SailPoint Identity-Security-Administrator Real Exam Dumps [September 2026 Update]

Virtual Appliances are the most distinctively SailPoint architectural topic on the Identity-Security-Administrator exam – and the one that administrators who have worked primarily in the SailPoint web interface rather than in its infrastructure layer most consistently miss. SailPoint Identity Security Cloud (ISC) is a SaaS platform: the application logic runs in SailPoint’s cloud. But most enterprise source systems – Active Directory, LDAP directories, on-premises HRMS, mainframe systems – are not directly accessible from the cloud. Virtual Appliances (VAs) are the bridge. A VA is a software appliance deployed inside the customer’s network that establishes outbound-only encrypted connections to ISC. The VA aggregates identity data from on-premises sources and pushes it to ISC; ISC sends provisioning commands back through the VA to on-premises systems. The administrator’s management of VAs – configuring VA clusters (pairs of VAs providing high availability for a source), setting VA priority (which VA in a cluster handles aggregations when both are healthy), monitoring VA health, and understanding what happens to source data when a VA cluster loses connectivity – determines whether identity data in ISC remains current and whether provisioning commands reach their targets. Administrators who know how to configure sources, create access profiles, and run certification campaigns in the ISC web interface may never have opened a VA console or reviewed VA logs. The exam tests VA management at the operational depth that real administrator responsibilities require.

The SailPoint Certified Identity Security Administrator (exam code: Identity-Security-Administrator) is SailPoint’s credential for cloud-based identity security administrators on the SailPoint Identity Security Cloud (ISC) platform. Announced February 17, 2026 as the seventh certification in SailPoint’s Identity University program. The exam covers platform management, virtual appliances, identity and lifecycle management, provisioning, access management, supporting governance, and sources. Candidates are expected to have at least 6 months of hands-on ISC administrator experience. Two exam attempts are included; candidates have 364 days from enrollment to schedule their attempts.

Cert Empire’s Identity-Security-Administrator exam questions cover all eight domain areas with particular depth on Virtual Appliance operational management and Identity Lifecycle State configuration – the two areas most frequently underinvested in by administrators who work primarily through the ISC interface.

Exam Snapshot

Eight Domain Areas

Domain 1: Platform Management

SailPoint Identity Security Cloud architecture: ISC is a multi-tenant SaaS platform where each customer organization has an isolated tenant. The exam tests how ISC tenants are structured: org-level settings apply across the entire tenant, while some settings (sources, access profiles, roles) are configured per-implementation. Administrators access ISC through the web-based admin console; end users access the request center and certification interface through separate URLs.

Tenant administration settings: Global settings that apply across the ISC tenant include: org-level password policies, session timeout settings, notification templates, UI customization (custom logos, color schemes), and API client management. The exam tests which settings are org-level (applying to all users and sources) versus which are configured per-source or per-application.

Admin API and scripting access: ISC provides a comprehensive REST API for automation and integration. Administrators can use the API to perform any operation available in the UI plus additional programmatic capabilities. The exam tests when the API is appropriate (bulk operations, automated workflows, integration with ITSM systems) and how API clients are created and authenticated (OAuth2 client credentials flow with client ID and secret).

Domain 2: Virtual Appliances

VA purpose and architecture: Virtual Appliances extend ISC connectivity to on-premises sources that are not directly accessible from SailPoint’s cloud. Each VA:

• Is deployed as a VM inside the customer’s network (supports VMware, Hyper-V, or Docker)
• Establishes outbound-only HTTPS connections to ISC (no inbound firewall rules required – VA initiates all connections)
• Handles source aggregation (reading identity data from sources and pushing it to ISC)
• Executes provisioning commands (creating, modifying, disabling accounts as directed by ISC)

VA clusters for high availability: Two VAs in the same cluster provide high availability. If one VA is unavailable, the other continues to service the source. The exam tests VA cluster configuration: how two VAs join the same cluster (they share a cluster ID configured during VA setup), how VA priority works within a cluster (the primary VA handles aggregations by default; the secondary takes over if the primary is unavailable), and what happens when both VAs in a cluster lose connectivity to ISC simultaneously (source data becomes stale – ISC cannot aggregate new data until connectivity is restored).

VA health monitoring: The ISC admin console shows VA health status. A healthy VA shows as “Connected”; an unreachable VA shows as “Warning” or “Disconnected.” The exam tests what administrators should do when a VA shows disconnected: check the VA’s network connectivity to ISC, verify that the VA service is running on the VM, and check VA logs for error messages indicating why the connection was lost.

VA logs and troubleshooting: VA logs are stored on the VA VM itself (not in ISC). The exam tests how to access VA logs (SSH to the VA VM, navigate to the log directory), what log entries indicate connection failures versus source connectivity failures (connection failure: VA cannot reach ISC; source connectivity failure: VA can reach ISC but cannot connect to the configured source system), and the difference between VA-to-ISC connectivity issues and VA-to-source connectivity issues from the administrator’s troubleshooting perspective.

VA versus cloud connector: Some sources can connect directly to ISC without a VA (cloud connectors for SaaS applications – Salesforce, Workday, ServiceNow, Azure AD). On-premises sources require a VA. The exam tests which source types require a VA and which can use a direct cloud connector.

Domain 3: Identity and Lifecycle Management

Identity attributes and identity profiles: In ISC, an identity is the aggregated representation of a person across all connected systems. Identity attributes are the fields that describe the identity (name, email, department, employee ID, manager). Identity Profiles define which source is authoritative for which attributes – when the same attribute exists in multiple sources, the identity profile defines which source’s value takes precedence.

Authoritative source: The authoritative source is the system of record for identity creation and deletion. Typically, the HRMS (Workday, SAP SuccessFactors, ADP) or AD is the authoritative source. When a new record appears in the authoritative source, ISC creates a new identity. When a record is removed from the authoritative source, ISC triggers the identity’s lifecycle progression toward deletion.

Identity correlation: Correlation rules define how ISC matches accounts in connected sources to known identities. The exam tests how correlation rules work: if an AD account’s email attribute matches a Workday identity’s email attribute, ISC creates the identity-to-account link. Without correct correlation, accounts appear as “uncorrelated” in ISC, meaning they are not associated with any identity.

Lifecycle States: Lifecycle States automate identity management based on identity status. Each lifecycle state (Active, Leave of Absence, Terminated, etc.) can be associated with automated actions: disabling accounts in certain systems, revoking specific access, triggering notifications. The exam tests lifecycle state configuration: which attributes trigger a state transition, what actions are associated with each state, and how ISC processes transitions when an identity’s attributes change (e.g., a Workday employee status field changes from “Active” to “Terminated”).

Domain 4: Provisioning

What provisioning does: Provisioning in ISC means creating, modifying, and deleting accounts in connected source systems in response to access requests and lifecycle events. When a user is approved for access to an application, ISC sends provisioning commands to the source to create or modify the account.

Provisioning policies: Provisioning policies define what attributes ISC sets when creating or modifying accounts. Field-level mapping determines which identity attribute populates which account attribute. The exam tests provisioning policy configuration: required attributes for account creation (what must be provided), optional attributes, and how ISC handles provisioning for sources that require specific attribute formats.

Manual provisioning: When ISC cannot automatically provision to a system (no machine-readable connector, manual onboarding process required), ISC can send a manual provisioning work item to a designated provisioning team. The exam tests when manual provisioning is appropriate and how the manual provisioning work item workflow operates.

Provisioning failure handling: When a provisioning command fails (the connector returns an error), ISC creates a retry queue and can alert administrators. The exam tests how provisioning failures appear in the ISC interface, how administrators investigate and retry failed provisioning attempts, and what causes common provisioning failures (attribute validation errors, source system unavailability, permission errors).

Domain 5: Access Management

Access Profiles and Roles:

Access Profiles define a package of access on a specific source – for example, an “AD Mailbox User” access profile grants specific AD group memberships that enable Exchange mailbox access. Access Profiles are the atomic unit of access in ISC.

Roles bundle multiple Access Profiles into a logical access package – for example, a “Finance Analyst” Role includes Access Profiles for the ERP system, the BI reporting tool, and the shared finance network drive. The exam tests the Role hierarchy: Roles can include other Roles (role nesting), but circular role assignments are not permitted.

Role Mining: Role Mining is ISC’s AI-driven capability that analyzes existing entitlement patterns across the identity population and suggests role definitions based on common entitlement combinations. The exam tests what Role Mining produces (candidate role definitions with membership criteria), how administrators evaluate and approve role suggestions, and what the “popularity” metric in Role Mining results indicates (how many identities share the same entitlement pattern).

Access Request workflow: Access requests are submitted by users through the request center or by managers on behalf of their team. Requests flow through configurable approval workflows. The exam tests approval configuration: who approves requests for specific Access Profiles or Roles (source owner, application owner, manager, or a designated approver group), how multi-level approval chains work, and what happens when an approver does not act within the configured SLA (escalation or automatic approval/rejection depending on configuration).

Domain 6: Supporting Governance

Certification campaigns: Certification campaigns are periodic access reviews where managers, application owners, or other designated reviewers confirm that their team members’ access is still appropriate. The exam tests certification campaign configuration: campaign type (manager certification, entitlement owner certification, source owner certification), how reviewers see and interact with certification items, what “certify” and “revoke” actions produce (revoke triggers a provisioning command to remove the access), and how bulk decisions work for reviewers with large numbers of items.

Separation of Duties (SoD) policies: SoD policies define combinations of access that an identity should not hold simultaneously (e.g., a user should not be able to both initiate and approve purchase orders). The exam tests SoD policy creation (defining the conflicting access pair), how SoD violations appear in ISC, and what options administrators have when a violation is detected (remediation request, exception grant with justification).

AI Recommendations and Identity Risk Score: ISC uses machine learning to analyze access patterns and provide recommendations. The Identity Risk Score indicates how risky an identity’s current access profile is compared to their peer group. The exam tests what factors contribute to the risk score and how risk scores appear in certification campaigns (high-risk items are highlighted for reviewer attention).

Domain 7: Sources

Source configuration: Sources are the connected systems that ISC aggregates identity data from and provisions accounts to. The exam tests source configuration: source type selection (which connector is used), connection parameters (server address, credentials, connector-specific settings), schema configuration (which attributes are aggregated), and account correlation (how accounts in this source are matched to ISC identities).

Aggregation types: Full aggregation reads all accounts from a source and updates ISC with the complete current state. Delta aggregation reads only changes since the last aggregation. The exam tests when each is appropriate (full aggregation for initial load and periodic reconciliation; delta aggregation for frequent updates where full aggregation would be too time-consuming) and what triggers delta aggregation (scheduled runs, event-based triggers).

Entitlement aggregation: Separate from account aggregation, entitlement aggregation reads the available entitlements from a source (AD groups, application roles, permissions) so ISC can display them for access request and certification purposes. The exam tests the entitlement aggregation schedule and what happens when new entitlements are created in a source between aggregation runs (they are not visible in ISC until the next entitlement aggregation completes).

5 Study Tips for SailPoint Identity-Security-Administrator

• Tip 1: Study Virtual Appliance operations at the infrastructure level – not just that VAs exist, but how clusters provide HA, how VA priority works, what happens when a VA goes offline, and how to access and interpret VA logs.
• Tip 2: Study Lifecycle States configuration deeply – which identity attributes trigger state transitions, what automated actions are associated with each state, and how the Terminated state triggers appropriate access removal.
• Tip 3: Study the difference between Access Profiles and Roles: Access Profiles are source-specific access packages; Roles bundle multiple Access Profiles. Know when each is used and how role nesting works.
• Tip 4: Study certification campaign types (manager, entitlement owner, source owner) and what each produces from the reviewer experience perspective.
• Tip 5: Practice with Cert Empire’s Identity-Security-Administrator exam questions with specific depth on VA cluster management, Lifecycle State automation, and certification campaign configuration.

Best Study Resources

• Cert Empire Identity-Security-Administrator exam questions PDF and practice simulator (2026 edition).
• SailPoint Identity University (university.sailpoint.com) – official training path and exam preparation materials.
• SailPoint Developer Portal (developer.sailpoint.com) – API documentation and technical references.
• SailPoint Community (community.sailpoint.com) – administrator discussion forums and knowledge base.
• OpenExamPrep.com SailPoint ISC Engineer free practice questions (covers overlapping ISC platform topics).

Career Opportunities After Identity-Security-Administrator

• SailPoint Identity Security Cloud Administrator
• Identity and Access Management (IAM) Administrator
• Identity Governance Analyst
• Cybersecurity Administrator (Identity Focus)
• SailPoint Partner Implementation Administrator

The SailPoint Certified Identity Security Administrator is the newest addition to SailPoint’s certification program (launched February 2026) and targets a growing segment: organizations that have deployed SailPoint ISC and need administrators who can manage it operationally – not just implement it once. IAM administrators with SailPoint credentials earn between USD 80,000 and USD 130,000 depending on organization size and responsibility scope.

Why Candidates Choose Cert Empire for Identity-Security-Administrator Preparation

✔ Virtual Appliance operational management questions. Our questions test VA cluster configuration, VA priority settings, VA health monitoring, and VA log interpretation at the administrator depth the real exam requires.

✔ Lifecycle State automation configuration questions. We test state transition triggers, automated actions per state, and Terminated state provisioning behavior.

✔ Certification campaign configuration scenario questions. Our questions test manager, entitlement owner, and source owner campaign types with reviewer experience scenarios.

✔ Source aggregation and correlation questions. We test full versus delta aggregation selection, entitlement aggregation timing, and identity correlation rule design.

✔ Backed by a full money-back guarantee. If our exam questions do not help you pass, we refund your purchase.

FAQ’s

What is the SailPoint Identity-Security-Administrator certification?

The SailPoint Certified Identity Security Administrator is SailPoint’s credential validating real-world administrator expertise in cloud-based identity security on the SailPoint Identity Security Cloud (ISC) platform. It was launched February 17, 2026, as part of SailPoint’s recertification program announcement.

What does a Virtual Appliance do in SailPoint ISC?

A Virtual Appliance (VA) bridges SailPoint ISC to on-premises source systems. It deploys inside the customer’s network, establishes outbound-only encrypted connections to ISC, and handles data aggregation from on-premises sources and provisioning commands to those systems. VAs are required for sources that are not directly accessible from the cloud.

How many exam attempts are included?

Two attempts are included with enrollment. Candidates have 364 days from enrollment to schedule and take both attempts.

What is the minimum experience required?

SailPoint recommends at least 6 months of hands-on ISC administrator experience before sitting for the exam.

How is the Identity-Security-Administrator different from the Identity Security Engineer exam?

The Administrator exam targets operational administrators who manage and maintain ISC deployments – platform management, VA operations, source administration, and governance campaigns. The Engineer exam targets technical engineers who configure and extend ISC – including architecture design, Rules and Transforms, connector extensibility, and API development.

Related Certifications Worth Exploring

Identity-Security-Administrator certified professionals expanding their SailPoint technical credential portfolio will find our SailPoint IdentityIQ-Engineer exam questions page covers advanced identity governance engineering skills including application onboarding, connector configuration, provisioning workflows, role management, policy enforcement, and troubleshooting that complement administrator-level identity security expertise. For those pursuing the IdentityIQ track alongside the ISC track, our SailPoint IdentityIQ-Associate exam questions page covers the on-premises IdentityIQ platform associate credential.