SailPoint Updated Identity-Security-Administrator Exam Questions and Answers by jennifer

No. Current Identity Security Cloud behavior does not automatically assign sp:scopes:all when an administrator or user creates a Personal Access Token without explicitly selecting scopes. SailPoint documents that when no scopes are selected, the default scope is assigned. That default provides permission only for API endpoints that do not require authorization; it is not equivalent to unrestricted access under sp:scopes:all.

The sp:scopes:all scope must be intentionally selected when required. Even then, it does not grant arbitrary privileges beyond the token owner's authority. Instead, it authorizes API scopes that are available through the user levels assigned to the user who created the PAT. Consequently, PAT permissions remain bounded by that identity's effective Identity Security Cloud privileges.

This behavior supports the principle of least privilege. SailPoint recommends selecting only the scopes necessary for the application or integration using the token rather than broadly assigning sp:scopes:all.

Therefore, leaving all scope checkboxes unselected does not implicitly grant all available API scopes.

Study Guide Reference: Platform — Personal Access Tokens, OAuth/API Scopes, sp:scopes:all and Least-Privilege API Authentication.

===============

Resetting the source and re-aggregating users is not the appropriate initial remediation. Aggregation is primarily an inbound data collection process: it reads account information from the source into Identity Security Cloud. It does not, by itself, perform the outbound disable operation that should occur when an identity enters the Terminated lifecycle state.

The administrator should first verify that the affected identities actually entered the expected lifecycle state and that the Terminated lifecycle-state configuration specifies that the database source account is to be disabled. SailPoint allows a lifecycle state to enable, disable, or delete accounts on selected sources. The source must also support the required account-disable operation.

The administrator should then review provisioning/account activity for failures and validate that provisioning is enabled and operating correctly for the database connector. Re-aggregation could later be useful to confirm the source's actual account state, but resetting the entire source is unnecessarily disruptive and does not correct the root cause of a failed lifecycle provisioning operation.

Therefore, the proposed troubleshooting action does not directly address why the Terminated lifecycle event failed to disable the account.

Study Guide Reference: Provisioning — Lifecycle-State Provisioning, Account Disable Operations, Provisioning Troubleshooting and Source Aggregation.

===============