Identity-Security-Administrator Exam Dumps and Practice Questions

The statement is false. Identity Security Cloud distinguishes between defining an identity attribute for the tenant and mapping that attribute within a specific identity profile. When an administrator creates a new custom identity attribute from the mappings configuration of an identity profile, the attribute itself becomes available across all identity profiles in the tenant.

SailPoint explicitly states that any identity attribute added under any identity profile appears in all identity profiles. However, administrators do not have to map or use that attribute in every profile. Each identity profile can define its own mapping because different identity populations can obtain attribute values from different authoritative or secondary sources.

For example, a custom Employee Region attribute could be mapped from an HR source for employees while being mapped from Active Directory for contractors---or left unmapped in a profile where it is unnecessary. This distinction is essential: the attribute definition is tenant-wide, whereas the mapping and resulting value are identity-profile-specific.

Therefore, claiming that the custom attribute applies only to the identity profile where it was created is incorrect.

Study Guide Reference: Identity and Lifecycle Management --- Identity Profiles, Custom Identity Attributes and Attribute Mappings.

This statement is incorrect. When a role uses Identity List as its assignment type, Identity Security Cloud expects administrators to explicitly search for and select individual identities that should receive the role. SailPoint's documented procedure is to select Identity List, search for a specific identity in Add Identities, add that identity, and repeat the process for additional identities. Identity List therefore functions as an explicit membership list rather than a pattern-based membership rule.

Wildcards such as * and ? are valid in Identity Security Cloud Search queries for supported text fields. For example, Search can use patterns to find records whose names match a particular character sequence. However, that Search capability must not be confused with role Identity List assignment criteria.

If dynamic membership is required, administrators should use Standard Criteria, where identity attributes, account attributes, or entitlements can be evaluated through supported comparison operators. Identity List is appropriate when named identities are deliberately selected.

Study Guide Reference: Access Management --- Roles, Automated Role Assignment, Identity List, Standard Criteria and Search Wildcards.

The statement is correct. During an Identity Security Cloud certification, the reviewer evaluates each required access item and records the appropriate decision---for example, approving or revoking access. The certification cannot be properly completed while required review items remain undecided.

SailPoint's current user documentation states that after the reviewer has reviewed each item, the reviewer is taken to the sign-off page to complete the certification. The reviewer then selects Finish to submit the decisions and move the certification into the completed state. SailPoint's certification overview likewise describes the sequence as reviewing assigned access, approving or revoking items, and then signing off on those decisions.

Sign-off has governance significance beyond the user-interface transition. Revocation decisions that have not been signed off are not treated as finalized remediation instructions. SailPoint explicitly warns that unsigned revoke decisions are not applied and can be treated as undecided when a campaign is administratively completed.

Therefore, completion of the required decisions is the prerequisite that brings the reviewer to the certification sign-off stage.

Study Guide Reference: Supporting Governance --- Access Certifications, Review Decisions, Certification Sign-Off and Campaign Completion.

This is not a valid description of how a canceled access request is handled. A cancellation terminates the request before it completes. Once an access request has entered a concluded Canceled state, it is no longer simply a pending approval waiting for an administrator to substitute a decision for the assigned reviewer.

Approval Management does give administrators powerful controls over pending governance work. Administrators can inspect requests, reassign current approvers, send reminders, cancel requests, and, where supported, overwrite the current approval step. Overwriting an approver is fundamentally different from reversing an already canceled request: the administrator is acting on the current approval step of an active request.

SailPoint documentation explicitly identifies Canceled as a concluded status and defines cancellation as termination of the request. The administrator's overwrite capability applies to an approval step, not to resurrecting a request after cancellation. A new request would normally be required when access is still needed after the original request has been terminated.

Study Guide Reference: Access Management --- Approval Management, Access Request Status, Administrative Approval Actions.

This proposed API call is not valid for retrieving Virtual Appliance connector logs. The identifier shown in the log entry is a managed-cluster ID, yet the proposed URL incorrectly places that ID under the /v3/sources/ API resource. Managed clusters and sources are separate Identity Security Cloud objects and use different API endpoints.

SailPoint's documented Managed Clusters API provides operations for obtaining cluster details and for retrieving or modifying the cluster's log configuration, such as GET /managed-clusters/{id}/log-config and PUT /managed-clusters/{id}/log-config. It does not document a GET /v3/sources/{managedClusterId}/logs endpoint for exporting VA connector log files.

For connector troubleshooting, enhanced logging can be enabled against the appropriate managed cluster, the problematic operation reproduced, and the resulting VA/connector logs collected through the supported VA troubleshooting process. The administrator must also ensure that the correct cluster associated with the affected source is being investigated.

Therefore, the proposed endpoint confuses a managed cluster with a source and does not represent a supported log-export API.

Study Guide Reference: Virtual Appliances --- Managed Clusters, Connector Logging, VA Troubleshooting and SailPoint REST APIs.