Free Practice Questions for SailPoint Identity-Security-Administrator Exam

Answer : A

The statement is correct. Identity Security Cloud allows administrators to configure a requestable role so that reviewers must provide justification when denying the requested access.

When configuring a role for access requests, administrators can enable the role for requests, define its approval process, and configure Require Comments behavior. SailPoint specifically provides an option named When a reviewer denies the request. Enabling this setting requires the reviewer to enter a comment or reason when rejecting the role request.

This requirement strengthens governance and auditability. A denial without explanation provides limited evidence about why the access was considered inappropriate. Requiring a comment records the business or security reasoning behind the decision, which can later assist administrators, access owners, auditors, and compliance personnel in understanding the approval history.

Comment requirements can also be configured at other stages, including when the requester submits the access request. Similar denial-comment controls exist for directly requestable entitlements.

Therefore, requiring a reviewer to document the reason for rejection is a supported role-request configuration.

Study Guide Reference: Access Management --- Requestable Roles, Approval Processes, Require Comments and Access Request Governance.

Answer : A

Yes, when the user's application access is governed through attribute-driven role assignment, a department change can trigger deprovisioning of access that is no longer appropriate. Identity Security Cloud roles can use mapped identity attributes such as Department as membership criteria. During identity processing, SailPoint evaluates whether the identity continues to satisfy those criteria.

If the user moves to another department and consequently ceases to satisfy the role's assignment criteria, the identity is removed from the role. SailPoint explicitly documents that when identities are removed from roles because of assignment-criteria changes, access assigned by those roles is removed or deprovisioned, unless the same access is independently provided through another role or assignment.

This implements birthright and role-based lifecycle governance: business changes such as department transfers should automatically cause obsolete access to be removed while new access appropriate to the destination department can be provisioned. SailPoint even provides a workflow template specifically addressing identity department changes and reassessment of old versus new access.

Thus, a department change is a valid deprovisioning trigger when the former application's access derives from criteria that the identity no longer satisfies.

Study Guide Reference: Provisioning --- Automated Role Assignment, Attribute Changes, Role Deprovisioning and Department-Based Access Lifecycle.

Answer : B

The statement is explicitly incorrect. Identity Security Cloud allows users to hold multiple User Levels in many circumstances, and permissions from compatible User Levels are cumulative. However, SailPoint defines several combinations that cannot be assigned simultaneously because their delegated administrative scopes conflict.

One of the specifically prohibited combinations is Role Admin and Source Sub-Admin. SailPoint's User Level documentation lists this pair among the User Levels that cannot coexist on the same user. Other prohibited combinations include Role Sub-Admin with Source Admin, Role Sub-Admin with Role Admin, and Source Sub-Admin with Source Admin.

The distinction is important. A Role Admin has broad role-management privileges, whereas a Source Sub-Admin receives scoped administrative capabilities based on Governance Group associations with particular sources. Combining certain global and scoped administrative models could create inconsistent authorization behavior, so SailPoint prevents those assignments.

Administrators should therefore consult the User Level compatibility matrix before granting multiple elevated permissions rather than assuming that every User Level can be stacked.

Study Guide Reference: Platform --- User Level Permissions, User Level Compatibility, Role Admin and Source Sub-Admin.

===============

Answer : A

The statement is correct. Identity Security Cloud defines several identity attributes by default, but User Name (uid), Work Email (email), and Last Name (lastname) have special required-status rules. SailPoint documentation states that these three attributes must have mappings for every identity profile and cannot be null for any identity.

User Name has an additional uniqueness requirement: it must be unique across identities from all identity profiles in the tenant. Work Email must contain a non-null value, although Identity Security Cloud does not itself validate that the value conforms to a syntactically valid email-address format. Last Name likewise must be populated.

Administrators therefore need to ensure that the authoritative-source data, source mappings, transforms, or rules reliably generate these required values. If authoritative data cannot directly populate a required field, a transform or other supported mapping mechanism should be used to derive the necessary value.

These requirements help maintain consistent identity representation and support core platform functions such as identity correlation, display, authentication, and governance.

Study Guide Reference: Identity and Lifecycle Management --- Identity Profile Attributes, Required Attribute Mappings, User Name, Last Name and Work Email.

Answer : B

The statement is incorrect because Identity Security Cloud Search and reporting are not restricted to identity records. Search supports multiple governance data categories, and scheduled saved-search subscriptions can return records from the results tab associated with the saved search.

Searchable information includes identities as well as other important governance objects and operational records, including entitlements, access profiles, roles, events, and account activity. Audit reporting itself is implemented through Search, demonstrating that reporting extends well beyond identity queries. For example, administrators can investigate authentication events, provisioning activity, source-related events, access-request activity, and other audit information.

When a saved search is subscribed to, Identity Security Cloud generates recurring results based on the tab selected when the search was saved. Therefore, restricting scheduled reporting conceptually to identity-only searches would remove substantial audit and governance functionality that the platform expressly supports. SailPoint's documentation describes both the multiple Search data models and the ability of scheduled searches to return results from the selected results tab.

Study Guide Reference: Platform --- Search Data Models, Saved Searches, Reporting and Scheduled Search Subscriptions.