SailPoint Identity-Security-Administrator Practice Exam Questions & Answers

This is a valid network-isolation troubleshooting step. Virtual Appliances depend on continuous outbound network connectivity to Identity Security Cloud. A VPN, firewall, proxy, routing policy, or network-security device positioned in the communication path can prevent the VA from reaching required SailPoint endpoints even when the VA itself is otherwise healthy.

Testing connectivity with and without the VPN helps determine whether the VPN path, its routing tables, security policies, DNS handling, or tunnel configuration is responsible for the failure. SailPoint requires VA outbound connectivity, including HTTPS communication over TCP port 443, and documents network connectivity as a primary dependency for proper VA operation. Network connectivity errors should therefore be investigated by validating the path between the appliance and required endpoints.

This does not mean permanently bypassing required enterprise security controls. The objective is diagnostic isolation: establish whether connectivity succeeds when the suspected network component is removed from the path, then correct the underlying VPN or routing configuration.

Study Guide Reference: Virtual Appliances --- VA Network Troubleshooting, Outbound Connectivity, VPN and Firewall Configuration.

Yes. Checking these mapped attributes is a primary troubleshooting action for an Identity Exception. Identity Security Cloud defines User Name (uid), Work Email (email), and Last Name (lastname) as required identity attributes. Every identity profile must contain mappings for these attributes, and none of the resulting identity values can be null. User Name carries the additional requirement of being unique across identities in the tenant.

When an authoritative-source account is missing one or more required values during aggregation, Identity Security Cloud generates an Identity Exception instead of creating the identity normally. A duplicate User Name can also produce an exception. The administrator should therefore inspect the Identity Exceptions report, identify which required attribute is absent or invalid, and verify the corresponding source-account data and identity-profile mappings.

SailPoint's documented remediation is to correct the problematic source information and then aggregate the source again, either manually or through the next scheduled aggregation. If direct mapping cannot generate a required value, a transform or supported rule can derive it.

Study Guide Reference: Identity and Lifecycle Management --- Identity Profiles, Required Identity Attributes, Identity Exceptions and Attribute Mappings.

This is a valid method for enabling connector-level logging on the relevant VA managed cluster. The log entry shows that the acme AD-TX Cluster currently has logConfiguration: null, meaning no temporary connector logging configuration is active for that cluster. The Managed Clusters API supports a PUT request to /managed-clusters/{id}/log-config to establish or update logging configuration.

The proposed durationMinutes value of 365 is valid because SailPoint supports a logging duration from 5 through 1,440 minutes. DEBUG is also a supported Log4j level, and sailpoint.connector.ADLDAPConnector is the appropriate connector logging class for Active Directory/LDAP connector activity. Once enabled, the administrator can reproduce the problematic aggregation and obtain substantially more diagnostic information than would be available under normal logging.

Importantly, enhanced logging should generally be enabled only for the troubleshooting period because verbose connector logging increases log volume. SailPoint's current API explicitly supports this managed-cluster logging operation and temporary duration control.

Study Guide Reference: Virtual Appliances --- Connector Logging, Managed Cluster Log Configuration, Active Directory Troubleshooting.

The statement is not valid in the normal Identity Security Cloud identity model. An authoritative source is specifically used to establish identities. When a source is associated with an identity profile and thereby designated as authoritative, Identity Security Cloud creates an identity from each qualifying authoritative account. The authoritative account therefore forms the identity's authoritative foundation rather than behaving as an ordinary account that must subsequently be correlated to an existing identity.

Uncorrelated accounts normally arise from non-authoritative or secondary sources when Identity Security Cloud cannot match an aggregated account to an existing authoritative identity by using configured correlation criteria. SailPoint defines an uncorrelated account as an account that has not been linked to an authoritative identity. Such accounts must be resolved before their associated access can be properly governed.

Although unusual administrative edge cases can affect existing authoritative-account associations, this does not change the fundamental certification concept: authoritative accounts establish identities, while correlation attaches accounts from other sources to those identities.

Study Guide Reference: Identity and Lifecycle Management --- Authoritative Sources, Identity Profiles, Account Correlation and Uncorrelated Accounts.

No. The statement is too restrictive and misunderstands SailPoint's Search data models. The nested object @entitlements(...) is available in contexts where the searched object can contain multiple entitlements. Access profiles are one such category, but they are not the only applicable category. SailPoint's searchable-field documentation also defines entitlement nested fields for roles. Therefore, @entitlements(name:Manager_Access) cannot be characterized as inherently returning only access profiles associated with that entitlement.

The search category matters. Identity Search uses the @access(...) nested object to identify the access held by identities. For example, an identity holding a Manager_Access entitlement can be searched through an appropriate @access(...) expression. Conversely, when querying access-profile or role records, @entitlements(...) can filter those objects according to entitlements contained within them.

The original query is consequently invalid as a coherent identity query because it combines identity-oriented fields and @access(...) expressions with an entitlement-container nested construct belonging to different searchable object models.

Study Guide Reference: Platform --- Searchable Fields, Nested Objects, Identity Search, Access Profiles and Role Search Models.

The statement is not accurate as written. Configuration Hub restoration does use a draft, but an administrator cannot simply add arbitrary missing configuration objects to an existing draft through the normal draft-editing process.

The supported restoration workflow is to select the required backup, create a deployment draft, review the differences between the backup and the live tenant, optionally edit supported object details or remove objects that should not be deployed, and then deploy the draft. Configuration Hub automatically evaluates dependencies and identifies reference issues while preparing the draft.

Current SailPoint documentation specifically states that administrators can edit JSON definitions of existing draft objects or remove objects/object types. If an administrator removes an object from the draft and later discovers that this was a mistake, the supported action is to create a new draft from the backup and start again. There is no general 'add missing object' operation to repopulate an existing draft.

Therefore, reviewing the draft is correct, but the proposed mechanism of editing and adding missing objects makes the overall statement invalid.

Study Guide Reference: Platform --- Configuration Hub, Backups, Configuration Drafts and Restoring Tenant Configuration.

The statement is incorrect. Purchasing or using an IGA platform that maintains security certifications or demonstrates alignment with regulatory frameworks does not automatically make the customer organization compliant with those requirements.

Regulatory compliance depends on the organization's own controls, processes, system configurations, access-governance practices, data-handling procedures, evidence collection, risk-management activities, and remediation processes. Identity Security Cloud provides capabilities that can support compliance obligations, but organizations must configure and operate those controls appropriately.

For example, Separation of Duties policies can detect conflicting access combinations. Certification campaigns enable managers, application owners, and other reviewers to validate whether users should retain particular access. Audit data provides evidence of governance decisions, access changes, and administrative actions. These features can materially support compliance assessments and audits.

However, the organization's auditors still evaluate whether applicable legal, regulatory, and internal-control requirements have actually been implemented and continuously maintained. Vendor certifications are supporting evidence, not blanket proof of customer compliance.

Study Guide Reference: Supporting Governance --- Separation of Duties, Certifications, Audit Evidence, Governance and Regulatory Compliance.