SailPoint Identity-Security-Administrator Dumps Questions Answers

The statement is false. Identity Security Cloud distinguishes between defining an identity attribute for the tenant and mapping that attribute within a specific identity profile. When an administrator creates a new custom identity attribute from the mappings configuration of an identity profile, the attribute itself becomes available across all identity profiles in the tenant .

SailPoint explicitly states that any identity attribute added under any identity profile appears in all identity profiles. However, administrators do not have to map or use that attribute in every profile. Each identity profile can define its own mapping because different identity populations can obtain attribute values from different authoritative or secondary sources.

For example, a custom Employee Region attribute could be mapped from an HR source for employees while being mapped from Active Directory for contractors—or left unmapped in a profile where it is unnecessary. This distinction is essential: the attribute definition is tenant-wide, whereas the mapping and resulting value are identity-profile-specific.

Therefore, claiming that the custom attribute applies only to the identity profile where it was created is incorrect.

Study Guide Reference: Identity and Lifecycle Management — Identity Profiles, Custom Identity Attributes and Attribute Mappings.

===============

The statement is incorrect. Identity Security Cloud does not automatically transfer a departed reviewer's certification responsibilities to that reviewer's manager merely because of the reporting relationship. Certification ownership is explicitly assigned, and the authorized replacement process is reassignment rather than implicit managerial inheritance.

If the original reviewer cannot finish a certification, an administrator can reassign that pending certification to another qualified identity. Identity Security Cloud validates the reassignment to prevent the new reviewer from certifying their own access. A manager can also configure work reassignment for their team members when that functionality is enabled, but that still establishes an explicit reassignment rather than granting the manager unrestricted authority to enter every certification belonging to the employee.

After a campaign deadline, administrators also have campaign-level options for resolving undecided items, including completing the campaign according to the configured maintain-or-revoke behavior.

Therefore, the correct response to a departed reviewer is to use supported reassignment or campaign-completion procedures, not assume the reviewer's manager automatically acquires all pending certifications.

Study Guide Reference: Supporting Governance — Certification Reassignment, Work Reassignment, Campaign Deadlines and Reviewer Responsibilities.

===============

This is a valid description of Separation of Duties (SoD) as an identity-governance control. SoD policies define combinations of access that should not be held by the same identity because combining those privileges could enable fraud, unauthorized transactions, or circumvention of internal controls. A detective implementation analyzes existing access and identifies identities that already violate a defined policy, allowing administrators to investigate, mitigate, revoke access, or document an approved exception.

Preventive policy evaluation applies the same governance principle before problematic access is granted. During an access-request or provisioning process, the proposed access can be evaluated against policy rules so that a potential conflict is identified before the access change is completed. SailPoint documents SoD policies as conflicting-access definitions and also documents preventive policy evaluation in its governance model. These controls provide measurable evidence that an organization is actively enforcing access-risk policies rather than merely documenting them.

Study Guide Reference: Supporting Governance — Separation of Duties, Policy Rules, Detective and Preventive Controls.

===============