SailPoint Certified Identity Security Cloud Engineer

What is SailPoint Identity Security Cloud (ISC) and how does it differ from SailPoint IdentityIQ?

• AThey are identical products — ISC is just a newer marketing name for IdentityIQ
• BISC (formerly IdentityNow) is SailPoint's cloud-native SaaS identity governance platform;…
• CISC is a mobile app version of IdentityIQ for remote access
• DISC handles only privileged access management while IdentityIQ handles user provisioning

What is a 'Virtual Appliance' in SailPoint Identity Security Cloud?

• AA cloud-hosted virtual machine managed by SailPoint for customer data storage
• BAn on-premise VM or Docker container deployed in the customer's environment that acts as…
• CA software-defined networking appliance that encrypts identity data in transit
• DA backup replica of the ISC cloud tenant hosted in the customer's data center

In ISC, what is a 'Source' and how does it relate to the Virtual Appliance cluster?

• AA log source that sends security events to SailPoint's analytics engine
• BA configured connection to a managed application or directory that ISC aggregates account…
• CA SailPoint-provided data feed of entitlement definitions for common SaaS applications
• DA network source IP range authorized to communicate with the ISC tenant

What is an 'Identity Profile' in SailPoint ISC?

• AA user's personal profile page in the ISC end-user portal
• BA configuration that defines how identity attributes are mapped and transformed from auth…
• CA preconfigured certification template for reviewing a specific user's access
• DA network profile that defines how ISC communicates with the Virtual Appliance

What is the purpose of 'Transforms' in SailPoint ISC?

• AConverting ISC configuration data between JSON and XML formats for export
• BApplying data transformation logic (substring, concatenation, lookup, conditional) to sou…
• CTransforming completed certification reports into PDF format for auditors
• DConverting on-premise Active Directory accounts to cloud-native ISC identities

In ISC, what is 'Role Mining' and how does it help administrators?

• AA tool for discovering and removing excessive roles that should be deprecated
• BAn AI-powered analysis of existing access patterns to suggest role definitions based on c…
• CA process for extracting role definitions from IdentityIQ and importing them to ISC
• DA scheduled task that mines the ISC database for orphaned role assignments

What are 'Entitlement Descriptions' in ISC and why are they important for user adoption?

• ATechnical schema definitions exported from Active Directory for engineering reference
• BBusiness-friendly text descriptions added to entitlements in the catalog so end users and…
• CLegal compliance descriptions required for GDPR documentation of each entitlement
• DMetadata tags that describe the security risk level of each entitlement for SIEM correlat…

What is an 'Access Profile' in SailPoint Identity Security Cloud?

• AA user's personal preference settings in the ISC portal
• BA grouping of one or more entitlements from a single Source that represents a logical acc…
• CA security policy profile applied to ISC administrator accounts
• DThe network access profile for the Virtual Appliance

How does ISC's 'Separation of Duties' (SoD) policy work in the context of ISC's data model?

• ASoD is enforced by the Virtual Appliance before entitlements are provisioned
• BSoD policies define conflicting combinations of Access Profiles or Entitlements; ISC dete…
• CSoD automatically revokes one conflicting entitlement without notification when a conflic…
• DSoD is only available for Active Directory sources and not for SaaS applications

What is the ISC 'Access Request' module and who can use it?

• AAn emergency access request system available only to security administrators
• BA self-service portal where users can request Roles and Access Profiles for themselves or…
• CA module for requesting IdentityIQ licenses from SailPoint
• DA ticketing system that integrates exclusively with ServiceNow

How does ISC's Virtual Appliance cluster handle high availability?

• AA single VA is sufficient — ISC automatically replicates the VA in its cloud
• BTwo or more VAs form a cluster; if one VA becomes unavailable, ISC automatically routes o…
• CVA high availability requires a hardware load balancer purchased separately
• DVA failover requires SailPoint support intervention to redirect connections

What is the 'Lifecycle States' feature in SailPoint ISC and how does it automate provisioning?

• AA workflow timer that schedules certification campaigns based on account age
• BPredefined states (Active, Inactive, Pre-hire, Terminated) that trigger automatic access…
• CA version control system for ISC configuration changes
• DStates that control which ISC features are available during different lifecycle phases of…

What is the 'Certification Campaign' feature in ISC and what types does it support?

• AA marketing certification for SailPoint ISC partners and resellers
• BA structured access review process; ISC supports Manager, Entitlement Owner, Source Owner…
• CAn automated compliance report run quarterly for SOX auditors
• DA certification that ISC's VA cluster is configured correctly

What is the ISC REST API and how do engineers use it?

• AA read-only API for generating ISC reports — it cannot modify configuration
• BA full-featured REST API with OAuth 2.0 authentication for programmatically managing iden…
• CAn API available only to SailPoint's internal engineering teams
• DA legacy API compatible only with IdentityIQ connectors

What is the 'Provisioning Configuration' on an ISC Source and what does the 'Create Account' option enable?

• AA configuration that limits which IdentityIQ rules can create accounts on the source
• BSettings that control what provisioning operations ISC can perform on the source — enabli…
• CA network configuration that defines how the VA connects to create accounts on the source
• DA licensing option that unlocks the provisioning feature for that source

In ISC, what does the 'Priority' setting on a VA cluster affect?

• AThe processing order of access requests within the cluster
• BWhich VA cluster processes aggregation and provisioning operations for Sources assigned t…
• CThe network QoS priority for VA-to-cloud communication
• DThe order in which certification campaign notifications are sent to VAs

What is ISC's 'Recommendation Engine' (AI Recommendations) and how does it help in certification campaigns?

• AA chatbot that recommends which users should request specific roles
• BAn AI/ML model that analyzes peer group access, historical certification decisions, and u…
• CA rule engine that automatically approves all entitlements below a configurable risk thre…
• DAn external AI service that customers must subscribe to separately

What is a 'Connector Rule' in ISC and how does it differ from a Transform?

• AThey are identical — Connector Rules and Transforms are two names for the same feature
• BConnector Rules are BeanShell scripts executed in the context of connector operations (be…
• CConnector Rules modify network routing; Transforms modify data content
• DConnector Rules are for cloud sources; Transforms are for on-premise sources only

What is ISC's 'Workflow' feature and what triggers workflows can be configured?

• AWorkflows are only triggered manually by administrators — automatic triggers are not supp…
• BISC Workflows are automated business processes triggered by events (identity attribute ch…
• CISC Workflows exclusively handle email notifications — provisioning is handled by a separ…
• DISC Workflows replace Virtual Appliance connectivity for on-premise sources

What is the purpose of ISC's 'Source Aggregation' schedule and what are the two types of aggregation it supports?

• ASource Aggregation is only manual — ISC does not support scheduled aggregation
• BISC supports Full Aggregation (reads all accounts from a source) and Delta Aggregation (r…
• CSource Aggregation runs only once when a source is initially configured
• DISC aggregates only entitlements on a schedule; account data must be imported via CSV

What is ISC's 'Provisioning Policy' in the context of ISC Sources and Access Profiles?

• AA network security policy controlling which ISC tenants can provision to a source
• BConfigurable rules and forms that define required fields and validation when creating or…
• CA policy that limits the number of users who can be provisioned to a source per day
• DAn SLA policy defining how quickly provisioning requests must be completed

What is the ISC 'Governance Group' (formerly Work Group) and how is it used?

• AA group of ISC administrators who review and approve platform configuration changes
• BA named group of users in ISC that can be assigned as approvers, reviewers, or owners for…
• CA group of VA clusters that form a redundant provisioning domain
• DA SailPoint partner organization that provides governance consulting services

What is the ISC 'Entitlement Access Request' feature and how does it differ from 'Role Access Request'?

• AThey are the same — ISC does not distinguish between entitlement and role requests
• BEntitlement Access Request allows direct request of specific entitlements; Role Access Re…
• CEntitlement requests are for IT staff only; Role requests are for end users
• DEntitlement requests require no approval; Role requests require multi-level approval

How does ISC handle 'Password Management' for connected sources?

• AISC stores all user passwords in its cloud database for centralized management
• BISC can provide self-service password reset and synchronize password changes across conne…
• CISC cannot manage passwords — it only governs account access, not credentials
• DPassword management requires installing a separate SailPoint PasswordManager appliance

What is the ISC 'Reporting' module and what report categories does it include?

• AA separate purchased add-on for ISC analytics — not included in base licensing
• BBuilt-in reports covering identity access, certification activity, provisioning history,…
• CA read-only export of ISC's raw database tables for external BI tools
• DReports generated exclusively by the AI Recommendation Engine

What is the ISC 'Provisioning Channel' and what role does the VA play in it?

• AA communication channel between ISC and its customers' legal teams for provisioning agree…
• BThe pathway through which ISC sends provisioning commands to target systems — for on-prem…
• CA dedicated network VLAN created by ISC for provisioning traffic isolation
• DThe API channel used exclusively for REST-based SaaS provisioning, with no VA involvement

What is the ISC 'Outlier Analysis' (AI-based) and what does it detect?

• ANetwork outlier traffic patterns suggesting external attacks on ISC infrastructure
• BAI-powered analysis that identifies identities with access significantly different from t…
• CStatistical outliers in certification campaign completion times
• DAnomalies in VA cluster performance metrics

How are ISC 'Service Desk Integrations' (like ServiceNow) configured and what do they enable?

• AServiceNow integration requires installing a SailPoint plugin on the ServiceNow instance…
• BISC connects to ServiceNow via REST API to create, update, and close service tickets for…
• CServiceNow integration is available only for manual provisioning workflows, not automated
• DISC delegates all governance operations to ServiceNow when integrated

What is the ISC 'Privileged Access Management' integration (via CyberArk, BeyondTrust, or Delinea) used for?

• AISC replaces PAM tools entirely — no external PAM integration is needed
• BISC governs who should have privileged account access by integrating with PAM vault syste…
• CISC provides the PAM vault storage for privileged credentials
• DPAM integrations are only available in IdentityIQ, not ISC

What is the ISC 'Provisioning Approval Workflow' and how are approvers configured?

• AApproval workflows are fixed — ISC always requires one-level manager approval for all req…
• BISC supports flexible multi-level approval workflows configurable per Access Profile or R…
• CApproval workflows require coding BeanShell scripts for each request type
• DAll ISC provisioning operations are auto-approved — no approval configuration is needed

What is the ISC 'Tenant Configuration' and which settings are managed at the tenant level?

• AThe ISC Tenant Configuration is managed exclusively by SailPoint support
• BTenant-level settings control organization-wide behaviors including default approval poli…
• CTenant Configuration only stores the API client credentials for ISC integrations
• DTenant Configuration is a read-only view of SailPoint's standard ISC settings that cannot…

What is ISC's 'Non-Employee Risk Management' (NERM) capability?

• AA module for managing vulnerability risks on non-employee-owned devices
• BA dedicated governance capability for managing third-party contractors, vendors, and othe…
• CA report tracking the number of non-employee accounts in the organization
• DA feature that automatically disables all non-employee accounts after 90 days

What is the purpose of ISC 'Source Schema' configuration?

• ADefining the JSON schema for ISC's REST API responses
• BDefining which attributes ISC reads from a source during aggregation and how they map to…
• CConfiguring the SQL schema of ISC's backend database tables
• DDefining the network schema (IP ranges) for VA cluster communication

In ISC, what is an 'Account Correlation' configuration and what happens with uncorrelated accounts?

• AAccount Correlation defines which network protocol ISC uses to connect to accounts
• BAccount Correlation defines the matching rules linking application accounts to ISC identi…
• CAccount Correlation automatically deletes accounts that do not match any ISC identity
• DAccount Correlation is only relevant when multiple sources are connected — single-source…

What is the ISC 'Provisioning Completed' event trigger and how is it used in Workflows?

• AA trigger that fires when a user completes the ISC provisioning training course
• BA Workflow trigger that fires when a provisioning operation (create account, grant entitl…
• CA scheduled event that runs at the end of each business day to finalize pending provisions
• DA trigger exclusive to the ServiceNow integration that fires when a ServiceNow ticket is…

What is the ISC 'Entitlement Aggregation' task and why is it important?

• AA task that removes unused entitlements from the ISC catalog automatically
• BThe process of reading group/permission/role definitions from a source to populate the IS…
• CAn automated task that assigns entitlements to all new accounts based on their role
• DA task that synchronizes entitlement definitions between ISC and IdentityIQ

What is the ISC 'Dashboard' and what key metrics does it surface for administrators?

• AThe ISC Dashboard shows only VA cluster health and connectivity status
• BThe ISC Dashboard provides an at-a-glance view of governance health including certificati…
• CThe ISC Dashboard is identical to the end-user portal — there is no separate admin dashbo…
• DThe ISC Dashboard shows only licensing usage metrics for capacity planning

What is the ISC 'User Level' (formerly ISC Tiers) licensing model for connected sources?

• AISC charges per provisioning operation, not per source or user
• BISC licenses identities at different governance tiers — governing what governance feature…
• CISC is a flat-fee platform with unlimited sources and identities
• DISC charges per Certification Campaign run regardless of identity count

What is ISC's 'Search' capability and what data can be searched?

• AISC Search can only find identities by exact name match — partial search is not supported
• BISC provides a powerful full-text search and query interface across identities, access pr…
• CISC Search is only available to administrators — end users cannot search for access
• DISC Search is a separately licensed module not included in base ISC

What is the key difference in how ISC handles 'platform updates' compared to on-premise IdentityIQ?

• AISC customers must apply updates manually using the iiq console — it is identical to Iden…
• BSailPoint applies ISC platform updates automatically on a regular cadence — customers rec…
• CISC customers choose when to apply updates through a self-service upgrade portal requirin…
• DISC updates only occur once per year, unlike IdentityIQ's more frequent patch releases

In ISC, what is the 'Certification Revocation' process and what triggers it?

• ARevocation is immediate — as soon as a reviewer clicks Revoke, the account is deleted
• BWhen a reviewer marks an item Revoke, ISC generates a provisioning plan to remove the ent…
• CRevocation in ISC certifications is advisory only — no actual access change occurs
• DRevocation requires a second approver to confirm before any access is removed

What is an 'Authoritative Source' in ISC and what data should it provide?

• AThe source with the most accounts connected to ISC by volume
• BThe designated source (typically HR system) that provides trusted identity attributes — n…
• CThe first source chronologically added to the ISC tenant
• DA source designated by SailPoint that cannot be modified by customers

What is ISC's 'Protected Access Profile' setting and when should it be used?

• AA setting that encrypts the Access Profile definition to prevent viewing by end users
• BA flag that prevents users from revoking a critical Access Profile in a certification cam…
• CA setting that grants permanent irrevocable access to an Access Profile for specific users
• DA network protection setting that limits which VAs can provision the Access Profile

What is the purpose of ISC's 'Customer Managed Connection' (using the VA) vs. a direct cloud-to-cloud connector?

• ACustomer Managed Connections are more secure than cloud-to-cloud connectors in all cases
• BCustomer Managed Connections (via VA) are used for on-premise or private network systems;…
• CCustomer Managed Connections use more bandwidth, so they are only for large enterprises
• DDirect cloud-to-cloud connectors are deprecated — all connections should use VAs

What is ISC's 'Identity Risk Score' and how is it calculated?

• AA score imported from the organization's HR performance management system
• BAn automatically calculated score per identity based on access risk weights, policy viola…
• CA score that measures how frequently the identity's password fails complexity checks
• DA score determined by the number of certification campaigns a user has participated in

How does Identity Security Cloud extend identity governance to SaaS applications such as Salesforce, Microsoft 365, Workday, and ServiceNow?

• AISC replaces each SaaS application's native administration console with a SailPoint-hoste…
• BISC uses purpose-built SaaS connectors to aggregate accounts and entitlements, govern acc…
• CISC can only read SaaS application login events; it cannot govern entitlements
• DISC treats all SaaS applications as flat-file sources and imports them via CSV

What is the ISC 'Identity History' feature and how does it support compliance?

• AA log of the user's password change history for security audit purposes
• BA chronological record of all access changes for an identity — what was granted, revoked,…
• CA history of all failed login attempts for the identity across connected sources
• DA record of which ISC certification campaigns the identity participated in as a reviewer