Career upgrade: Learn practical AI skills for better jobs and higher pay.
Level up
PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free ISC Engineer Practice Questions

Pass your SailPoint Certified Identity Security Cloud Engineer exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
~55-65% Pass Rate
100+ Questions
100% Free
1 / 100
Question 1
Score: 0/0

In ISC, what is 'Role Mining' and how does it help administrators?

A
B
C
D
to track
Same family resources

Explore More SailPoint Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

SailPoint Certified IdentityIQ Engineer

Practice Questions
2026 Statistics

Key Facts: ISC Engineer Exam

~60

Exam Questions

SailPoint

105 min

Exam Duration

SailPoint

70%

Passing Score

SailPoint

$250

Exam Fee

SailPoint

SaaS

Deployment Model

SailPoint-managed cloud platform

2 years

Certification Validity

SailPoint

The ISC Engineer exam has approximately 60 questions in 105 minutes with a 70% passing threshold. Key domains: VA architecture, source/identity configuration, access profiles and roles, lifecycle management, and certifications/workflows. Hands-on ISC/IdentityNow experience recommended. Exam fee is $250. Valid for 2 years.

Sample ISC Engineer Practice Questions

Try these sample questions to test your ISC Engineer exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1What is SailPoint Identity Security Cloud (ISC) and how does it differ from SailPoint IdentityIQ?
A.They are identical products — ISC is just a newer marketing name for IdentityIQ
B.ISC (formerly IdentityNow) is SailPoint's cloud-native SaaS identity governance platform; IdentityIQ is an on-premise product customers deploy and manage themselves
C.ISC is a mobile app version of IdentityIQ for remote access
D.ISC handles only privileged access management while IdentityIQ handles user provisioning
Explanation: SailPoint Identity Security Cloud (formerly IdentityNow) is a fully managed SaaS platform where SailPoint hosts and maintains the infrastructure, applies updates, and ensures availability. IdentityIQ is an on-premise product that customers deploy on their own servers and manage themselves. ISC offers faster deployment, automatic updates, and no infrastructure overhead — making it the recommended path for new SailPoint deployments.
2What is a 'Virtual Appliance' in SailPoint Identity Security Cloud?
A.A cloud-hosted virtual machine managed by SailPoint for customer data storage
B.An on-premise VM or Docker container deployed in the customer's environment that acts as a secure gateway between ISC's cloud platform and the customer's on-premise systems
C.A software-defined networking appliance that encrypts identity data in transit
D.A backup replica of the ISC cloud tenant hosted in the customer's data center
Explanation: The Virtual Appliance (VA) is a core ISC component deployed on-premise (as a VM or Docker container) in the customer's network. It establishes an outbound-only encrypted connection to SailPoint's cloud platform, enabling ISC to reach on-premise systems (Active Directory, databases, HR systems) without requiring inbound firewall ports. VAs are the bridge between ISC SaaS and on-premise resources.
3In ISC, what is a 'Source' and how does it relate to the Virtual Appliance cluster?
A.A log source that sends security events to SailPoint's analytics engine
B.A configured connection to a managed application or directory that ISC aggregates accounts and entitlements from, associated with a VA cluster for on-premise sources
C.A SailPoint-provided data feed of entitlement definitions for common SaaS applications
D.A network source IP range authorized to communicate with the ISC tenant
Explanation: In ISC, a Source is the equivalent of an Application in IdentityIQ — it defines a connection to a managed system (Active Directory, Workday, Salesforce, etc.) from which ISC aggregates accounts and entitlements. On-premise Sources (like AD) are associated with a VA cluster so the cloud platform can reach the on-premise system through the VA's outbound tunnel. Cloud SaaS Sources connect directly via the internet.
4What is an 'Identity Profile' in SailPoint ISC?
A.A user's personal profile page in the ISC end-user portal
B.A configuration that defines how identity attributes are mapped and transformed from authoritative sources, and which Source populates each identity attribute
C.A preconfigured certification template for reviewing a specific user's access
D.A network profile that defines how ISC communicates with the Virtual Appliance
Explanation: An Identity Profile in ISC defines how identity records are created and populated from Sources. It specifies the authoritative Source (typically an HR system), maps source attributes to ISC identity attributes (e.g., HR firstName maps to ISC first-name), applies transforms (formatting rules), and defines the identity attribute mapping rules. Each ISC identity must be associated with an Identity Profile that defines how its data is sourced and structured.
5What is the purpose of 'Transforms' in SailPoint ISC?
A.Converting ISC configuration data between JSON and XML formats for export
B.Applying data transformation logic (substring, concatenation, lookup, conditional) to source attributes before storing them in identity records
C.Transforming completed certification reports into PDF format for auditors
D.Converting on-premise Active Directory accounts to cloud-native ISC identities
Explanation: Transforms in ISC are configurable functions that manipulate attribute values during aggregation and identity attribute mapping. For example, a Transform can extract an employee ID from an email address (substring), concatenate first name and last name into a display name, convert an HR department code to a business-readable name, or apply conditional logic. They replace the need for custom code in many cases.
6In ISC, what is 'Role Mining' and how does it help administrators?
A.A tool for discovering and removing excessive roles that should be deprecated
B.An AI-powered analysis of existing access patterns to suggest role definitions based on common entitlement combinations across similar users
C.A process for extracting role definitions from IdentityIQ and importing them to ISC
D.A scheduled task that mines the ISC database for orphaned role assignments
Explanation: ISC's Role Mining uses AI/ML to analyze access data across the identity population, identifying clusters of users who share similar entitlement combinations. It suggests potential role definitions that reflect actual access usage patterns, enabling administrators to build a role catalog from empirical data rather than theoretical job descriptions. This accelerates role catalog creation and improves role coverage accuracy.
7What are 'Entitlement Descriptions' in ISC and why are they important for user adoption?
A.Technical schema definitions exported from Active Directory for engineering reference
B.Business-friendly text descriptions added to entitlements in the catalog so end users and managers can understand what access they are requesting or certifying
C.Legal compliance descriptions required for GDPR documentation of each entitlement
D.Metadata tags that describe the security risk level of each entitlement for SIEM correlation
Explanation: Entitlement Descriptions in ISC provide human-readable explanations of what each entitlement grants in business terms — e.g., 'Grants read access to the Q4 Finance reports folder in SharePoint' rather than 'cn=SP-Finance-Q4-R,ou=groups,dc=corp'. When users see meaningful descriptions in the Access Request catalog or during certification campaigns, they can make informed decisions about what to request or certify, improving governance quality.
8What is an 'Access Profile' in SailPoint Identity Security Cloud?
A.A user's personal preference settings in the ISC portal
B.A grouping of one or more entitlements from a single Source that represents a logical access set, usable as a building block in Roles
C.A security policy profile applied to ISC administrator accounts
D.The network access profile for the Virtual Appliance
Explanation: An Access Profile in ISC is a grouping of one or more entitlements from a single Source into a named, manageable access bundle. Access Profiles abstract individual entitlements into business-meaningful packages — e.g., an 'Salesforce Sales Rep' Access Profile groups the Salesforce 'Sales User' profile + 'Opportunity Read' + 'Account Read' entitlements. Access Profiles are used as building blocks within Roles and in Access Requests.
9How does ISC's 'Separation of Duties' (SoD) policy work in the context of ISC's data model?
A.SoD is enforced by the Virtual Appliance before entitlements are provisioned
B.SoD policies define conflicting combinations of Access Profiles or Entitlements; ISC detects violations during provisioning requests and certification campaigns and flags or blocks them
C.SoD automatically revokes one conflicting entitlement without notification when a conflict is detected
D.SoD is only available for Active Directory sources and not for SaaS applications
Explanation: ISC's Separation of Duties policies define pairs or sets of Access Profiles or Entitlements that should not be held by the same user simultaneously. When a user requests access that would create an SoD violation, the request can be blocked or flagged for exception approval. During certification campaigns, existing SoD violations are surfaced for reviewer action. SoD violations appear in the policy violation dashboard.
10What is the ISC 'Access Request' module and who can use it?
A.An emergency access request system available only to security administrators
B.A self-service portal where users can request Roles and Access Profiles for themselves or others, with configurable approval workflows governing each request
C.A module for requesting IdentityIQ licenses from SailPoint
D.A ticketing system that integrates exclusively with ServiceNow
Explanation: ISC's Access Request module provides a self-service catalog where users can browse and request Roles and Access Profiles. Requests trigger configurable approval workflows (manager approval, access owner approval, auto-approve for low-risk items). The module is accessible to end users for self-service requests and managers/admins for requesting on behalf of others. This replaces email-based access request processes.

About the ISC Engineer Exam

The SailPoint Certified Identity Security Cloud Engineer certification validates expertise in implementing and administering SailPoint Identity Security Cloud (formerly IdentityNow), SailPoint's cloud-native SaaS identity governance platform. It covers the Virtual Appliance architecture, Source configuration and correlation, Identity Profiles and Transforms, Access Profiles and Roles, lifecycle automation, SoD policies, AI Recommendations, certification campaigns, Workflows, and the REST API.

Questions

60 scored questions

Time Limit

105 minutes

Passing Score

70%

Exam Fee

$250 (SailPoint)

ISC Engineer Exam Content Outline

~20%

Architecture and Virtual Appliance

SaaS deployment model, VA installation and clustering, outbound-only connectivity, customer-managed vs. cloud connectors, VA priority and failover

~25%

Sources, Identity Profiles, and Transforms

Source configuration, schema, account correlation, entitlement aggregation, Identity Profiles, authoritative sources, Transforms, attribute mapping

~20%

Roles, Access Profiles, and Governance

Access Profiles, Roles hierarchy, Role Mining, AI Recommendations, SoD policies, Identity Risk Score, Outlier Analysis, protected access profiles

~20%

Lifecycle Management and Provisioning

Lifecycle States, access request approval workflows, provisioning configuration, password management, NERM, Governance Groups

~15%

Certifications, Workflows, and Admin

Certification campaign types, revocation, Workflows (event/schedule triggers), Event Trigger framework, REST API, tenant configuration, reporting

How to Pass the ISC Engineer Exam

What You Need to Know

  • Passing score: 70%
  • Exam length: 60 questions
  • Time limit: 105 minutes
  • Exam fee: $250

Keys to Passing

  • Complete 500+ practice questions
  • Score 80%+ consistently before scheduling
  • Focus on highest-weighted sections
  • Use our AI tutor for tough concepts

ISC Engineer Study Tips from Top Performers

1Understand the Virtual Appliance role deeply — know it is outbound-only, how clustering provides HA, and when VAs are required vs. direct cloud connectors
2Know the difference between Source Schema, Account Correlation, and Entitlement Aggregation — these are three separate but related setup steps
3Understand Identity Profiles — they define which Source is authoritative and how attributes are mapped into the ISC identity
4Master Transforms — know the common transform types (String, Substring, Concatenation, Conditional, Static) and their JSON structure
5Know Access Profiles vs. Roles — understand the hierarchy and how both are used in governance and access requests
6Understand Lifecycle States and how they trigger automatic provisioning — this is a core ISC feature that differentiates it from reactive governance
7Use the SailPoint Developer Portal (developer.sailpoint.com) — the REST API documentation is excellent exam preparation
8Get hands-on in an ISC trial tenant — the product is SaaS so no installation is needed to practice

Frequently Asked Questions

What is the SailPoint Identity Security Cloud Engineer certification?

The SailPoint Certified Identity Security Cloud Engineer validates expertise in implementing and operating ISC — SailPoint's cloud-native SaaS identity governance platform. It tests knowledge of Virtual Appliance deployment, Source configuration, Identity Profiles and Transforms, Access Profiles and Roles, Lifecycle States, certification campaigns, AI governance features, and Workflow/API automation.

How many questions are on the ISC Engineer exam?

The ISC Engineer exam has approximately 60 questions to be completed in 105 minutes. The passing score is 70%. Questions test both conceptual understanding and practical configuration knowledge, with scenario-based questions requiring judgment about the correct approach for common ISC implementation challenges.

What is an Access Profile in ISC and how does it differ from a Role?

An Access Profile groups one or more entitlements from a single Source into a named access bundle (e.g., 'Salesforce Sales User' groups the Salesforce profile and related permissions). A Role is a higher-level construct that bundles multiple Access Profiles from potentially multiple Sources into a job-function representation (e.g., 'Sales Representative' includes Salesforce + CRM + SharePoint Access Profiles). Access Profiles are building blocks; Roles aggregate them for business-aligned governance.

How do Lifecycle States automate identity provisioning?

Lifecycle States define the access lifecycle for identities. When an identity transitions between states (Pre-hire → Active on start date, Active → Terminated on end date), ISC automatically executes configured provisioning actions — granting appropriate access when going Active (create accounts, assign roles), and revoking all access when going Terminated. This automates the Joiner/Mover/Leaver process without manual IT intervention.

What does Non-Employee Risk Management (NERM) provide?

NERM provides a dedicated lifecycle management process for non-employees — contractors, vendors, consultants, and interns. Business sponsors can request non-employee access with defined start and end dates, manage renewals, and ISC automatically deprovisions access when the term ends. This addresses the governance gap where contractors often retain access long after their engagement ends.