SailPoint Identity-Security-Administrator Dumps

Yes. Removing the @entitlements(name:Manager_Access) portion produces a valid identity-oriented query structure. Identity Search supports the @access(...) nested object because an identity can possess multiple access items. SailPoint specifically documents @access(displayName:...) for identifying identities that possess a named access item and @access(source.name:...) for locating identities whose access originates from a particular source. Nested access queries can be combined with ordinary identity fields by using Boolean operators.

The remaining query therefore applies three conditions correctly: the identity must have been created during the specified 24-hour range, and the identity must satisfy either the New_Hire_Access condition or the Acme_HRMS source-access condition.

The problem with the original expression is the @entitlements(...) nested object. In SailPoint's searchable data models, @entitlements is used when examining objects such as access profiles or roles that contain entitlements; it is not the appropriate nested object for identity-level access searches. Identity-level entitlement holdings are searched through @access(...).

Study Guide Reference: Platform — Search, Nested Queries, Identity Access Fields and Boolean Query Construction.

===============

This approach satisfies the stated provisioning requirements. Identity Security Cloud roles can use identity attributes such as department as assignment criteria. Therefore, a standard role can be configured so that identities whose department equals Finance automatically qualify for the role, regardless of whether their employment type is employee or contractor.

The role can then contain the Office 365 E3 entitlement, either directly or through an appropriate access profile. When an identity satisfies role membership criteria, Identity Security Cloud automatically assigns the role and provisions its associated access to the identity's applicable source account. When the identity ceases to meet the criteria, the role and associated provisioned access can be removed.

This design does not indiscriminately assign a default Office 365 license to contractors throughout the organization. It targets Finance identities and grants the specific E3 access required by the scenario. It also avoids deliberately assigning both the default license and E3 license to the same Finance identity.

Study Guide Reference: Provisioning — Automated Role Assignment, Identity Attribute Criteria, Role-Based Provisioning and Entitlement Assignment.

===============

The statement is correct. In SAML federation, the Entity ID uniquely identifies a participant in the trust relationship. When Identity Security Cloud is configured to use an external Identity Provider, the Identity Provider Entity ID entered in SailPoint must correspond to the EntityID specified in the IdP's SAML metadata.

This identifier helps Identity Security Cloud determine which trusted Identity Provider issued the authentication assertion. If the configured Entity ID does not match the expected IdP identifier, authentication processing can fail because the received federation information does not correspond to the configured trust relationship.

Administrators must also configure other SAML components correctly, including the Identity Provider login endpoint and signing certificate. The signing certificate enables Identity Security Cloud to validate the authenticity and integrity of SAML assertions received from the IdP.

It is also important to distinguish between the IdP Entity ID and the Identity Security Cloud Service Provider Entity ID. Each identifies a different side of the SAML relationship.

Study Guide Reference: Access Management — SAML Authentication, Identity Provider Configuration, Entity IDs and Federation Trust.

===============

This is not a valid explanation for why a requestable entitlement is missing. An entitlement being included in an access profile does not inherently mean that the entitlement becomes hidden from the Request Center. Identity Security Cloud supports direct entitlement requests as well as requests for access profiles that bundle multiple entitlements.

SailPoint explicitly states that entitlements can be configured for direct access requests and can also be grouped into access profiles. Likewise, access profiles can independently be configured as requestable objects. Therefore, membership in an access profile is not itself the troubleshooting condition that determines whether the underlying entitlement is requestable.

The more relevant checks are whether entitlement requests are globally enabled, whether the newly aggregated group actually exists as an entitlement in Identity Security Cloud, and whether its Requestable status is enabled. SailPoint's entitlement-request configuration explicitly requires both global enablement and entitlement-level requestability.

Consequently, assuming that the group has disappeared simply because an access profile contains it is technically incorrect.

Study Guide Reference: Access Management — Entitlements, Access Profiles, Direct Entitlement Requests and Request Center Configuration.

===============

This is a valid description of Separation of Duties (SoD) as an identity-governance control. SoD policies define combinations of access that should not be held by the same identity because combining those privileges could enable fraud, unauthorized transactions, or circumvention of internal controls. A detective implementation analyzes existing access and identifies identities that already violate a defined policy, allowing administrators to investigate, mitigate, revoke access, or document an approved exception.

Preventive policy evaluation applies the same governance principle before problematic access is granted. During an access-request or provisioning process, the proposed access can be evaluated against policy rules so that a potential conflict is identified before the access change is completed. SailPoint documents SoD policies as conflicting-access definitions and also documents preventive policy evaluation in its governance model. These controls provide measurable evidence that an organization is actively enforcing access-risk policies rather than merely documenting them.

Study Guide Reference: Supporting Governance — Separation of Duties, Policy Rules, Detective and Preventive Controls.

===============

The statement correctly describes the communication model used by SailPoint Virtual Appliances. The critical architectural principle is that communication between a customer-hosted VA and Identity Security Cloud is initiated outbound from the VA . SailPoint does not establish unsolicited inbound connections from its cloud environment directly into the customer's VA.

SailPoint specifically documents that each VA makes continuous outbound-only calls to the cloud environment and polls the cluster queue for requested actions , including aggregation and provisioning work. The appliance retrieves the work assigned to its cluster, executes the appropriate connector operation against the customer source, and communicates the resulting information back to Identity Security Cloud.

This polling model is significant from a network-security perspective because customers do not need to create inbound firewall rules allowing Identity Security Cloud to initiate sessions into their internal environment. Instead, the VA requires appropriate outbound connectivity to SailPoint's required endpoints.

Therefore, describing VAs as initiating communication to their cluster queue accurately reflects the supported VA architecture.

Study Guide Reference: Virtual Appliances — VA Cluster Architecture, Cluster Queue Polling, Outbound-Only Communication and Connector Operations.

===============

The statement is valid in the Identity Security Cloud source model. A source represents an external enterprise system that maintains accounts or personnel records. Those source accounts are aggregated into Identity Security Cloud so they can be correlated with identities and governed.

SailPoint's official definition states that a source represents a third-party enterprise application, database, or directory-management system maintaining its own set of user accounts or personnel records. For example, an Active Directory source can contain directory user accounts, while a database source might expose database accounts and a SaaS source might contain application-specific user objects.

This distinction between an identity and a source account is fundamental. One Identity Security Cloud identity can be correlated to accounts across multiple sources. The identity represents the person or governed entity, whereas each source account represents that identity's presence in a particular external system.

During aggregation, Identity Security Cloud loads account attributes and associated access from the source, correlates those accounts to identities, and uses the resulting relationships for provisioning, access modeling, certifications, and governance.

Study Guide Reference: Sources — Sources and Connectors, Source Accounts, Account Aggregation and Identity Correlation.

===============

Yes. Identity Security Cloud identity profiles support stronger verification for password-reset and account-unlock operations. When two-factor authentication is enabled for these functions, users must successfully complete two configured identity-verification methods before Identity Security Cloud permits the password reset operation. SailPoint explicitly documents this behavior under the identity profile's Password Reset and User Unlock settings.

Available verification methods can include a verification code or call to a configured phone number, a verification message delivered to an email address, security questions, Helpdesk-provided codes, or supported external MFA integrations. Administrators must ensure that the underlying identity attributes—such as phone numbers and email addresses—contain valid data when those methods are selected.

This password-reset authentication control should be distinguished from the Multifactor Authentication Sign-In Method , which uses an authenticator application to protect normal Identity Security Cloud sign-in. Both mechanisms strengthen authentication, but they protect different stages of account access.

Study Guide Reference: Access Management — Identity Profile Security Settings, Two-Factor Authentication, Password Reset and User Unlock Methods.

===============

Yes. This is a classic Separation of Duties scenario. The individual requesting a significant system configuration change should not also possess the authority to independently approve that same change. Combining requester and approver responsibilities eliminates an important independent-control checkpoint and allows one person to initiate and authorize a potentially high-impact administrative operation.

SailPoint's official SoD guidance specifically uses major system configuration changes as an example: significant configuration changes should be approved by someone other than the person requesting the change. SoD policies are designed to identify and govern combinations of access that would enable such conflicting responsibilities.

From a governance perspective, the requester initiates the business or technical need, while an independent reviewer determines whether the requested change is appropriate, authorized, and sufficiently controlled. Separating these functions reduces fraud, accidental misconfiguration, privilege abuse, and unauthorized system modification. Where conflicting access already exists, Identity Security Cloud can identify the associated SoD violation for investigation and remediation.

Therefore, allowing the requester to approve their own major system change represents exactly the type of control conflict that SoD is intended to prevent.

Study Guide Reference: Supporting Governance — Separation of Duties, Requester/Approver Conflicts, Internal Controls and SoD Policy Enforcement.

===============

1. An IT company grants system administrators elevated permissions to manage critical servers and network configurations. These administrators use unique, secure credentials and multi-factor authentication to access sensitive systems, ensuring that only qualified personnel can perform high-risk tasks.

Select a match:

Answer: Privileged Access

2. A payroll administrator at a financial services company is responsible for processing employee salaries. Due to staffing shortages, they are also given approval access for salary disbursements, meaning they can both enter and approve payroll transactions.

Select a match:

Answer: Separation of Duties (SOD)

3. A customer support agent in a healthcare company accesses a patient's full medical history and Social Security number to verify their identity for a simple billing inquiry.

Select a match:

Answer: Personally Identifiable Information (PII)

The first scenario represents Privileged Access because system administrators hold elevated permissions that allow them to perform sensitive, high-impact operations on critical infrastructure. SailPoint identifies privileged entitlements as access that can expose sensitive data or create elevated security risk, making stronger controls such as MFA and dedicated credentials appropriate.

The second scenario represents Separation of Duties (SOD) . Allowing the same payroll administrator both to enter payroll transactions and approve salary disbursements creates conflicting responsibilities. SailPoint's SoD model specifically exists to prevent one identity from possessing combinations of access that allow them to initiate and independently authorize sensitive business transactions.

The third scenario involves Personally Identifiable Information (PII) because medical information combined with a Social Security number directly exposes sensitive information associated with an identifiable individual.

Study Guide Reference: Supporting Governance — Separation of Duties, Privileged Access, Sensitive Data and Identity Governance Controls.

This is not a valid description of how a canceled access request is handled. A cancellation terminates the request before it completes. Once an access request has entered a concluded Canceled state, it is no longer simply a pending approval waiting for an administrator to substitute a decision for the assigned reviewer.

Approval Management does give administrators powerful controls over pending governance work. Administrators can inspect requests, reassign current approvers, send reminders, cancel requests, and, where supported, overwrite the current approval step. Overwriting an approver is fundamentally different from reversing an already canceled request: the administrator is acting on the current approval step of an active request.

SailPoint documentation explicitly identifies Canceled as a concluded status and defines cancellation as termination of the request. The administrator's overwrite capability applies to an approval step, not to resurrecting a request after cancellation. A new request would normally be required when access is still needed after the original request has been terminated.

Study Guide Reference: Access Management — Approval Management, Access Request Status, Administrative Approval Actions.

===============

This is a valid network-isolation troubleshooting step. Virtual Appliances depend on continuous outbound network connectivity to Identity Security Cloud. A VPN, firewall, proxy, routing policy, or network-security device positioned in the communication path can prevent the VA from reaching required SailPoint endpoints even when the VA itself is otherwise healthy.

Testing connectivity with and without the VPN helps determine whether the VPN path, its routing tables, security policies, DNS handling, or tunnel configuration is responsible for the failure. SailPoint requires VA outbound connectivity, including HTTPS communication over TCP port 443, and documents network connectivity as a primary dependency for proper VA operation. Network connectivity errors should therefore be investigated by validating the path between the appliance and required endpoints.

This does not mean permanently bypassing required enterprise security controls. The objective is diagnostic isolation: establish whether connectivity succeeds when the suspected network component is removed from the path, then correct the underlying VPN or routing configuration.

Study Guide Reference: Virtual Appliances — VA Network Troubleshooting, Outbound Connectivity, VPN and Firewall Configuration.

===============

This is a valid troubleshooting approach. An Active Directory provisioning failure such as "There is no such object on the server" indicates that the connector attempted an operation against an object or directory reference that Active Directory could not resolve. Potential causes include an account or group being deleted or moved, an outdated distinguished name, an invalid entitlement reference, replication timing, or a provisioning operation targeting an object that no longer exists.

Searching SailPoint's technical knowledge and community resources for the exact connector error is therefore useful because connector-specific errors often have previously documented causes, configuration considerations, and remediation patterns. This should complement—not replace—tenant-side investigation. An administrator should correlate the error with provisioning activity, source information, account state, and the target system. Identity Security Cloud provides Search and audit information for investigating provisioning activity, while SailPoint technical resources provide additional connector-specific context. Current SailPoint documentation explicitly identifies provisioning activity as auditable and searchable.

Study Guide Reference: Provisioning — Troubleshooting Provisioning Errors, Active Directory Connector Operations, SailPoint Support Resources.

===============

This can be a valid reason, depending on the manager-review campaign mechanism being used. In a search-based certification campaign where Manager is selected as the reviewer, Identity Security Cloud determines the reviewer from each identity's manager relationship. If an identity does not have a manager defined, SailPoint documents that the certification is reassigned to the creator of the campaign . If the campaign creator is an administrator, the certification therefore appears assigned to that administrator instead of a manager.

The absence of a manager can originate from authoritative HR data, an incomplete manager attribute mapping, failed manager correlation, or otherwise missing manager information on the identity.

A distinction is important: traditional Manager Campaigns require identities to have managers defined and identities without managers are normally excluded. SailPoint recommends using a Search-based campaign with Manager selected as reviewer when identities without managers must still be included.

Given the scenario explicitly states that the certification was reassigned to an admin, missing manager information is therefore a technically valid explanation for the observed fallback assignment.

Study Guide Reference: Supporting Governance — Certifications, Manager Review, Search-Based Campaigns and Identities Without Managers.

===============

The statement is correct. Identity Security Cloud allows administrators to configure a requestable role so that reviewers must provide justification when denying the requested access.

When configuring a role for access requests, administrators can enable the role for requests, define its approval process, and configure Require Comments behavior. SailPoint specifically provides an option named When a reviewer denies the request . Enabling this setting requires the reviewer to enter a comment or reason when rejecting the role request.

This requirement strengthens governance and auditability. A denial without explanation provides limited evidence about why the access was considered inappropriate. Requiring a comment records the business or security reasoning behind the decision, which can later assist administrators, access owners, auditors, and compliance personnel in understanding the approval history.

Comment requirements can also be configured at other stages, including when the requester submits the access request. Similar denial-comment controls exist for directly requestable entitlements.

Therefore, requiring a reviewer to document the reason for rejection is a supported role-request configuration.

Study Guide Reference: Access Management — Requestable Roles, Approval Processes, Require Comments and Access Request Governance.

Yes, when the user's application access is governed through attribute-driven role assignment, a department change can trigger deprovisioning of access that is no longer appropriate. Identity Security Cloud roles can use mapped identity attributes such as Department as membership criteria. During identity processing, SailPoint evaluates whether the identity continues to satisfy those criteria.

If the user moves to another department and consequently ceases to satisfy the role's assignment criteria, the identity is removed from the role. SailPoint explicitly documents that when identities are removed from roles because of assignment-criteria changes, access assigned by those roles is removed or deprovisioned , unless the same access is independently provided through another role or assignment.

This implements birthright and role-based lifecycle governance: business changes such as department transfers should automatically cause obsolete access to be removed while new access appropriate to the destination department can be provisioned. SailPoint even provides a workflow template specifically addressing identity department changes and reassessment of old versus new access.

Thus, a department change is a valid deprovisioning trigger when the former application's access derives from criteria that the identity no longer satisfies.

Study Guide Reference: Provisioning — Automated Role Assignment, Attribute Changes, Role Deprovisioning and Department-Based Access Lifecycle.

This is an appropriate corrective action for a PKIX certification-path failure. When the Active Directory connector communicates with a domain controller using TLS, the Virtual Appliance must trust the certificate presented by that server. A PKIX path validation failed or unable to find valid certification path to requested target error indicates that Java cannot construct a trusted certificate chain from the server certificate to a trusted certification authority.

Consequently, verifying that the correct CA or server certificate is available to the VA is a fundamental troubleshooting step. SailPoint supports TLS between Virtual Appliances and compatible sources and documents certificate management on the VA for situations where trusted certificates need to be added manually. Current configuration also attempts to copy supported TLS certificates automatically to the VA cluster, but administrators must still validate certificate trust when TLS handshakes fail.

The certificate chain, expiration, hostname, and issuing CA should also be checked. Once the VA trusts the appropriate chain, the TLS handshake can complete successfully.

Study Guide Reference: Virtual Appliances — TLS Configuration, Certificate Trust, Active Directory Secure Connectivity and PKIX Troubleshooting.

===============

The statement is valid. Multi-Factor Authentication (MFA) strengthens authentication by requiring more than a single verification mechanism before access is granted. Authentication factors are generally categorized as something the user knows, something the user possesses, or something the user inherently is. Requiring multiple factors substantially reduces the effectiveness of a compromised password because possession of that password alone is insufficient to complete authentication.

Identity Security Cloud supports MFA through an external authenticator application. When MFA is configured for an Identity Profile, affected users register an authenticator and subsequently provide a generated verification code during authentication. SailPoint also distinguishes sign-in MFA from two-factor verification used for password resets and account unlocking, where administrators can explicitly require users to complete two configured verification methods.

Therefore, the video's characterization of MFA as requiring two or more forms of verification correctly reflects the underlying security principle. MFA should not be confused with authorization: authentication establishes identity, whereas authorization determines what authenticated identities are permitted to access.

Study Guide Reference: Access Management — Multifactor Authentication, Authentication Factors, Strong Authentication and Identity Profile Sign-In Methods.

===============

The statement does not accurately describe how governance-group approval and escalation operate. When a governance group is configured as an approver, the request is associated with the group's members, and a member of that governance group can perform the approval on behalf of the group. The system is not designed to send the request exclusively to the manager of one active group member.

Escalation behavior is also broader than the proposed statement suggests. SailPoint documents that when governance-group approvals are escalated to a manager level, the request can be escalated to each member's manager . If a particular member does not have a manager, that member's approval can remain assigned while other members' assignments are escalated. If none of the members has a manager, the applicable approvals can progress to the configured fallback approver.

Therefore, "only to the manager of an active member" incorrectly reduces a multi-member governance-group escalation process to one manager and does not reflect the documented routing behavior.

Study Guide Reference: Access Management — Governance Group Approvals, Escalation Chains, Access Request Reviewers.

===============

The statement is correct. Identity Security Cloud normally uses optimized aggregation , which retrieves records from the source but can skip further processing for an account when the account already exists and no relevant data changes are detected. In that situation, account correlation and manager correlation do not need to be recalculated for unchanged accounts.

Disabling aggregation optimization causes an unoptimized aggregation . SailPoint explicitly states that this mode reprocesses every record regardless of whether the underlying account data has changed. It also reevaluates account-correlation and manager-correlation logic for those accounts.

This is particularly important after changing account-correlation configuration. If an account's attributes have not changed, an optimized aggregation might otherwise skip the account, leaving it uncorrelated despite the newly corrected correlation rules. SailPoint therefore recommends running an aggregation with optimization disabled when correlation logic has been modified on an already-aggregated source.

Unoptimized processing requires more resources and can take longer on large sources, so it should be used deliberately when full reevaluation is necessary rather than as the default aggregation mode.

Study Guide Reference: Sources — Account Aggregation, Optimized and Unoptimized Aggregations, Account Correlation.

===============

This statement is incorrect. When a role uses Identity List as its assignment type, Identity Security Cloud expects administrators to explicitly search for and select individual identities that should receive the role. SailPoint's documented procedure is to select Identity List, search for a specific identity in Add Identities , add that identity, and repeat the process for additional identities. Identity List therefore functions as an explicit membership list rather than a pattern-based membership rule.

Wildcards such as * and ? are valid in Identity Security Cloud Search queries for supported text fields. For example, Search can use patterns to find records whose names match a particular character sequence. However, that Search capability must not be confused with role Identity List assignment criteria.

If dynamic membership is required, administrators should use Standard Criteria , where identity attributes, account attributes, or entitlements can be evaluated through supported comparison operators. Identity List is appropriate when named identities are deliberately selected.

Study Guide Reference: Access Management — Roles, Automated Role Assignment, Identity List, Standard Criteria and Search Wildcards.

===============

The statement is valid. A Governance Group is intended to provide a collection of identities that can make governance decisions about access. If the group has no valid members, there is nobody within that group who can perform the required approval action.

SailPoint explicitly states that before a Governance Group reviews access, it must be configured and have members . When the Governance Group's turn arrives during an access request or certification, its members receive notification and any eligible member can act on behalf of the group.

Identity Security Cloud has fallback and reassignment mechanisms for situations where reviewers cannot be resolved, but administrators should not design approval configurations around an empty Governance Group. Doing so creates unnecessary routing failures, escalation, or reassignment and weakens the intended ownership model.

The recommended governance model is therefore to create the group, assign appropriate responsible identities as members, maintain membership as organizational responsibilities change, and only then use that group as a reviewer, owner, or governance decision point.

Study Guide Reference: Access Management — Governance Groups, Group Membership, Access Request Reviewers and Approval Configuration.

===============

This is a valid method for enabling connector-level logging on the relevant VA managed cluster. The log entry shows that the acme AD-TX Cluster currently has logConfiguration: null, meaning no temporary connector logging configuration is active for that cluster. The Managed Clusters API supports a PUT request to /managed-clusters/{id}/log-config to establish or update logging configuration.

The proposed durationMinutes value of 365 is valid because SailPoint supports a logging duration from 5 through 1,440 minutes. DEBUG is also a supported Log4j level, and sailpoint.connector.ADLDAPConnector is the appropriate connector logging class for Active Directory/LDAP connector activity. Once enabled, the administrator can reproduce the problematic aggregation and obtain substantially more diagnostic information than would be available under normal logging.

Importantly, enhanced logging should generally be enabled only for the troubleshooting period because verbose connector logging increases log volume. SailPoint's current API explicitly supports this managed-cluster logging operation and temporary duration control.

Study Guide Reference: Virtual Appliances — Connector Logging, Managed Cluster Log Configuration, Active Directory Troubleshooting.

===============

The statement is valid. The Identity Security Cloud Active Directory connector supports substantial identity-lifecycle functionality, including account aggregation, creation, modification, entitlement management, password-related operations, and provisioning. SailPoint documents Active Directory account provisioning and the use of Identity Security Cloud provisioning policies to create and manage accounts on the directory.

Active Directory can also serve as an authentication source through Pass-Through Authentication (PTA) . With PTA configured for an identity profile, users can authenticate to Identity Security Cloud using the network password associated with their Active Directory account. Identity Security Cloud passes the authentication operation through to the configured directory source rather than requiring a separate local SailPoint password.

Therefore, the AD integration is not restricted to account aggregation or read-only identity data. It can participate in both authentication and lifecycle administration, including provisioning users and managing access. Appropriate service-account permissions, VA connectivity, and provisioning configuration are required.

Study Guide Reference: Sources — Active Directory Connector, Pass-Through Authentication, Account Aggregation and Provisioning.

===============

Certificate-based authentication is a valid authentication mechanism for verifying both user and device identities. It relies on Public Key Infrastructure (PKI), in which a trusted Certificate Authority issues a digital certificate containing the subject's public key and identifying information. During authentication, the certificate holder demonstrates possession of the corresponding private key, and the receiving system validates the certificate's trust chain, validity period, revocation status, intended use, and other policy requirements.

This model can authenticate individual users through certificates stored on smart cards, security tokens, or endpoint certificate stores. The same mechanism can authenticate managed computers, servers, and other devices by issuing device-specific certificates. Because the private key does not need to be transmitted to the authenticating service, certificate-based authentication provides stronger resistance to credential theft than reusable passwords when implemented correctly.

The statement therefore accurately describes a recognized authentication method applicable within broader enterprise identity and access-management architectures.

Study Guide Reference: Access Management — Authentication Methods, Certificate-Based Authentication, PKI and Strong Authentication.

===============

The statement is false. Removing an account record from Identity Security Cloud does not necessarily permanently prevent the account from being discovered again. The decisive factor is whether the account still exists on the underlying source system.

SailPoint explicitly documents that when an administrator selects Remove Account for an account in Identity Security Cloud, the account is removed from the tenant's current source data, but it will be re-aggregated during the next complete source aggregation unless it is also removed from the source itself .

The same architectural principle applies to aggregation-driven account state. Identity Security Cloud's source data is a governed representation of accounts that actually exist on connected systems. A future full aggregation can rediscover a source account and recreate its representation in the tenant if that source account continues to exist and is returned by the connector.

To permanently eliminate the account from subsequent aggregation, it must be appropriately deleted or otherwise excluded on the actual source, subject to the organization's provisioning and governance policy.

Study Guide Reference: Sources — Account Aggregation, Removing Accounts, Complete Aggregations and Source Account Lifecycle.

The statement accurately describes the cryptographic trust model underlying SAML federation. In a typical SAML configuration, the Identity Provider (IdP) authenticates the user and issues a SAML assertion. The Service Provider (SP) validates the assertion, particularly its digital signature, by using certificate/public-key information associated with the trusted IdP. Private keys remain protected by their owners; the corresponding certificates containing public keys can be exchanged through configuration or SAML metadata.

For Identity Security Cloud operating as a SAML Service Provider, SailPoint requires administrators to obtain the IdP's signing certificate and configure it in Identity Security Cloud. SailPoint also provides Service Provider metadata that can be supplied to the IdP. This establishes the federation relationship and allows the participating systems to validate SAML messages according to the configured trust model. The critical concept is that passwords are not shared between the IdP and SP. Authentication assertions are trusted because they originate from an established federation partner and can be cryptographically validated.

Study Guide Reference: Access Management — Authentication Methods, SAML Federation, Identity Provider and Service Provider Trust.

===============

This proposed API call is not valid for retrieving Virtual Appliance connector logs. The identifier shown in the log entry is a managed-cluster ID , yet the proposed URL incorrectly places that ID under the /v3/sources/ API resource. Managed clusters and sources are separate Identity Security Cloud objects and use different API endpoints.

SailPoint's documented Managed Clusters API provides operations for obtaining cluster details and for retrieving or modifying the cluster's log configuration , such as GET /managed-clusters/{id}/log-config and PUT /managed-clusters/{id}/log-config. It does not document a GET /v3/sources/{managedClusterId}/logs endpoint for exporting VA connector log files.

For connector troubleshooting, enhanced logging can be enabled against the appropriate managed cluster, the problematic operation reproduced, and the resulting VA/connector logs collected through the supported VA troubleshooting process. The administrator must also ensure that the correct cluster associated with the affected source is being investigated.

Therefore, the proposed endpoint confuses a managed cluster with a source and does not represent a supported log-export API.

Study Guide Reference: Virtual Appliances — Managed Clusters, Connector Logging, VA Troubleshooting and SailPoint REST APIs.

===============

This approach is valid because Identity Security Cloud supports search-driven certification campaigns focused specifically on access items. An administrator can select Access Items , choose All Access Items Returned by a Query , and use Search to identify privileged entitlements, access profiles, or roles. The privileged:true field is supported for access-item data and identifies access designated as privileged. Identities possessing the selected access items are then included in the campaign.

The reviewer configuration also meets the requirement. For appropriate search-based certification types, Manager can be selected as the reviewer. Identity Security Cloud then assigns each identity's access review to that identity's manager. Therefore, managers review the privileged access belonging to their own subordinates rather than having a single central certifier review the entire population. If an identity has no manager, SailPoint provides fallback handling by assigning the certification to the campaign creator.

This combines privileged-access filtering with manager-based governance and directly satisfies the scenario.

Study Guide Reference: Supporting Governance — Search-Based Certification Campaigns, Access Item Certifications, Privileged Access and Manager Reviews.

===============