SailPoint Updated Identity-Security-Administrator Exam Questions and Answers by tomi

The statement is incorrect because it confuses the responsibilities of an Identity Provider with those of a Service Provider. In a federated authentication architecture, the Identity Provider, commonly called the IdP, is responsible for authenticating the user and issuing trusted identity or authentication information.

The Service Provider is the system, application, or service that the user is attempting to access. It relies on the authentication assertion provided by the IdP and determines whether the authenticated user can access the requested resource.

For example, when Identity Security Cloud is configured to use SAML federation, an external IdP can authenticate the user. The IdP then sends a signed SAML assertion to Identity Security Cloud. Identity Security Cloud acts as the Service Provider and provides the application functionality after accepting the trusted authentication information.

Therefore, the component that offers the application or service is generally the Service Provider, not the Identity Provider. The IdP establishes identity and provides authentication assertions.

Study Guide Reference: Access Management — Federated Authentication, Identity Providers, Service Providers, SAML Authentication.

===============

1. Define what values are needed to onboard a user in a managed system.

Select a match:

Create Account

2. Update an identity's phone number in Active Directory.

Select a match:

Attribute Sync

3. Customizable logic to match an account to an existing identity.

Select a match:

Correlation Rule

4. Supports user management in Active Directory.

Select a match:

IQService

The correct mappings correspond directly to the functions of SailPoint Identity Security Cloud provisioning and integration components. Create Account defines the account attributes and values that Identity Security Cloud uses when provisioning a new account on a managed source. SailPoint states that the Create Account configuration specifies which attributes are populated and how their values are determined.

Attribute Sync keeps account attributes on a target source synchronized with identity attributes. Therefore, if an identity's mapped phone-number attribute changes, Attribute Sync can provision the corresponding change to Active Directory.

A Correlation Rule provides customizable logic for matching source accounts to existing identities when straightforward attribute correlation is insufficient. Correlation fundamentally determines which identity owns a source account.

Finally, IQService is SailPoint's Windows service used with Active Directory to support provisioning and Windows-specific management operations. SailPoint explicitly requires IQService for Active Directory provisioning and related Windows functionality.

Study Guide Reference: Provisioning — Create Account; Attribute Sync; Account Correlation; IQService and Active Directory Integration.

The statement is not accurate as written. Configuration Hub restoration does use a draft , but an administrator cannot simply add arbitrary missing configuration objects to an existing draft through the normal draft-editing process.

The supported restoration workflow is to select the required backup, create a deployment draft, review the differences between the backup and the live tenant, optionally edit supported object details or remove objects that should not be deployed, and then deploy the draft. Configuration Hub automatically evaluates dependencies and identifies reference issues while preparing the draft.

Current SailPoint documentation specifically states that administrators can edit JSON definitions of existing draft objects or remove objects/object types. If an administrator removes an object from the draft and later discovers that this was a mistake, the supported action is to create a new draft from the backup and start again . There is no general "add missing object" operation to repopulate an existing draft.

Therefore, reviewing the draft is correct, but the proposed mechanism of editing and adding missing objects makes the overall statement invalid.

Study Guide Reference: Platform — Configuration Hub, Backups, Configuration Drafts and Restoring Tenant Configuration.

===============

The statement is correct. In SAML federation, the Entity ID uniquely identifies a participant in the trust relationship. When Identity Security Cloud is configured to use an external Identity Provider, the Identity Provider Entity ID entered in SailPoint must correspond to the EntityID specified in the IdP's SAML metadata.

This identifier helps Identity Security Cloud determine which trusted Identity Provider issued the authentication assertion. If the configured Entity ID does not match the expected IdP identifier, authentication processing can fail because the received federation information does not correspond to the configured trust relationship.

Administrators must also configure other SAML components correctly, including the Identity Provider login endpoint and signing certificate. The signing certificate enables Identity Security Cloud to validate the authenticity and integrity of SAML assertions received from the IdP.

It is also important to distinguish between the IdP Entity ID and the Identity Security Cloud Service Provider Entity ID. Each identifies a different side of the SAML relationship.

Study Guide Reference: Access Management — SAML Authentication, Identity Provider Configuration, Entity IDs and Federation Trust.

===============