SailPoint Identity-Security-Administrator Exam Questions

The statement does not accurately describe how governance-group approval and escalation operate. When a governance group is configured as an approver, the request is associated with the group's members, and a member of that governance group can perform the approval on behalf of the group. The system is not designed to send the request exclusively to the manager of one active group member.

Escalation behavior is also broader than the proposed statement suggests. SailPoint documents that when governance-group approvals are escalated to a manager level, the request can be escalated to each member's manager. If a particular member does not have a manager, that member's approval can remain assigned while other members' assignments are escalated. If none of the members has a manager, the applicable approvals can progress to the configured fallback approver.

Therefore, 'only to the manager of an active member' incorrectly reduces a multi-member governance-group escalation process to one manager and does not reflect the documented routing behavior.

Study Guide Reference: Access Management --- Governance Group Approvals, Escalation Chains, Access Request Reviewers.

===============

The statement is correct. Attribute synchronization is configured at the source level because administrators must determine which account attributes on a specific governed source should remain synchronized with corresponding Identity Security Cloud identity attributes.

SailPoint's documented configuration path begins by navigating to Admin > Connections > Sources and selecting or editing the appropriate source. Within the source's Account Management section, the administrator opens Attribute Sync. Identity Security Cloud then displays the account attributes that are eligible for synchronization based on the source's Create Account definition and identity-attribute mappings. The administrator selects the attributes that should synchronize and can initiate the appropriate synchronization process.

Attribute Sync applies to existing correlated accounts. It does not independently create accounts, and an uncorrelated account cannot participate because Identity Security Cloud has no authoritative identity relationship from which to determine the target attribute values.

Therefore, accessing the source through Admin > Connections > Sources and configuring Attribute Sync from its account-management configuration is precisely the supported administrative approach.

Study Guide Reference: Provisioning --- Configuring Attribute Sync, Source Account Management, Identity Attribute Mapping and Correlated Accounts.

===============

The proposed statement is incorrect because the displayed search syntax is malformed. To search for identities whose account count falls within an inclusive numerical range, Identity Security Cloud uses range-query syntax with properly matched square brackets.

The correct expression is:

accountCount:[1 TO 4]

Square brackets indicate that both endpoints are included. Therefore, a correctly formatted query would return identities with account counts of 1, 2, 3, or 4. The displayed expression, however, is missing the closing square bracket and does not follow the documented range syntax correctly.

The accountCount field represents the number of accounts associated with an identity across connected sources. Range searches are useful when administrators need to identify identities with unusually low or high account ownership, investigate orphaned access patterns, or perform access-analysis activities.

Because the specific proposed command is syntactically incomplete, it cannot reliably be treated as the documented query that returns identities with one through four accounts.

Study Guide Reference: Platform --- Search Query Syntax, Range Queries, Identity Search Fields.

===============

Yes. This is a classic Separation of Duties scenario. The individual requesting a significant system configuration change should not also possess the authority to independently approve that same change. Combining requester and approver responsibilities eliminates an important independent-control checkpoint and allows one person to initiate and authorize a potentially high-impact administrative operation.

SailPoint's official SoD guidance specifically uses major system configuration changes as an example: significant configuration changes should be approved by someone other than the person requesting the change. SoD policies are designed to identify and govern combinations of access that would enable such conflicting responsibilities.

From a governance perspective, the requester initiates the business or technical need, while an independent reviewer determines whether the requested change is appropriate, authorized, and sufficiently controlled. Separating these functions reduces fraud, accidental misconfiguration, privilege abuse, and unauthorized system modification. Where conflicting access already exists, Identity Security Cloud can identify the associated SoD violation for investigation and remediation.

Therefore, allowing the requester to approve their own major system change represents exactly the type of control conflict that SoD is intended to prevent.

Study Guide Reference: Supporting Governance --- Separation of Duties, Requester/Approver Conflicts, Internal Controls and SoD Policy Enforcement.

===============

This is a valid troubleshooting approach. An Active Directory provisioning failure such as 'There is no such object on the server' indicates that the connector attempted an operation against an object or directory reference that Active Directory could not resolve. Potential causes include an account or group being deleted or moved, an outdated distinguished name, an invalid entitlement reference, replication timing, or a provisioning operation targeting an object that no longer exists.

Searching SailPoint's technical knowledge and community resources for the exact connector error is therefore useful because connector-specific errors often have previously documented causes, configuration considerations, and remediation patterns. This should complement---not replace---tenant-side investigation. An administrator should correlate the error with provisioning activity, source information, account state, and the target system. Identity Security Cloud provides Search and audit information for investigating provisioning activity, while SailPoint technical resources provide additional connector-specific context. Current SailPoint documentation explicitly identifies provisioning activity as auditable and searchable.

Study Guide Reference: Provisioning --- Troubleshooting Provisioning Errors, Active Directory Connector Operations, SailPoint Support Resources.

===============