SailPoint Updated Identity-Security-Administrator Exam Questions and Answers by alya

The statement is false. Identity Security Cloud distinguishes between defining an identity attribute for the tenant and mapping that attribute within a specific identity profile. When an administrator creates a new custom identity attribute from the mappings configuration of an identity profile, the attribute itself becomes available across all identity profiles in the tenant .

SailPoint explicitly states that any identity attribute added under any identity profile appears in all identity profiles. However, administrators do not have to map or use that attribute in every profile. Each identity profile can define its own mapping because different identity populations can obtain attribute values from different authoritative or secondary sources.

For example, a custom Employee Region attribute could be mapped from an HR source for employees while being mapped from Active Directory for contractors—or left unmapped in a profile where it is unnecessary. This distinction is essential: the attribute definition is tenant-wide, whereas the mapping and resulting value are identity-profile-specific.

Therefore, claiming that the custom attribute applies only to the identity profile where it was created is incorrect.

Study Guide Reference: Identity and Lifecycle Management — Identity Profiles, Custom Identity Attributes and Attribute Mappings.

===============

This is a valid troubleshooting approach. An Active Directory provisioning failure such as "There is no such object on the server" indicates that the connector attempted an operation against an object or directory reference that Active Directory could not resolve. Potential causes include an account or group being deleted or moved, an outdated distinguished name, an invalid entitlement reference, replication timing, or a provisioning operation targeting an object that no longer exists.

Searching SailPoint's technical knowledge and community resources for the exact connector error is therefore useful because connector-specific errors often have previously documented causes, configuration considerations, and remediation patterns. This should complement—not replace—tenant-side investigation. An administrator should correlate the error with provisioning activity, source information, account state, and the target system. Identity Security Cloud provides Search and audit information for investigating provisioning activity, while SailPoint technical resources provide additional connector-specific context. Current SailPoint documentation explicitly identifies provisioning activity as auditable and searchable.

Study Guide Reference: Provisioning — Troubleshooting Provisioning Errors, Active Directory Connector Operations, SailPoint Support Resources.

===============

The statement is incorrect. Identity Profiles remain administratively manageable after identities have been created from their associated authoritative sources. Administrators can edit supported Identity Profile properties, including identity attribute mappings, lifecycle-related configuration, ownership information, and other profile settings. When a change affects identity data, Identity Security Cloud marks the profile as requiring processing, and the administrator can use Apply Changes to recalculate affected identities.

Identity Profiles can also be managed programmatically. SailPoint exposes APIs for updating and deleting Identity Profiles. Some fields have restrictions—for example, system-generated properties cannot be modified, and changes to authoritative-source configuration and identity-attribute configuration have specific processing constraints—but the existence of identities under the profile does not make the profile permanently immutable. The V3 API explicitly provides both update and delete Identity Profile operations.

Because at least the assertion that administrators cannot modify an Identity Profile after identities are assigned is demonstrably false, the overall proposed statement is false.

Study Guide Reference: Identity and Lifecycle Management — Identity Profiles, Editing Identity Profiles, Processing Identity Changes and Identity Profile Administration.

===============

The statement correctly describes Identity Security Cloud's default self-approval prevention behavior when the requester is assigned as an individual reviewer . SailPoint does not normally permit a person to approve their own access request. This applies whether the request is submitted directly for themselves or whether the affected access recipient otherwise appears as a reviewer in the approval sequence.

When the requester or recipient is assigned an approval directly as an individual, Identity Security Cloud automatically reassigns that review responsibility to the individual's manager . If a valid manager is unavailable, the system can continue through alternative fallback mechanisms, eventually reaching an administrator when necessary.

There is an important distinction for Governance Groups: if the requester belongs to a Governance Group configured as reviewer, the requester is normally omitted while other group members remain eligible to approve. Only when that user is effectively the group's sole valid reviewer does manager reassignment occur.

An optional API setting can permit auto-approval for individual reviewers, but the default behavior described by the scenario is manager reassignment.

Study Guide Reference: Access Management — Preventing Self-Approval, Approval Reassignment, Manager Review and Access Request Governance.

===============