Free IDENTITY-SECURITY-ADMINISTRATOR Practice Test Questions and Answers (2026)

In SailPoint Identity Security Cloud, entitlements are made requestable by explicitly setting their "Requestable" attribute to true, either individually or via bulk management. Entitlements are not hidden from the request catalog simply by being included within an Access Profile; including an entitlement in an Access Profile does not restrict or suppress its availability for standalone access requests. Furthermore, access profiles are managed under the Access Models section, rather than inside individual source configurations. To troubleshoot why newly aggregated groups cannot be requested, an administrator should verify whether the entitlements were marked as requestable after aggregation, ensure proper provisioning settings, and check if request catalog search indexes have updated properly.

A: This option is incorrect because belonging to an Access Profile does not hide an entitlement from the request catalog, making this an invalid troubleshooting step.

1. SailPoint Identity Security Cloud Documentation, "Managing Requestable Entitlements", Section: Access Requests Administration, 2024.

2. SailPoint Identity Security Cloud Product Guide, "Configuring Access Models and Entitlements", Doc ID: ISC-UG-2023-04.

In SailPoint Identity Security Cloud, Virtual Appliances (VAs) are designed using a client-initiated, outbound-only network architecture to ensure secure hybrid integration. VAs deployed on-premises do not accept inbound network traffic from the cloud tenant. Instead, the VA initiates outbound HTTPS connections over secure TLS channels to the VA cluster messaging queue hosted in the Identity Security Cloud tenant. Through this persistent outbound channel, the VA polls the tenant queue for queued operational tasks, executes connector operations against target systems, and transmits execution results back to the cloud. Thus, the statement accurately describes the core functional behavior and traffic flow of the Virtual Appliance within the identity architecture.

B: Incorrect because VAs actively initiate outbound communication to the cloud tenant cluster queue, making the statement technically true.

1. SailPoint Identity Security Cloud Integration Architecture, "Virtual Appliance (VA) Connectivity and Network Requirements", Section: Communication Flow.

2. SailPoint Virtual Appliance Deployment Guide, "Outbound Port Requirements and Messaging Queue Integration", Standard Version 2023.2.

In SailPoint Identity Security Cloud manager certification campaigns, access items are automatically routed to each identity's assigned manager based on the identity cube's manager attribute populated by HR source aggregations. If an identity lacks a manager attribute—because the HR source record has no manager assigned or mapped—the system cannot identify a designated manager reviewer. Under default certification engine rules, items for unmanaged identities fall back and are reassigned to the campaign fallback certifier or an administrator designated during campaign creation. Therefore, the absence of an assigned HR manager is a valid and expected operational reason for the campaign items being routed to an administrator.

B. No

Incorrect because missing HR manager attributes trigger campaign fallback logic, routing certification items directly to designated administrators or campaign owners for review.

1. SailPoint Identity Security Cloud Documentation: Creating Manager Certification Campaigns, Section: Fallback Certifier Assignment, 2023.

2. SailPoint Compass Knowledge Base: Managing Unassigned Certifications and Fallback Rules, Doc ID: ISC-CERT-FB-014, 2023.

An access request decision is an independent, immutable governance event within the identity lifecycle workflow. When an access request is denied—whether due to lack of business justification, policy violation, or reviewer decision—the workflow instance transitions to a closed state. A password reset or password change operation modifies authentication credentials in the identity provider or directory service, which is completely decoupled from request workflow engine states. Password changes do not alter approval decisions, override reviewer denials, or re-trigger workflow approvals. To obtain the denied access, the user or manager must submit a new access request containing the required business justification.

A. Password management operations are credential updates that have no mechanism or authority to alter access request approval workflow states.

1. SailPoint Product Documentation, "Access Request Lifecycle and Decision Tracking", Identity Security Cloud Documentation, Section: Denied Request Handling, 2023.

2. ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security controls", Control A.9.2: User Access Management.

Standard search query syntax used across identity security platforms relies on Lucene-based range query conventions to evaluate numeric, date, or alphabetical bounds. In this syntax structure, square brackets [min TO max] denote an inclusive range, meaning that both boundary values specified in the query are included in the search results. Conversely, curly braces {min TO max} represent an exclusive range, which excludes the upper and lower boundary values from the result set. Because the statement asserts that square brackets exclude boundary values, the statement is technically incorrect. Understanding this distinction is essential for identity administrators constructing accurate filter conditions during identity audits or access searches.

Option A: Option A is incorrect because square brackets denote an inclusive range query where boundaries are included; curly braces are used to exclude boundary values in query syntax.

SailPoint IdentitySecurity Cloud Documentation, "Search Syntax Reference - Range Queries", SailPoint Compass Reference Guide.

Apache Lucene Documentation, "Query Parser Syntax - Range Searches", Apache Software Foundation.

In identity governance solutions such as SailPoint Identity Security Cloud (ISC), an aggregation returning zero accounts is often caused by misconfigurations rather than actual account deletions. Common root causes include misconfigured search scopes, restrictive account filters, insufficient service account permissions on the target system, or transient network timeouts during execution. If an administrator assumes accounts are genuinely absent, ISC may trigger automated deprovisioning or account uncorrelation actions, leading to widespread loss of user access. Therefore, administrators must thoroughly inspect connector configurations, logs, search filters, and API/service account permissions before accepting an empty aggregation result as valid.

B: Incorrect. Assuming accounts are absent without troubleshooting aggregation logs and configurations risks accidental account de-provisioning and severe operational disruption.

- SailPoint Identity Security Cloud Documentation, "Managing Sources and Aggregations", Section: Troubleshooting Aggregations and Uncorrelated Accounts, 2024.

- SailPoint Identity Security Cloud Documentation, "Account Filters and Search Scope Configuration", Section: Best Practices for Aggregation, 2023.

A successful connector test connection verifies basic network reachability, valid authentication credentials, and operational connectivity to the target endpoint API or service interface. However, it does not validate or guarantee the operational correctness of the target system schema mapping, account aggregation filters, or correlation rules. Furthermore, test connection operations do not execute write-level provisioning workflows, such as account creation, entitlement modifications, attribute updates, or password resets. Target endpoints often enforce granular privilege controls where read access succeeds during testing, but insufficient provisioning permissions, missing schema attributes, or malformed correlation rules cause subsequent aggregation and provisioning operations to fail during execution.

A. Yes: Test connection only validates endpoint communication and credential validity; it does not test schema definitions, correlation rules, or write-based provisioning actions.

- SailPoint Identity Security Cloud / IdentityIQ Connector Architecture Guide, "Testing Connectivity vs. Provisioning Validation," Section 3.1, 2023.

- IEEE Transactions on Dependable and Secure Computing, "Verification and Testing of Identity Governance Provisioning Integrations," DOI: 10.1109/TDSC.2021.3051214.

Access request segments in identity governance frameworks are used to define scope, audience, and visibility rules for requestable items. Segment membership determines which users are eligible to view and request specific access items or roles within the self-service request portal. However, visibility or eligibility to request access does not equate to automatic provisioning or assignment. Granting access requires the completion of the defined request lifecycle, which typically involves submitting a formal request, undergoing necessary approval workflows, and completing target system provisioning. Automatic assignment is handled via birthright provisioning rules or dynamic role assignment policies, not request segment scope definitions.

A. Segment membership grants eligibility to request an item, not automatic entitlement or provisioning of the item itself.

1. SailPoint Product Documentation, "Managing Access Request Segments", Identity Security Cloud Documentation, Section: Request Visibility and Eligibility, 2024.

2. Saviynt Enterprise Identity Cloud Documentation, "Configuring Requestability and Access Scope", Admin Guide, Section: Access Request Catalog, 2023.

Separation of Duties (SoD) policies are designed to prevent fraud, administrative error, and conflicts of interest by identifying incompatible functions within an organization. A standard SoD policy matrix defines two or more mutually exclusive sets of entitlements or access privileges (often designated as Left Side and Right Side access lists). When an identity holds at least one permission from the first conflicting access list and at least one permission from the second conflicting access list simultaneously, a toxic combination exists. Governance systems evaluate this specific condition as an active SoD policy violation, flagging it for remediation, policy exception approval, or administrative review to maintain proper preventive security controls.

B. No: This option is incorrect because holding permissions from both conflicting sets directly violates SoD rules, requiring the system to detect and flag the combination as a policy violation.

- SailPoint Identity Security Cloud Documentation, "Separation of Duties Policies," Section: Configuring SoD Rules and Criteria Evaluation.

- ISACA Technical Guidance, "Auditing Separation of Duties and Toxic Combinations," Chapter 3: Policy Configuration and Enforcement.

In SailPoint Identity Security Cloud, governance groups function as collective approval bodies composed of designated users who share governance responsibilities. When an access request approval or escalation policy targets a governance group, notifications and pending approval actions are distributed to the members of that governance group itself, or routed according to the configured fallback escalation path. They are not routed to the personal managers of individual group members. Escalation policies allow administrators to specify designated fallback approvers or alternative group routines when requests remain unacted upon, rather than automatically redirecting requests exclusively to managers of active members. Therefore, the proposed statement is inaccurate.

Option A is incorrect because governance group requests and escalations target group members or defined fallback approvers, not individual group members' managers.

- SailPoint Identity Security Cloud Documentation, "Managing Governance Groups and Approval Routing".

- SailPoint Identity Security Cloud Admin Guide, "Configuring Reminders and Escalation Policies for Approvals".