SailPoint Identity Security Engineer Certification Sample Questions

01. An identity security team is documenting the governance controls available to it in Identity Security Cloud. An engineer joining the team asks how the separation-of-duties work is tracked from day to day, and where the list of things somebody has to act on actually comes from.
What is a separation-of-duties violation?
a) One identity holding access from both sides of a combination the policy says must not be held.
b) An access request that was stopped before it could create the combination.
c) A request for access that reached an account before the named approver in the chain had released it.
d) A campaign item that a reviewer has marked for revocation but has not yet signed off on, so the identity still holds it.

02. A manager approved an access request three days ago. The requester reports that the access still does not work. The source involved uses a connector that cannot write to the target system. What is the most likely explanation?
a) The approval did not save, because an approved request grants the access at the moment of approval
b) The request expired, because an approved request must be provisioned within a fixed window
c) The role was not assigned, because approval only records a decision about a role's criteria
d) The provisioning work is waiting on a manual action, because the connector cannot write

03. An insurer assigns a birthright role by criteria to every identity whose department attribute names the claims unit. A claims adjuster who joined last week has an identity carrying the right department value, and she has none of the access that role grants.
The engineer holds two hypotheses: the role never became assigned to her, or the role is assigned and provisioning has not reached her accounts.
Which observation settles which hypothesis is in play?
a) The claims source's account schema does not define the entitlements that the role's access profile bundles.
b) The role does not appear among the access currently assigned to her identity.
c) An approval on her request for the role is still outstanding.
d) Her lifecycle state is active rather than leaver.

04. A pharmaceutical company's platform team is asked for a list of identities broken down by the cost centre recorded against each person in the HR system. The cost centre is on every HR record and the team can see it in the HR system itself, but a search of the tenant for it comes back with nothing at all: not a mismatch and not an empty value, but no such thing to search on.
What best explains what the team is seeing?
a) Identity profile priority favours another authoritative source, so that source's value for cost centre is the one winning here.
b) The search has not caught up with the most recent aggregation of the source, so the value will appear once it does.
c) Cost centre is not among the attributes that the HR source brings in and the identity profile populates.
d) The source is aggregated but not authoritative, so what it holds stays invisible to search until it is made authoritative.

05. An organization must show that a small set of highly privileged entitlements is still appropriate for each holder, and it must be able to do that far more often than its annual review of everything else. How should the campaign be scoped?
a) To every identity holding any access on the systems those entitlements belong to
b) To those entitlements, reviewed by someone who knows what they grant
c) To all accounts on the systems concerned, reviewed by the source owner
d) To each manager's direct reports and the access they hold

06. A platform team reports intermittent failures when executing workflows. Some actions complete successfully, while others fail without clear errors. Engineers need to identify where failures occur, confirm execution order, and validate access permissions for workflow actions.
Where should engineers look to determine which workflow step failed?
a) The account schema of the systems it writes to
b) The execution history recorded for each run of the workflow
c) The certification records covering the identities the workflow acted on
d) The identity attributes on the identities it acted on

07. An organization governs an Active Directory domain and a relational database, both reached through the same on-premises virtual appliance. Directory aggregation succeeds on every run. Database aggregation has begun failing intermittently, with no change to the appliance or to the network.
What is the most likely cause?
a) Something specific to the database source's own connection settings or credentials
b) The identity profile priority between the two sources is in conflict
c) The appliance has lost its connection to the tenant
d) Certification campaigns have not been created for the database source, so its aggregated data is never refreshed

08. A logistics company provisions accounts on a warehouse management system through a source in ISC. A supervisor's role assignment drove provisioning overnight, and ISC reports no failure on the provisioning operation for her account. The warehouse system's administrators confirm that no account for her exists there this morning.
What should the engineer establish next?
a) Resubmit the access request so provisioning runs a second time.
b) Reconfigure the source's connector to authenticate with a service account that holds create permission on the warehouse system, then provision again.
c) Establish whether the operation was dispatched to the connector or raised as a manual action for a person to complete.
d) Review the approval history on the request and confirm every approver responded.

09. A source supplies a value that needs two ordinary manipulations before it is written to an identity attribute: the surrounding spaces removed, and the result put into lower case. How does an engineer apply both manipulations to that one attribute value?
a) Write a cloud rule that performs both manipulations, because a transform applies only one operation to a value
b) Nest the transforms, so that one transform's output becomes the other's input
c) Apply both manipulations inside the source's account schema definition
d) Run a workflow after each aggregation that rewrites the value held on the identity

10. A facilities system holds a record for every person on site, including visitors who appear in no HR feed. Its records are typed in by site staff, carry no stable identifier and are frequently duplicated. The security team would like the visitors to appear as identities.
What is the correct way to onboard this system?
a) As an authoritative source at the lowest identity profile priority, so that HR values overwrite its own where they conflict
b) Not at all, because a source whose records carry no stable identifier cannot be aggregated into the tenant
c) As an authoritative source, with the security team reconciling duplicate records by hand after each aggregation
d) As a non-authoritative source, until visitors have a system of record with a stable identifier