Identity-Security-Administrator SailPoint Certified Identity Security Administrator Free Practice Exam Questions (2026 Updated)

This is a valid troubleshooting action. Identity Security Cloud depends on the source's entitlement schema to understand what entitlement objects and attributes should be collected. If the schema or entitlement-type configuration is incorrect, a newly created entitlement might not be recognized correctly during aggregation.

In the current Identity Security Cloud interface, this functionality is represented under Entitlement Management > Entitlement Types and Schemas . Each entitlement type has a schema that defines attributes such as its identifier, name, display name, description, and other source-specific properties. The account schema also identifies which account attributes represent entitlements. Consequently, schema configuration directly affects how source entitlement information is interpreted and linked to accounts.

Administrators should therefore confirm that the expected entitlement type exists, verify that its entitlement ID and entitlement-name attributes are mapped correctly, and then perform an entitlement aggregation. SailPoint specifically recommends examining and correcting entitlement schema mappings when entitlement information is not being aggregated correctly.

Study Guide Reference: Sources — Entitlement Types and Schemas, Entitlement Aggregation, Source Entitlement Configuration.

===============

No. The statement is too restrictive and misunderstands SailPoint's Search data models. The nested object @entitlements(...) is available in contexts where the searched object can contain multiple entitlements. Access profiles are one such category, but they are not the only applicable category. SailPoint's searchable-field documentation also defines entitlement nested fields for roles. Therefore, @entitlements(name:Manager_Access) cannot be characterized as inherently returning only access profiles associated with that entitlement.

The search category matters. Identity Search uses the @access(...) nested object to identify the access held by identities. For example, an identity holding a Manager_Access entitlement can be searched through an appropriate @access(...) expression. Conversely, when querying access-profile or role records, @entitlements(...) can filter those objects according to entitlements contained within them.

The original query is consequently invalid as a coherent identity query because it combines identity-oriented fields and @access(...) expressions with an entitlement-container nested construct belonging to different searchable object models.

Study Guide Reference: Platform — Searchable Fields, Nested Objects, Identity Search, Access Profiles and Role Search Models.

===============

The statement accurately describes the function of an Identity Provider in a federated authentication architecture. An IdP authenticates users and provides trusted identity or authentication information to a Service Provider. This enables the Service Provider to rely on an established trust relationship instead of independently validating the user's primary credentials.

In a SAML-based implementation, the Identity Provider authenticates the user and generates a signed SAML assertion. The assertion contains information that allows the Service Provider to determine that the user's authentication has been successfully completed. Depending on configuration, additional identity attributes can also be included.

Identity Security Cloud can operate as a SAML Service Provider and rely on an organization's external Identity Provider for user authentication. This allows enterprises to centralize authentication and integrate SailPoint access with existing single sign-on infrastructure.

The critical concepts are trust, centralized authentication, and secure transfer of authentication assertions between the IdP and Service Provider. The proposed statement correctly identifies each of these fundamental IdP responsibilities.

Study Guide Reference: Access Management — Federated Identity, Identity Providers, SAML Authentication, Service Provider Integration.

===============

The statement is incorrect because it confuses the responsibilities of an Identity Provider with those of a Service Provider. In a federated authentication architecture, the Identity Provider, commonly called the IdP, is responsible for authenticating the user and issuing trusted identity or authentication information.

The Service Provider is the system, application, or service that the user is attempting to access. It relies on the authentication assertion provided by the IdP and determines whether the authenticated user can access the requested resource.

For example, when Identity Security Cloud is configured to use SAML federation, an external IdP can authenticate the user. The IdP then sends a signed SAML assertion to Identity Security Cloud. Identity Security Cloud acts as the Service Provider and provides the application functionality after accepting the trusted authentication information.

Therefore, the component that offers the application or service is generally the Service Provider, not the Identity Provider. The IdP establishes identity and provides authentication assertions.

Study Guide Reference: Access Management — Federated Authentication, Identity Providers, Service Providers, SAML Authentication.

===============

Yes. Identity Security Cloud identity profiles support stronger verification for password-reset and account-unlock operations. When two-factor authentication is enabled for these functions, users must successfully complete two configured identity-verification methods before Identity Security Cloud permits the password reset operation. SailPoint explicitly documents this behavior under the identity profile's Password Reset and User Unlock settings.

Available verification methods can include a verification code or call to a configured phone number, a verification message delivered to an email address, security questions, Helpdesk-provided codes, or supported external MFA integrations. Administrators must ensure that the underlying identity attributes—such as phone numbers and email addresses—contain valid data when those methods are selected.

This password-reset authentication control should be distinguished from the Multifactor Authentication Sign-In Method , which uses an authenticator application to protect normal Identity Security Cloud sign-in. Both mechanisms strengthen authentication, but they protect different stages of account access.

Study Guide Reference: Access Management — Identity Profile Security Settings, Two-Factor Authentication, Password Reset and User Unlock Methods.

===============

This statement is correct and closely matches SailPoint's official definition of a source. Identity Security Cloud does not treat an external enterprise system itself as being physically contained within the tenant. Instead, it creates a source definition representing that application, database, directory, HR system, or other managed environment.

The source definition supplies the governance context through which Identity Security Cloud interacts with the underlying system. A connector gathers account and access information and associates that data with the source. Identity Security Cloud can then correlate source accounts to identities, aggregate entitlements, model access, perform certifications, support access requests, and—in the case of writable connectors—provision changes back to the external system.

SailPoint's current source-management documentation explicitly defines a source as the Identity Security Cloud representation of a third-party enterprise application, database, or directory-management system maintaining its own user accounts or personnel records.

This distinction between source and connector is important: the source is the governed system representation, while the connector provides the technical mechanism used to communicate with that system.

Study Guide Reference: Sources — Source Definitions, Connector Definitions, Source Accounts and Enterprise System Integration.

===============

The statement is valid in the Identity Security Cloud source model. A source represents an external enterprise system that maintains accounts or personnel records. Those source accounts are aggregated into Identity Security Cloud so they can be correlated with identities and governed.

SailPoint's official definition states that a source represents a third-party enterprise application, database, or directory-management system maintaining its own set of user accounts or personnel records. For example, an Active Directory source can contain directory user accounts, while a database source might expose database accounts and a SaaS source might contain application-specific user objects.

This distinction between an identity and a source account is fundamental. One Identity Security Cloud identity can be correlated to accounts across multiple sources. The identity represents the person or governed entity, whereas each source account represents that identity's presence in a particular external system.

During aggregation, Identity Security Cloud loads account attributes and associated access from the source, correlates those accounts to identities, and uses the resulting relationships for provisioning, access modeling, certifications, and governance.

Study Guide Reference: Sources — Sources and Connectors, Source Accounts, Account Aggregation and Identity Correlation.

===============

The statement is false. Removing an account record from Identity Security Cloud does not necessarily permanently prevent the account from being discovered again. The decisive factor is whether the account still exists on the underlying source system.

SailPoint explicitly documents that when an administrator selects Remove Account for an account in Identity Security Cloud, the account is removed from the tenant's current source data, but it will be re-aggregated during the next complete source aggregation unless it is also removed from the source itself .

The same architectural principle applies to aggregation-driven account state. Identity Security Cloud's source data is a governed representation of accounts that actually exist on connected systems. A future full aggregation can rediscover a source account and recreate its representation in the tenant if that source account continues to exist and is returned by the connector.

To permanently eliminate the account from subsequent aggregation, it must be appropriately deleted or otherwise excluded on the actual source, subject to the organization's provisioning and governance policy.

Study Guide Reference: Sources — Account Aggregation, Removing Accounts, Complete Aggregations and Source Account Lifecycle.