Identity-Security-Administrator Premium Exam Questions

Yes. Removing the @entitlements(name:Manager_Access) portion produces a valid identity-oriented query structure. Identity Search supports the @access(...) nested object because an identity can possess multiple access items. SailPoint specifically documents @access(displayName:...) for identifying identities that possess a named access item and @access(source.name:...) for locating identities whose access originates from a particular source. Nested access queries can be combined with ordinary identity fields by using Boolean operators.

The remaining query therefore applies three conditions correctly: the identity must have been created during the specified 24-hour range, and the identity must satisfy either the New_Hire_Access condition or the Acme_HRMS source-access condition.

The problem with the original expression is the @entitlements(...) nested object. In SailPoint's searchable data models, @entitlements is used when examining objects such as access profiles or roles that contain entitlements; it is not the appropriate nested object for identity-level access searches. Identity-level entitlement holdings are searched through @access(...).

Study Guide Reference: Platform — Search, Nested Queries, Identity Access Fields and Boolean Query Construction.

===============

The statement does not accurately describe how governance-group approval and escalation operate. When a governance group is configured as an approver, the request is associated with the group's members, and a member of that governance group can perform the approval on behalf of the group. The system is not designed to send the request exclusively to the manager of one active group member.

Escalation behavior is also broader than the proposed statement suggests. SailPoint documents that when governance-group approvals are escalated to a manager level, the request can be escalated to each member's manager . If a particular member does not have a manager, that member's approval can remain assigned while other members' assignments are escalated. If none of the members has a manager, the applicable approvals can progress to the configured fallback approver.

Therefore, "only to the manager of an active member" incorrectly reduces a multi-member governance-group escalation process to one manager and does not reflect the documented routing behavior.

Study Guide Reference: Access Management — Governance Group Approvals, Escalation Chains, Access Request Reviewers.

===============

This statement is correct and closely matches SailPoint's official definition of a source. Identity Security Cloud does not treat an external enterprise system itself as being physically contained within the tenant. Instead, it creates a source definition representing that application, database, directory, HR system, or other managed environment.

The source definition supplies the governance context through which Identity Security Cloud interacts with the underlying system. A connector gathers account and access information and associates that data with the source. Identity Security Cloud can then correlate source accounts to identities, aggregate entitlements, model access, perform certifications, support access requests, and—in the case of writable connectors—provision changes back to the external system.

SailPoint's current source-management documentation explicitly defines a source as the Identity Security Cloud representation of a third-party enterprise application, database, or directory-management system maintaining its own user accounts or personnel records.

This distinction between source and connector is important: the source is the governed system representation, while the connector provides the technical mechanism used to communicate with that system.

Study Guide Reference: Sources — Source Definitions, Connector Definitions, Source Accounts and Enterprise System Integration.

===============

The statement accurately describes the cryptographic trust model underlying SAML federation. In a typical SAML configuration, the Identity Provider (IdP) authenticates the user and issues a SAML assertion. The Service Provider (SP) validates the assertion, particularly its digital signature, by using certificate/public-key information associated with the trusted IdP. Private keys remain protected by their owners; the corresponding certificates containing public keys can be exchanged through configuration or SAML metadata.

For Identity Security Cloud operating as a SAML Service Provider, SailPoint requires administrators to obtain the IdP's signing certificate and configure it in Identity Security Cloud. SailPoint also provides Service Provider metadata that can be supplied to the IdP. This establishes the federation relationship and allows the participating systems to validate SAML messages according to the configured trust model. The critical concept is that passwords are not shared between the IdP and SP. Authentication assertions are trusted because they originate from an established federation partner and can be cryptographically validated.

Study Guide Reference: Access Management — Authentication Methods, SAML Federation, Identity Provider and Service Provider Trust.

===============