Identity-Security-Administrator Exam Dumps - SailPoint Certified Identity Security Administrator

This is a valid description of Separation of Duties (SoD) as an identity-governance control. SoD policies define combinations of access that should not be held by the same identity because combining those privileges could enable fraud, unauthorized transactions, or circumvention of internal controls. A detective implementation analyzes existing access and identifies identities that already violate a defined policy, allowing administrators to investigate, mitigate, revoke access, or document an approved exception.

Preventive policy evaluation applies the same governance principle before problematic access is granted. During an access-request or provisioning process, the proposed access can be evaluated against policy rules so that a potential conflict is identified before the access change is completed. SailPoint documents SoD policies as conflicting-access definitions and also documents preventive policy evaluation in its governance model. These controls provide measurable evidence that an organization is actively enforcing access-risk policies rather than merely documenting them.

Study Guide Reference: Supporting Governance — Separation of Duties, Policy Rules, Detective and Preventive Controls.

===============

The statement is incorrect. A Virtual Appliance is primarily a secure connectivity and connector-execution component that enables Identity Security Cloud to communicate with sources located inside an organization's private network or otherwise inaccessible directly from the SailPoint cloud environment.

During aggregation, the VA can communicate with the source and transmit relevant account, identity, group, and entitlement information to Identity Security Cloud. However, the Virtual Appliance is not intended to function as the persistent entitlement repository or search-indexing database.

Entitlement information used for access modeling, certifications, governance, search, roles, access profiles, and policy analysis is managed within the Identity Security Cloud platform. The VA facilitates source communication and executes connector-related operations such as aggregation and provisioning when required.

This architectural distinction is important because Virtual Appliances should not be treated as local databases containing governance data. Their primary responsibilities are secure connectivity, execution of integration workloads, and communication between SailPoint's cloud services and enterprise-managed systems.

Study Guide Reference: Virtual Appliances — VA Architecture, Source Connectivity, Aggregation and Provisioning Operations.

===============

Yes. Identity Security Cloud identity profiles support stronger verification for password-reset and account-unlock operations. When two-factor authentication is enabled for these functions, users must successfully complete two configured identity-verification methods before Identity Security Cloud permits the password reset operation. SailPoint explicitly documents this behavior under the identity profile's Password Reset and User Unlock settings.

Available verification methods can include a verification code or call to a configured phone number, a verification message delivered to an email address, security questions, Helpdesk-provided codes, or supported external MFA integrations. Administrators must ensure that the underlying identity attributes—such as phone numbers and email addresses—contain valid data when those methods are selected.

This password-reset authentication control should be distinguished from the Multifactor Authentication Sign-In Method , which uses an authenticator application to protect normal Identity Security Cloud sign-in. Both mechanisms strengthen authentication, but they protect different stages of account access.

Study Guide Reference: Access Management — Identity Profile Security Settings, Two-Factor Authentication, Password Reset and User Unlock Methods.

===============

Yes. Identity Security Cloud's Account Activity view is designed to provide administrators with a chronological operational view of provisioning actions. SailPoint documents that account activities are displayed by default in descending order of Last Modified date , which places the most recently updated provisioning activity first. This is useful during troubleshooting because current or recently failed operations are immediately visible.

The activity table exposes operational fields such as Status, Action, Requester, Recipient, Sources, Last Modified, and Stage. Administrators can use the tabular controls to reorganize the displayed information for analysis, including changing sort direction on sortable columns. This makes it possible to investigate provisioning operations from perspectives other than chronological order—for example, grouping similar requesters, recipients, sources, statuses, or actions.

Selecting an individual activity exposes additional request information, including provisioning errors and the progression of the request through its processing stages. This capability is important when determining whether an account create, modify, enable, disable, or entitlement operation completed successfully or stalled.

Study Guide Reference: Provisioning — Monitoring Provisioning, Account Activity, Last Modified Sorting and Provisioning Troubleshooting.

===============

Gather data from requestor to build search query.

Run the query to gather results.

Save and name the search query.

Schedule saved search query on a month cadence as requested.

The sequence follows the correct Identity Security Cloud Search workflow. First, the administrator must gather the audit requirements from the requestor, including which distribution list, identities, access attributes, or other conditions must be evaluated. Those requirements are then translated into an appropriate Search query. Second, the query must be executed so the administrator can confirm that it returns the intended records before automating it.

After validating the output, the administrator saves and names the query. Identity Security Cloud requires the query to exist as a saved search before a recurring subscription can be configured. Finally, the saved search is scheduled according to the requested monthly cadence. SailPoint supports subscriptions to saved searches with Daily, Weekly, and Monthly schedules and allows administrators to specify the numerical days of the month and execution times. Therefore, scheduling must occur after the query has been constructed, tested, and saved.

Study Guide Reference: Platform — Search, Building Search Queries, Saved Searches, Search Subscriptions and Scheduled Reporting.

This is a valid integration approach. Identity Security Cloud does not require every authoritative source to correspond to a purpose-built SaaS connector. For custom or legacy systems, generic integration mechanisms can expose the authoritative account or personnel information needed to construct identities.

A Delimited File source can load account information exported from a system into Identity Security Cloud. SailPoint describes the Delimited File connector as a general-purpose mechanism that reads account data from files and supports customizable account schemas. A database-backed custom HR application can instead be integrated through an appropriate JDBC/database connector when its personnel information is accessible through relational tables.

After creating the source, an Identity Profile can be associated with it to make that source authoritative. SailPoint states that when a source is configured as authoritative through an Identity Profile, an Identity Security Cloud identity is created for each applicable authoritative account.

The administrator must still design a reliable schema, uniquely identify contractors, configure required identity attributes, and determine suitable correlation and lifecycle mappings. Nevertheless, Delimited File and JDBC-style integrations are legitimate approaches for legacy authoritative data.

Study Guide Reference: Sources — Authoritative Sources, Generic Connectors, Delimited File Integration, JDBC Integration and Identity Profiles.

===============

The statement is correct. Identity Security Cloud normally uses optimized aggregation , which retrieves records from the source but can skip further processing for an account when the account already exists and no relevant data changes are detected. In that situation, account correlation and manager correlation do not need to be recalculated for unchanged accounts.

Disabling aggregation optimization causes an unoptimized aggregation . SailPoint explicitly states that this mode reprocesses every record regardless of whether the underlying account data has changed. It also reevaluates account-correlation and manager-correlation logic for those accounts.

This is particularly important after changing account-correlation configuration. If an account's attributes have not changed, an optimized aggregation might otherwise skip the account, leaving it uncorrelated despite the newly corrected correlation rules. SailPoint therefore recommends running an aggregation with optimization disabled when correlation logic has been modified on an already-aggregated source.

Unoptimized processing requires more resources and can take longer on large sources, so it should be used deliberately when full reevaluation is necessary rather than as the default aggregation mode.

Study Guide Reference: Sources — Account Aggregation, Optimized and Unoptimized Aggregations, Account Correlation.

===============

The statement is valid. The Identity Security Cloud Active Directory connector supports substantial identity-lifecycle functionality, including account aggregation, creation, modification, entitlement management, password-related operations, and provisioning. SailPoint documents Active Directory account provisioning and the use of Identity Security Cloud provisioning policies to create and manage accounts on the directory.

Active Directory can also serve as an authentication source through Pass-Through Authentication (PTA) . With PTA configured for an identity profile, users can authenticate to Identity Security Cloud using the network password associated with their Active Directory account. Identity Security Cloud passes the authentication operation through to the configured directory source rather than requiring a separate local SailPoint password.

Therefore, the AD integration is not restricted to account aggregation or read-only identity data. It can participate in both authentication and lifecycle administration, including provisioning users and managing access. Appropriate service-account permissions, VA connectivity, and provisioning configuration are required.

Study Guide Reference: Sources — Active Directory Connector, Pass-Through Authentication, Account Aggregation and Provisioning.

===============