SailPoint SailPoint Professional Identity-Security-Administrator New Questions

Yes. Checking these mapped attributes is a primary troubleshooting action for an Identity Exception. Identity Security Cloud defines User Name (uid) , Work Email (email) , and Last Name (lastname) as required identity attributes. Every identity profile must contain mappings for these attributes, and none of the resulting identity values can be null. User Name carries the additional requirement of being unique across identities in the tenant.

When an authoritative-source account is missing one or more required values during aggregation, Identity Security Cloud generates an Identity Exception instead of creating the identity normally. A duplicate User Name can also produce an exception. The administrator should therefore inspect the Identity Exceptions report, identify which required attribute is absent or invalid, and verify the corresponding source-account data and identity-profile mappings.

SailPoint's documented remediation is to correct the problematic source information and then aggregate the source again, either manually or through the next scheduled aggregation. If direct mapping cannot generate a required value, a transform or supported rule can derive it.

Study Guide Reference: Identity and Lifecycle Management — Identity Profiles, Required Identity Attributes, Identity Exceptions and Attribute Mappings.

===============

Resetting the source and re-aggregating users is not the appropriate initial remediation. Aggregation is primarily an inbound data collection process: it reads account information from the source into Identity Security Cloud. It does not, by itself, perform the outbound disable operation that should occur when an identity enters the Terminated lifecycle state.

The administrator should first verify that the affected identities actually entered the expected lifecycle state and that the Terminated lifecycle-state configuration specifies that the database source account is to be disabled. SailPoint allows a lifecycle state to enable, disable, or delete accounts on selected sources. The source must also support the required account-disable operation.

The administrator should then review provisioning/account activity for failures and validate that provisioning is enabled and operating correctly for the database connector. Re-aggregation could later be useful to confirm the source's actual account state, but resetting the entire source is unnecessarily disruptive and does not correct the root cause of a failed lifecycle provisioning operation.

Therefore, the proposed troubleshooting action does not directly address why the Terminated lifecycle event failed to disable the account.

Study Guide Reference: Provisioning — Lifecycle-State Provisioning, Account Disable Operations, Provisioning Troubleshooting and Source Aggregation.

===============

The statement correctly describes Identity Security Cloud's default self-approval prevention behavior when the requester is assigned as an individual reviewer . SailPoint does not normally permit a person to approve their own access request. This applies whether the request is submitted directly for themselves or whether the affected access recipient otherwise appears as a reviewer in the approval sequence.

When the requester or recipient is assigned an approval directly as an individual, Identity Security Cloud automatically reassigns that review responsibility to the individual's manager . If a valid manager is unavailable, the system can continue through alternative fallback mechanisms, eventually reaching an administrator when necessary.

There is an important distinction for Governance Groups: if the requester belongs to a Governance Group configured as reviewer, the requester is normally omitted while other group members remain eligible to approve. Only when that user is effectively the group's sole valid reviewer does manager reassignment occur.

An optional API setting can permit auto-approval for individual reviewers, but the default behavior described by the scenario is manager reassignment.

Study Guide Reference: Access Management — Preventing Self-Approval, Approval Reassignment, Manager Review and Access Request Governance.

===============

The statement correctly describes the standard escalation behavior represented by the access-request escalation model. Identity Security Cloud can automatically escalate an approval when the assigned reviewer fails to act within the configured timeframe. This prevents an access request from remaining indefinitely with an unavailable or unresponsive approver.

Under the standard escalation pattern, the first and second escalations can route the request to successive manager levels of the assigned reviewer. The third escalation routes the approval to the configured fallback approver. Administrators control escalation timing, frequency, escalation reviewers, and fallback behavior through approval settings. This mechanism operates alongside reminder notifications and request timeout controls.

The fallback approver is particularly important because it provides a final governance path when ordinary escalation cannot resolve the request. SailPoint's current documentation explicitly describes the first two manager escalations followed by a third escalation to the fallback approver when custom approval settings are not configured.

Study Guide Reference: Access Management — Access Requests, Global Reminder and Escalation Policy, Approval Escalation and Fallback Approvers.

===============