Yes, SailPoint uses a proprietary fairness algorithm to manage and distribute workloads in its multi-tenant environment. This algorithm ensures that resources are allocated fairly among tenants, preventing any single tenant from consuming excessive resources at the expense of others. It helps maintain system performance and stability, balancing the processing load and providing equitable access to shared infrastructure in a multi-tenant setup.

References:

SailPoint IdentityNow Multi-Tenant Architecture Documentation.

SailPoint IdentityNow Resource Allocation and Fairness Algorithm Guide.

No, the Virtual Appliances (VAs) should not reside in A , which represents the SailPoint cloud environment. VAs are typically deployed in the on-premises network to interface directly with internal resources like Active Directory, databases, and applications. The cloud environment is where IdentityNow services are hosted, but the VAs need to be positioned closer to on-premise resources to manage identity synchronization and provisioning tasks.

Key Reference from SailPoint Documentation:

VA Placement Recommendations: Virtual Appliances are deployed in the on-premise network rather than the cloud, to ensure they have direct and secure access to internal resources.

The configuration provided is not valid due to an error in the server specification for Domain B . The server for Domain B (domainb.com) is incorrectly set to server.domaina.com , which is not correct. Each domain in the Active Directory (AD) forest should have its own respective server. For Domain B, the correct server should be something like server.domainb.com , assuming that there are distinct domain controllers for each domain.

Additionally, the search DN for Domain A appears to be valid as it correctly filters for employees with (employeeType=employee). The search DN for Domain B seems to be partially correct, as it targets the OU=Contingent Workers , but the issue lies with the incorrect server assignment.

Key Reference from SailPoint Documentation:

Active Directory Configuration: Each domain in a forest should be connected to its respective server, and incorrect server assignments between domains can cause LDAP search and synchronization issues. Proper domain controller assignment for both domaina.com and domainb.com is required.

Yes, the Virtual Appliances (VAs) should reside in C , which represents the on-premise network. In this scenario, the engineer has an Active Directory, a database server, and cloud applications. The VA needs to reside inside the internal on-premises network (C) to securely communicate with the Active Directory and database server. The VA will manage the secure connection to these internal resources and can also interact with cloud applications via SailPoint IdentityNow.

Key Reference from SailPoint Documentation:

VA Deployment in On-Prem Network: SailPoint advises deploying Virtual Appliances within the internal on-premises network where they can securely access identity sources like Active Directory and internal databases.

No, a user with Report-admin level permissions cannot view a live display of events in progress. The Report-admin role is primarily concerned with reporting functions, such as viewing and managing reports. Viewing live events, especially operational or real-time system events, would require higher-level permissions, typically associated with System Admin or Operations Admin roles, which have access to system dashboards, monitoring tools, and event logs.

References:

SailPoint IdentityNow Role-Based Access Control (RBAC) Documentation.

SailPoint IdentityNow Monitoring and Event Logging Permissions Guide.

Yes, this statement is correct. When setting up a Virtual Appliance (VA) cluster, SailPoint does indeed create an asymmetric key pair based on a user-provided passphrase . This key pair is used for secure communication between the Virtual Appliance and the IdentityNow tenant. The asymmetric encryption model uses a public-private key pair where the private key is stored securely within the VA, and the public key is shared with the IdentityNow tenant to establish a secure, encrypted communication channel. This setup ensures that data exchanged between the VA and the IdentityNow tenant remains protected.

References:

SailPoint IdentityNow Virtual Appliance Security Guide.

SailPoint IdentityNow Asymmetric Encryption and Key Management Documentation.

No, deleting the access profile is not the correct way to meet the requirement of removing approval for access requests. The access profile defines the entitlements and permissions that users can request for an application. Deleting it would remove the entire ability to request access, rather than just removing the approval workflow. The correct step would be to modify the approval settings in the access profile (as explained in Question 44), not to delete it.

Key Reference from SailPoint Documentation:

Access Profile Management: Modifying approval settings in the access profile is the appropriate step to meet management ' s new requirement, not deleting the profile itself.

No, this statement is incorrect. While IdentityNow does use TLS (Transport Layer Security) for securing data in transit , TLS is not a hashing algorithm; it is a protocol used for encryption to ensure secure communication over networks. Additionally, IdentityNow uses hashing algorithms for securely storing passwords and answers to security questions (e.g., SHA-256 or bcrypt), but it does not use TLS for hashing these values. Hashing algorithms are one-way functions that help store sensitive data securely by converting them into irreversible fixed-length representations.

TLS protects data during transmission by encrypting it, while hashing is used for securing stored data such as passwords.

References:

SailPoint IdentityNow Encryption and Security Practices Documentation.

SailPoint IdentityNow Password Hashing and Encryption Mechanisms Guide.

By default, not all emails generated from a SailPoint IdentityNow tenant are sent directly to the intended recipient. SailPoint IdentityNow provides an email testing mode (sandbox mode) where emails generated from the platform, such as access request notifications or password reset messages, can be routed to a specified test recipient instead of the actual intended users. This feature is commonly used during implementation or testing phases to verify email content and delivery without impacting real users.

Once the system is out of the testing phase and the email routing rules are removed, emails will be sent directly to their intended recipients. This ensures that email communications during testing do not reach end users prematurely.

Key Reference from SailPoint Documentation:

Testing Mode for Email Routing in IdentityNow: IdentityNow allows administrators to configure an email routing setting where all emails can be sent to a test inbox to ensure that email communications are functioning properly before going live to end users.

IQService does not run on the Virtual Appliance (VA). It is a separate service that must be installed on a Windows Server within the environment that has access to the target system, particularly for Active Directory and other Windows-based systems. IQService acts as a proxy between the IdentityNow tenant and these target systems, allowing operations such as password management and account provisioning to be executed on systems that do not support native connectors on the VA. It communicates with the VA but is not hosted on it.

References:

SailPoint IdentityNow IQService Installation Guide.

SailPoint IdentityNow Target Connector Architecture.