Pass the SailPoint SailPoint Professional Identity-Security-Administrator Questions and answers with CertsForce

The statement accurately reflects the Search-based reporting model represented by Identity Security Cloud. Search is not limited to interactive investigation. Administrators can create a useful search query, save it, and configure a recurring subscription so that Identity Security Cloud generates and distributes the results automatically on a defined schedule.

The important workflow is that the query must first be executed and stored as a saved search. A subscription can then be attached to that saved search, with configuration for scheduling, timezone, and recipients. The scheduled execution returns records from the results category or tab that was selected when the saved search was created.

This functionality effectively turns a valid, reusable Search query into a scheduled reporting mechanism. It is particularly useful for recurring governance monitoring, audit review, identity-analysis tasks, entitlement investigations, and event reporting. SailPoint documentation states that automatic scheduled emails can contain the results of a saved search query and that subscriptions can be configured on recurring schedules.

Study Guide Reference: Platform — Search, Saved Searches, Scheduled Search Reports and Subscriptions.

===============

The statement correctly describes the standard escalation behavior represented by the access-request escalation model. Identity Security Cloud can automatically escalate an approval when the assigned reviewer fails to act within the configured timeframe. This prevents an access request from remaining indefinitely with an unavailable or unresponsive approver.

Under the standard escalation pattern, the first and second escalations can route the request to successive manager levels of the assigned reviewer. The third escalation routes the approval to the configured fallback approver. Administrators control escalation timing, frequency, escalation reviewers, and fallback behavior through approval settings. This mechanism operates alongside reminder notifications and request timeout controls.

The fallback approver is particularly important because it provides a final governance path when ordinary escalation cannot resolve the request. SailPoint's current documentation explicitly describes the first two manager escalations followed by a third escalation to the fallback approver when custom approval settings are not configured.

Study Guide Reference: Access Management — Access Requests, Global Reminder and Escalation Policy, Approval Escalation and Fallback Approvers.

===============

The statement accurately describes the cryptographic trust model underlying SAML federation. In a typical SAML configuration, the Identity Provider (IdP) authenticates the user and issues a SAML assertion. The Service Provider (SP) validates the assertion, particularly its digital signature, by using certificate/public-key information associated with the trusted IdP. Private keys remain protected by their owners; the corresponding certificates containing public keys can be exchanged through configuration or SAML metadata.

For Identity Security Cloud operating as a SAML Service Provider, SailPoint requires administrators to obtain the IdP's signing certificate and configure it in Identity Security Cloud. SailPoint also provides Service Provider metadata that can be supplied to the IdP. This establishes the federation relationship and allows the participating systems to validate SAML messages according to the configured trust model. The critical concept is that passwords are not shared between the IdP and SP. Authentication assertions are trusted because they originate from an established federation partner and can be cryptographically validated.

Study Guide Reference: Access Management — Authentication Methods, SAML Federation, Identity Provider and Service Provider Trust.

===============

This is a valid use of Approval Management. A pending access request can become operationally blocked if the assigned reviewer—for example, the requester's manager—is unavailable. Administrators need a mechanism to prevent governance processes from stalling because of absence, organizational changes, or incorrect assignment.

Identity Security Cloud allows administrators to locate a pending access request and reassign its review responsibility to another suitable identity. The new reviewer becomes the current approver and can continue the approval process. Reassignment is recorded as part of the request's processing history, preserving accountability and auditability.

The same principle is also available to reviewers in appropriate circumstances: an assigned reviewer can reassign a request when another user is better suited to make the decision. For administrators, Approval Management provides centralized visibility and control over pending requests across the tenant. SailPoint explicitly documents that administrators can reassign requests and that reassignment is intended to maintain the timely flow of governance processes.

Study Guide Reference: Access Management — Approval Management, Reassigning Access Requests, Pending Approval Administration.

===============

Certificate-based authentication is a valid authentication mechanism for verifying both user and device identities. It relies on Public Key Infrastructure (PKI), in which a trusted Certificate Authority issues a digital certificate containing the subject's public key and identifying information. During authentication, the certificate holder demonstrates possession of the corresponding private key, and the receiving system validates the certificate's trust chain, validity period, revocation status, intended use, and other policy requirements.

This model can authenticate individual users through certificates stored on smart cards, security tokens, or endpoint certificate stores. The same mechanism can authenticate managed computers, servers, and other devices by issuing device-specific certificates. Because the private key does not need to be transmitted to the authenticating service, certificate-based authentication provides stronger resistance to credential theft than reusable passwords when implemented correctly.

The statement therefore accurately describes a recognized authentication method applicable within broader enterprise identity and access-management architectures.

Study Guide Reference: Access Management — Authentication Methods, Certificate-Based Authentication, PKI and Strong Authentication.

===============

This statement is correct. An uncorrelated account is a source account that Identity Security Cloud has been unable to associate with an existing identity by using the configured account-correlation criteria. SailPoint provides a supported manual-correlation process for resolving these accounts.

From the source's Uncorrelated Accounts area, an administrator can select Download Correlation File to obtain a CSV containing the uncorrelated accounts. The administrator then adds the appropriate identity Account IDs to the designated userName column beside each account that needs to be correlated. After saving the modified CSV, it can be uploaded back through the Uncorrelated Accounts page. Identity Security Cloud processes the file and creates permanent manual associations between the specified source accounts and identities.

Manual correlation differs from ordinary correlation rules because a manually correlated account remains attached to that identity even if source attributes later change. To associate it with another identity, the manual correlation must first be removed or explicitly changed.

Therefore, the download-edit-upload procedure described in the proposed statement is an officially supported method.

Study Guide Reference: Identity and Lifecycle Management — Account Correlation, Uncorrelated Accounts, Manual Correlation and Identity Assignment.

This is a valid troubleshooting approach. An Active Directory provisioning failure such as "There is no such object on the server" indicates that the connector attempted an operation against an object or directory reference that Active Directory could not resolve. Potential causes include an account or group being deleted or moved, an outdated distinguished name, an invalid entitlement reference, replication timing, or a provisioning operation targeting an object that no longer exists.

Searching SailPoint's technical knowledge and community resources for the exact connector error is therefore useful because connector-specific errors often have previously documented causes, configuration considerations, and remediation patterns. This should complement—not replace—tenant-side investigation. An administrator should correlate the error with provisioning activity, source information, account state, and the target system. Identity Security Cloud provides Search and audit information for investigating provisioning activity, while SailPoint technical resources provide additional connector-specific context. Current SailPoint documentation explicitly identifies provisioning activity as auditable and searchable.

Study Guide Reference: Provisioning — Troubleshooting Provisioning Errors, Active Directory Connector Operations, SailPoint Support Resources.

===============

The statement is not valid in the normal Identity Security Cloud identity model. An authoritative source is specifically used to establish identities. When a source is associated with an identity profile and thereby designated as authoritative, Identity Security Cloud creates an identity from each qualifying authoritative account. The authoritative account therefore forms the identity's authoritative foundation rather than behaving as an ordinary account that must subsequently be correlated to an existing identity.

Uncorrelated accounts normally arise from non-authoritative or secondary sources when Identity Security Cloud cannot match an aggregated account to an existing authoritative identity by using configured correlation criteria. SailPoint defines an uncorrelated account as an account that has not been linked to an authoritative identity. Such accounts must be resolved before their associated access can be properly governed.

Although unusual administrative edge cases can affect existing authoritative-account associations, this does not change the fundamental certification concept: authoritative accounts establish identities, while correlation attaches accounts from other sources to those identities.

Study Guide Reference: Identity and Lifecycle Management — Authoritative Sources, Identity Profiles, Account Correlation and Uncorrelated Accounts.

===============

The statement is incorrect because Identity Security Cloud Search and reporting are not restricted to identity records. Search supports multiple governance data categories, and scheduled saved-search subscriptions can return records from the results tab associated with the saved search.

Searchable information includes identities as well as other important governance objects and operational records, including entitlements, access profiles, roles, events, and account activity. Audit reporting itself is implemented through Search, demonstrating that reporting extends well beyond identity queries. For example, administrators can investigate authentication events, provisioning activity, source-related events, access-request activity, and other audit information.

When a saved search is subscribed to, Identity Security Cloud generates recurring results based on the tab selected when the search was saved. Therefore, restricting scheduled reporting conceptually to identity-only searches would remove substantial audit and governance functionality that the platform expressly supports. SailPoint's documentation describes both the multiple Search data models and the ability of scheduled searches to return results from the selected results tab.

Study Guide Reference: Platform — Search Data Models, Saved Searches, Reporting and Scheduled Search Subscriptions.

The statement is valid. In Identity Security Cloud, entitlements represent individual access rights or permissions that exist on connected sources. The specific form of an entitlement depends on the target system. Examples can include Active Directory groups, application roles, permission sets, security groups, database privileges, or other source-specific access constructs.

Entitlements form a fundamental layer of SailPoint's access model. Administrators can combine one or more entitlements from the same source into an access profile. Access profiles can then be incorporated into roles to create higher-level business access models.

Because SailPoint aggregates entitlement information from connected sources, administrators can govern these access rights through certifications, access requests, provisioning processes, role management, and policy analysis. Entitlement metadata can also provide meaningful descriptions and ownership information so reviewers understand the access being governed.

Therefore, describing entitlements as specific access rights on a source precisely reflects their role in Identity Security Cloud's access governance architecture.

Study Guide Reference: Access Management — Entitlements, Access Profiles, Roles and Access Model Fundamentals.

===============