A Role Admin has broad role-management privileges, whereas a Source Sub-Admin receives scoped administrative capabilities based on Governance Group associations with particular sources. Combining certain global and scoped administrative models could create inconsistent authorization behavior, so SailPoint prevents those assignments.

Administrators should therefore consult the User Level compatibility matrix before granting multiple elevated permissions rather than assuming that every User Level can be stacked.

Study Guide Reference: Platform — User Level Permissions, User Level Compatibility, Role Admin and Source Sub-Admin.

===============

The statement does not accurately describe how governance-group approval and escalation operate. When a governance group is configured as an approver, the request is associated with the group's members, and a member of that governance group can perform the approval on behalf of the group. The system is not designed to send the request exclusively to the manager of one active group member.

Escalation behavior is also broader than the proposed statement suggests. SailPoint documents that when governance-group approvals are escalated to a manager level, the request can be escalated to each member's manager . If a particular member does not have a manager, that member's approval can remain assigned while other members' assignments are escalated. If none of the members has a manager, the applicable approvals can progress to the configured fallback approver.

Therefore, "only to the manager of an active member" incorrectly reduces a multi-member governance-group escalation process to one manager and does not reflect the documented routing behavior.

Study Guide Reference: Access Management — Governance Group Approvals, Escalation Chains, Access Request Reviewers.

===============

This is a valid network-isolation troubleshooting step. Virtual Appliances depend on continuous outbound network connectivity to Identity Security Cloud. A VPN, firewall, proxy, routing policy, or network-security device positioned in the communication path can prevent the VA from reaching required SailPoint endpoints even when the VA itself is otherwise healthy.

Testing connectivity with and without the VPN helps determine whether the VPN path, its routing tables, security policies, DNS handling, or tunnel configuration is responsible for the failure. SailPoint requires VA outbound connectivity, including HTTPS communication over TCP port 443, and documents network connectivity as a primary dependency for proper VA operation. Network connectivity errors should therefore be investigated by validating the path between the appliance and required endpoints.

This does not mean permanently bypassing required enterprise security controls. The objective is diagnostic isolation: establish whether connectivity succeeds when the suspected network component is removed from the path, then correct the underlying VPN or routing configuration.

Study Guide Reference: Virtual Appliances — VA Network Troubleshooting, Outbound Connectivity, VPN and Firewall Configuration.

===============

The statement is correct. Identity Profiles have a priority property that determines precedence when an identity is associated with accounts on more than one authoritative source. Lower numerical priority values represent higher precedence. This becomes important when several authoritative sources could potentially establish the same Identity Security Cloud identity.

SailPoint's Identity Profile REST API supports updating an existing Identity Profile through a PATCH operation. The Identity Profile data model contains the priority property, and it is not included among the properties that the Update Identity Profile endpoint prohibits from being modified. Consequently, an administrator can issue a JSON Patch operation against the /priority path to change that profile's precedence. SailPoint's published API documentation exposes both the priority field and the Identity Profile update operation.

Priority changes should be performed carefully because changing authoritative-source precedence can affect how identities are represented and which Identity Profile governs them when multiple authoritative accounts exist.

Therefore, using the REST API to modify Identity Profile priority is supported.

Study Guide Reference: Identity and Lifecycle Management — Identity Profile Priority, Authoritative Source Precedence and Identity Profile REST APIs.

===============

This is not a valid description of how a canceled access request is handled. A cancellation terminates the request before it completes. Once an access request has entered a concluded Canceled state, it is no longer simply a pending approval waiting for an administrator to substitute a decision for the assigned reviewer.

Approval Management does give administrators powerful controls over pending governance work. Administrators can inspect requests, reassign current approvers, send reminders, cancel requests, and, where supported, overwrite the current approval step. Overwriting an approver is fundamentally different from reversing an already canceled request: the administrator is acting on the current approval step of an active request.

SailPoint documentation explicitly identifies Canceled as a concluded status and defines cancellation as termination of the request. The administrator's overwrite capability applies to an approval step, not to resurrecting a request after cancellation. A new request would normally be required when access is still needed after the original request has been terminated.

Study Guide Reference: Access Management — Approval Management, Access Request Status, Administrative Approval Actions.

===============

This is a valid and specifically documented cause of missing entitlements during flat-file aggregation. When multiple rows represent different entitlements belonging to the same account, Identity Security Cloud expects the rows for that account to be grouped together according to the account identifier.

SailPoint's aggregation troubleshooting documentation explicitly addresses the condition in which only one or an incomplete set of entitlements is aggregated for accounts from a delimited file. The documented remediation is to ensure that the file is sorted by account ID . SailPoint's Generic Flat File prerequisites similarly state that all accounts and entitlements must be sorted by the account name so that all entitlement rows for an account appear together.

This requirement matters because the aggregation parser must correctly recognize consecutive records as belonging to the same logical account while assembling its multi-valued entitlement attributes. If the same account appears in separated regions of the file, the complete entitlement set may not be assembled as expected.

Therefore, sorting and grouping all rows for each account together is a fundamental preprocessing requirement when supplying multi-valued entitlement information through flat files.

Study Guide Reference: Sources — Flat File Aggregation, Delimited Files, Multi-Valued Entitlements and Aggregation Troubleshooting.

===============