Identity-Security-Administrator SailPoint Certified Identity Security Administrator Free Practice Exam Questions (2026 Updated)

The statement is valid. The Identity Security Cloud Active Directory connector supports substantial identity-lifecycle functionality, including account aggregation, creation, modification, entitlement management, password-related operations, and provisioning. SailPoint documents Active Directory account provisioning and the use of Identity Security Cloud provisioning policies to create and manage accounts on the directory.

Active Directory can also serve as an authentication source through Pass-Through Authentication (PTA) . With PTA configured for an identity profile, users can authenticate to Identity Security Cloud using the network password associated with their Active Directory account. Identity Security Cloud passes the authentication operation through to the configured directory source rather than requiring a separate local SailPoint password.

Therefore, the AD integration is not restricted to account aggregation or read-only identity data. It can participate in both authentication and lifecycle administration, including provisioning users and managing access. Appropriate service-account permissions, VA connectivity, and provisioning configuration are required.

Study Guide Reference: Sources — Active Directory Connector, Pass-Through Authentication, Account Aggregation and Provisioning.

===============

This statement is incorrect. When a role uses Identity List as its assignment type, Identity Security Cloud expects administrators to explicitly search for and select individual identities that should receive the role. SailPoint's documented procedure is to select Identity List, search for a specific identity in Add Identities , add that identity, and repeat the process for additional identities. Identity List therefore functions as an explicit membership list rather than a pattern-based membership rule.

Wildcards such as * and ? are valid in Identity Security Cloud Search queries for supported text fields. For example, Search can use patterns to find records whose names match a particular character sequence. However, that Search capability must not be confused with role Identity List assignment criteria.

If dynamic membership is required, administrators should use Standard Criteria , where identity attributes, account attributes, or entitlements can be evaluated through supported comparison operators. Identity List is appropriate when named identities are deliberately selected.

Study Guide Reference: Access Management — Roles, Automated Role Assignment, Identity List, Standard Criteria and Search Wildcards.

===============

1. Section of the UI that allows users to ask for access.

Select a match:

Answer: Request Center

2. Provide an interface to read user account data and provision changes from Identity Security Cloud to target systems and applications.

Select a match:

Answer: Direct Connection

3. A ticket is created in ServiceNow and assigned to the operations team that manages the source application.

Select a match:

Answer: Service Desk Integration

4. A task is created and assigned to a source owner to provision the users' access being requested.

Select a match:

Answer: Manual work Item

Request Center is the end-user interface through which users browse and request configured roles, access profiles, and entitlements. Direct Connection represents the connection model through which Identity Security Cloud communicates with a managed source and, when provisioning is supported and enabled, performs changes directly rather than requiring manual intervention. SailPoint distinguishes directly connected sources from flat-file/manual provisioning sources.

Service Desk Integration is appropriate when fulfillment is delegated to an external service-management platform such as ServiceNow. The resulting ticket is routed to the operational team responsible for implementing the requested change. Manual work Item applies when Identity Security Cloud cannot automatically provision the requested change; instead, a provisioning task is assigned to the responsible source or entitlement owner for completion outside the automated connector path. SailPoint explicitly documents manual provisioning tasks for sources that cannot be automatically written to.

Study Guide Reference: Provisioning — Provisioning Methods, Direct Connections, Manual Provisioning, Service Desk Integration and Request Center.

The statement is incorrect. Identity Security Cloud prevents access-request self-approval by default. If the requester or access recipient belongs to a Governance Group that has been configured as an approval reviewer, SailPoint does not automatically approve the request merely because that person belongs to the group.

Instead, the requester or recipient is omitted from the Governance Group review. Other valid members of the group can review the request on behalf of the Governance Group. If the requester or recipient is the group's only member, the approval responsibility is reassigned to that person's manager. If no manager exists, Identity Security Cloud can ultimately route the approval to an administrator through its fallback behavior.

SailPoint does provide an optional automatic-approval configuration, but this is materially different. Auto-approval applies only when the configured reviewer is an individual identity and requires API configuration. SailPoint explicitly states that automatic approval does not apply when the configured reviewer is a Governance Group, even when the requester is its only member.

Study Guide Reference: Access Management — Access Request Approvals, Governance Groups, Preventing Self-Approval and Automatic Approval.

===============

The statement is not accurate as a description of the Delimited File Source itself. A Delimited File source reads account information from a supplied file, but the connector does not inherently operate as a continuously connected file-share reader that automatically discovers and aggregates files directly from a network share.

SailPoint documents two principal ways of loading data for the Delimited File source: use the Identity Security Cloud File Upload Utility to provide the file, or manually perform the applicable account aggregation process. SailPoint separately describes the File Upload Utility as a mechanism that can automatically upload files into Identity Security Cloud. That external utility is important because it distinguishes automated file delivery from the Delimited File connector independently connecting to and monitoring a file share.

After the file reaches Identity Security Cloud, the source can process its account and entitlement information according to its schema. Flat-file feeds can also be manually uploaded whenever changes need to be aggregated.

Therefore, automatic collection from a file share is not an intrinsic capability that should be attributed directly to the Delimited File Source.

Study Guide Reference: Sources — Delimited File Sources, File Upload Utility, Flat-File Aggregation and Data Import.

===============

The statement is incorrect. A source in Identity Security Cloud is not primarily a backup-storage repository. A source represents an enterprise system from which Identity Security Cloud obtains account, identity, and access information or to which it performs supported provisioning operations.

SailPoint defines a source as the Identity Security Cloud representation of a third-party enterprise application, database, or directory-management system that maintains its own accounts or personnel records. Connectors are used to interact with those systems so Identity Security Cloud can aggregate accounts and access rights and associate that information with identities.

Examples include Active Directory, HR applications, databases, SaaS platforms, and flat-file feeds. Depending on connector capabilities and configuration, a source can support account aggregation, entitlement aggregation, account creation and modification, enable/disable operations, password management, and entitlement provisioning.

Backup and disaster-recovery functions are separate concerns. Configuration Hub, for example, backs up supported Identity Security Cloud configuration objects , but that does not redefine enterprise sources as backup systems.

Study Guide Reference: Sources — Source Definitions, Connectors, Account and Entitlement Aggregation, Source Management.

===============

This is not the standard Identity Security Cloud method for configuring role assignment criteria. Role membership can be automatically determined using defined identity or account-based criteria, or administrators can explicitly specify identities through an Identity List depending on the role configuration.

The Identity List mechanism is designed to identify users who should receive the role rather than create a separate universal exclusion list containing identities who must never receive it. When automatic assignment criteria are configured, identities satisfying those criteria can become role members based on the associated identity attributes, account attributes, or other supported conditions.

If a particular identity must not receive a role, administrators should design the role-assignment criteria so that the identity does not satisfy the required conditions or use another appropriate assignment strategy. Introducing an unsupported exclusion mechanism could create incorrect expectations about how role membership is calculated.

Roles are intended to package business-relevant access and automatically assign that access to identities meeting defined organizational criteria.

Study Guide Reference: Access Management — Roles, Role Assignment Criteria, Standard Criteria, Identity Lists.

===============

The statement is explicitly incorrect. Identity Security Cloud allows users to hold multiple User Levels in many circumstances, and permissions from compatible User Levels are cumulative. However, SailPoint defines several combinations that cannot be assigned simultaneously because their delegated administrative scopes conflict.

One of the specifically prohibited combinations is Role Admin and Source Sub-Admin . SailPoint's User Level documentation lists this pair among the User Levels that cannot coexist on the same user. Other prohibited combinations include Role Sub-Admin with Source Admin, Role Sub-Admin with Role Admin, and Source Sub-Admin with Source Admin.

The distinction is important. A Role Admin has broad role-management privileges, whereas a Source Sub-Admin receives scoped administrative capabilities based on Governance Group associations with particular sources. Combining certain global and scoped administrative models could create inconsistent authorization behavior, so SailPoint prevents those assignments.

Administrators should therefore consult the User Level compatibility matrix before granting multiple elevated permissions rather than assuming that every User Level can be stacked.

Study Guide Reference: Platform — User Level Permissions, User Level Compatibility, Role Admin and Source Sub-Admin.

===============

This is not a valid explanation for why a requestable entitlement is missing. An entitlement being included in an access profile does not inherently mean that the entitlement becomes hidden from the Request Center. Identity Security Cloud supports direct entitlement requests as well as requests for access profiles that bundle multiple entitlements.

SailPoint explicitly states that entitlements can be configured for direct access requests and can also be grouped into access profiles. Likewise, access profiles can independently be configured as requestable objects. Therefore, membership in an access profile is not itself the troubleshooting condition that determines whether the underlying entitlement is requestable.

The more relevant checks are whether entitlement requests are globally enabled, whether the newly aggregated group actually exists as an entitlement in Identity Security Cloud, and whether its Requestable status is enabled. SailPoint's entitlement-request configuration explicitly requires both global enablement and entitlement-level requestability.

Consequently, assuming that the group has disappeared simply because an access profile contains it is technically incorrect.

Study Guide Reference: Access Management — Entitlements, Access Profiles, Direct Entitlement Requests and Request Center Configuration.

===============

Yes. Identity Security Cloud's Account Activity view is designed to provide administrators with a chronological operational view of provisioning actions. SailPoint documents that account activities are displayed by default in descending order of Last Modified date , which places the most recently updated provisioning activity first. This is useful during troubleshooting because current or recently failed operations are immediately visible.

The activity table exposes operational fields such as Status, Action, Requester, Recipient, Sources, Last Modified, and Stage. Administrators can use the tabular controls to reorganize the displayed information for analysis, including changing sort direction on sortable columns. This makes it possible to investigate provisioning operations from perspectives other than chronological order—for example, grouping similar requesters, recipients, sources, statuses, or actions.

Selecting an individual activity exposes additional request information, including provisioning errors and the progression of the request through its processing stages. This capability is important when determining whether an account create, modify, enable, disable, or entitlement operation completed successfully or stalled.

Study Guide Reference: Provisioning — Monitoring Provisioning, Account Activity, Last Modified Sorting and Provisioning Troubleshooting.

===============

The statement is correct. Identity Security Cloud supports two documented methods for defining role assignment: Standard Criteria and Identity List . SailPoint explicitly presents these options under Define Assignment > Choose Criteria Type when configuring automated role assignment.

Standard Criteria is the dynamic, data-driven option. Administrators can construct criteria using supported identity attributes, account attributes, or entitlements. Operators such as Equals, Does Not Equal, Contains, Starts With, and Ends With can be used where applicable, and multiple conditions can be organized with AND/OR logic. During identity processing, qualifying identities are assigned the role automatically.

Identity List provides a direct membership approach. Administrators search for and explicitly select the identities that should receive the role. It is appropriate when membership cannot conveniently be expressed through business attributes or when a controlled list of named identities is required.

After assignment configuration is saved and the role is enabled, Identity Security Cloud evaluates the role during identity processing; administrators can also initiate processing using Apply Changes.

Study Guide Reference: Access Management — Role Assignment, Standard Criteria, Identity List and Automated Role Provisioning.

===============

The statement accurately reflects the Search-based reporting model represented by Identity Security Cloud. Search is not limited to interactive investigation. Administrators can create a useful search query, save it, and configure a recurring subscription so that Identity Security Cloud generates and distributes the results automatically on a defined schedule.

The important workflow is that the query must first be executed and stored as a saved search. A subscription can then be attached to that saved search, with configuration for scheduling, timezone, and recipients. The scheduled execution returns records from the results category or tab that was selected when the saved search was created.

This functionality effectively turns a valid, reusable Search query into a scheduled reporting mechanism. It is particularly useful for recurring governance monitoring, audit review, identity-analysis tasks, entitlement investigations, and event reporting. SailPoint documentation states that automatic scheduled emails can contain the results of a saved search query and that subscriptions can be configured on recurring schedules.

Study Guide Reference: Platform — Search, Saved Searches, Scheduled Search Reports and Subscriptions.

===============

This is an appropriate corrective action for a PKIX certification-path failure. When the Active Directory connector communicates with a domain controller using TLS, the Virtual Appliance must trust the certificate presented by that server. A PKIX path validation failed or unable to find valid certification path to requested target error indicates that Java cannot construct a trusted certificate chain from the server certificate to a trusted certification authority.

Consequently, verifying that the correct CA or server certificate is available to the VA is a fundamental troubleshooting step. SailPoint supports TLS between Virtual Appliances and compatible sources and documents certificate management on the VA for situations where trusted certificates need to be added manually. Current configuration also attempts to copy supported TLS certificates automatically to the VA cluster, but administrators must still validate certificate trust when TLS handshakes fail.

The certificate chain, expiration, hostname, and issuing CA should also be checked. Once the VA trusts the appropriate chain, the TLS handshake can complete successfully.

Study Guide Reference: Virtual Appliances — TLS Configuration, Certificate Trust, Active Directory Secure Connectivity and PKIX Troubleshooting.

===============

This approach directly violates the stated requirements. The scenario explicitly requires Finance users to receive an Office 365 E3 license and further states that no Finance employee or contractor should receive more than one type of Office 365 license. The proposed configuration assigns Finance contractors both the default Office 365 license through an access profile and the Office 365 E3 license separately.

Identity Security Cloud access profiles are bundles of entitlements that can be automatically provisioned through role assignment. If an access profile containing the default license is included in the role, that access will be granted when the contractor satisfies the role criteria. Adding E3 separately would therefore produce the duplicate-license condition the design is expressly intended to prevent.

The solution is additionally incomplete because it targets only Finance contractors while the requirement applies to every Finance department user , including employees. A better design is one Finance role whose assignment criteria encompass all Finance users and whose access contains only the required E3 license.

Study Guide Reference: Provisioning — Roles, Access Profiles, Automated Provisioning, Assignment Criteria and Least-Privilege Access Design.

===============

This is a valid description of Separation of Duties (SoD) as an identity-governance control. SoD policies define combinations of access that should not be held by the same identity because combining those privileges could enable fraud, unauthorized transactions, or circumvention of internal controls. A detective implementation analyzes existing access and identifies identities that already violate a defined policy, allowing administrators to investigate, mitigate, revoke access, or document an approved exception.

Preventive policy evaluation applies the same governance principle before problematic access is granted. During an access-request or provisioning process, the proposed access can be evaluated against policy rules so that a potential conflict is identified before the access change is completed. SailPoint documents SoD policies as conflicting-access definitions and also documents preventive policy evaluation in its governance model. These controls provide measurable evidence that an organization is actively enforcing access-risk policies rather than merely documenting them.

Study Guide Reference: Supporting Governance — Separation of Duties, Policy Rules, Detective and Preventive Controls.

===============

The statement accurately describes the cryptographic trust model underlying SAML federation. In a typical SAML configuration, the Identity Provider (IdP) authenticates the user and issues a SAML assertion. The Service Provider (SP) validates the assertion, particularly its digital signature, by using certificate/public-key information associated with the trusted IdP. Private keys remain protected by their owners; the corresponding certificates containing public keys can be exchanged through configuration or SAML metadata.

For Identity Security Cloud operating as a SAML Service Provider, SailPoint requires administrators to obtain the IdP's signing certificate and configure it in Identity Security Cloud. SailPoint also provides Service Provider metadata that can be supplied to the IdP. This establishes the federation relationship and allows the participating systems to validate SAML messages according to the configured trust model. The critical concept is that passwords are not shared between the IdP and SP. Authentication assertions are trusted because they originate from an established federation partner and can be cryptographically validated.

Study Guide Reference: Access Management — Authentication Methods, SAML Federation, Identity Provider and Service Provider Trust.

===============

This is a valid troubleshooting approach. An Active Directory provisioning failure such as "There is no such object on the server" indicates that the connector attempted an operation against an object or directory reference that Active Directory could not resolve. Potential causes include an account or group being deleted or moved, an outdated distinguished name, an invalid entitlement reference, replication timing, or a provisioning operation targeting an object that no longer exists.

Searching SailPoint's technical knowledge and community resources for the exact connector error is therefore useful because connector-specific errors often have previously documented causes, configuration considerations, and remediation patterns. This should complement—not replace—tenant-side investigation. An administrator should correlate the error with provisioning activity, source information, account state, and the target system. Identity Security Cloud provides Search and audit information for investigating provisioning activity, while SailPoint technical resources provide additional connector-specific context. Current SailPoint documentation explicitly identifies provisioning activity as auditable and searchable.

Study Guide Reference: Provisioning — Troubleshooting Provisioning Errors, Active Directory Connector Operations, SailPoint Support Resources.

===============

This can be a valid reason, depending on the manager-review campaign mechanism being used. In a search-based certification campaign where Manager is selected as the reviewer, Identity Security Cloud determines the reviewer from each identity's manager relationship. If an identity does not have a manager defined, SailPoint documents that the certification is reassigned to the creator of the campaign . If the campaign creator is an administrator, the certification therefore appears assigned to that administrator instead of a manager.

The absence of a manager can originate from authoritative HR data, an incomplete manager attribute mapping, failed manager correlation, or otherwise missing manager information on the identity.

A distinction is important: traditional Manager Campaigns require identities to have managers defined and identities without managers are normally excluded. SailPoint recommends using a Search-based campaign with Manager selected as reviewer when identities without managers must still be included.

Given the scenario explicitly states that the certification was reassigned to an admin, missing manager information is therefore a technically valid explanation for the observed fallback assignment.

Study Guide Reference: Supporting Governance — Certifications, Manager Review, Search-Based Campaigns and Identities Without Managers.

===============

Yes. Checking these mapped attributes is a primary troubleshooting action for an Identity Exception. Identity Security Cloud defines User Name (uid) , Work Email (email) , and Last Name (lastname) as required identity attributes. Every identity profile must contain mappings for these attributes, and none of the resulting identity values can be null. User Name carries the additional requirement of being unique across identities in the tenant.

When an authoritative-source account is missing one or more required values during aggregation, Identity Security Cloud generates an Identity Exception instead of creating the identity normally. A duplicate User Name can also produce an exception. The administrator should therefore inspect the Identity Exceptions report, identify which required attribute is absent or invalid, and verify the corresponding source-account data and identity-profile mappings.

SailPoint's documented remediation is to correct the problematic source information and then aggregate the source again, either manually or through the next scheduled aggregation. If direct mapping cannot generate a required value, a transform or supported rule can derive it.

Study Guide Reference: Identity and Lifecycle Management — Identity Profiles, Required Identity Attributes, Identity Exceptions and Attribute Mappings.

===============