Checked 18 October 2026. Questions and model answers written by ProSyllabus, checked 18 October 2026 against SailPoint’s prep guides and product documentation. Product names and features change; check the current documentation for screens and options.
We wrote 60 original interview questions for SailPoint roles, grouped by experience: 20 foundations, 20 practitioner and 20 experienced. Three are on this page with a short model answer, one for each level; the other 57 questions and their answers come with the practice exam. They cover identity governance ideas, IdentityIQ and Identity Security Cloud (formerly IdentityNow). They are our questions, not ones collected from any employer or exam, and the answers are starting points: an interviewer wants your own example behind each one. ProSyllabus is an independent study site, not affiliated with SailPoint. Every rule and price here is quoted or summarised from SailPoint’s own pages, read on 18 October 2026.
What SailPoint interviews test
The same areas recur across the blueprints SailPoint publishes for its role-based exams, and our questions follow them: identity governance basics (IGA, authentication versus authorization, compliance), onboarding sources and applications, correlation and aggregation, provisioning, roles and access profiles, certifications and separation of duties, rules, transforms and workflows, and for engineers the platform itself: virtual appliances or IdentityIQ installation, APIs and debugging. These are our study areas, not a list of what any employer asks.
| Level | Typical roles | What they probe |
|---|---|---|
| Foundations (0–2 years) | Analyst, junior engineer, support | Vocabulary and the joiner-mover-leaver story |
| Practitioner (2–5 years) | Implementation engineer, administrator | Onboarding, troubleshooting, campaign and policy design |
| Experienced (5+ years) | Senior engineer, architect, lead | Migrations, role models, performance, security and programme results |
Topics the 60 questions cover
| Topic | Questions | Product |
|---|---|---|
| Governance basics (IAM, IGA, least privilege, audit) | 1, 2, 10, 11, 16, 19 | Both |
| Sources, aggregation and correlation | 3, 4, 5, 12, 15, 21, 22 | Both |
| Lifecycle and provisioning | 6, 7, 13, 27, 31, 33, 34, 35, 37, 55 | Both |
| Roles and access modelling | 14, 20, 25, 47, 48 | Both |
| Certifications and separation of duties | 8, 9, 28, 29, 30, 36, 50 | Both |
| Identity Security Cloud specifics | 17, 23, 24, 26, 39, 40, 46 | Identity Security Cloud |
| IdentityIQ specifics | 42, 43, 44, 45, 52, 53, 59 | IdentityIQ |
| Programme, security and leadership | 18, 32, 38, 41, 49, 51, 54, 56, 57, 58, 60 | Both |
Our grouping. Some questions fit more than one topic; each is listed once.
Counts from the topic table above. Our grouping of our own questions.
What each level is asked about
Foundations (questions 1–20). These check that you can use the vocabulary correctly and tell the joiner-mover-leaver story without notes. Expect to be asked to tell apart ideas that sound alike: an identity and an account, an account and an entitlement, authentication and authorization, an access certification and an access request. A good answer at this level is short and exact, and ends with a one-line example from a real system, such as Active Directory or an HR feed.
Practitioner (questions 21–40). These move from what things are to how you make them work. The questions ask how you would onboard an application, what you do with accounts that do not correlate, how you design a certification campaign that reviewers take seriously, how you model separation of duties, and what you check when provisioning to a source fails. Interviewers at this level listen for a method: what you look at first, what you change, and how you prove the fix worked.
Experienced (questions 41–60). These are about judgement and scale. They cover migrations between products, role models that stay maintainable, performance with large numbers of identities, upgrade planning, governing service and machine accounts, securing the deployment itself, and explaining the programme to people who do not run it, such as a finance lead. A strong answer names the trade-off you chose and the result, ideally in numbers.
Which product to revise. The practitioner questions lean towards Identity Security Cloud: identity profiles, transforms, virtual appliances, workflows and calling its APIs from a script. The experienced questions lean towards IdentityIQ: rule libraries, the identity refresh task, moving configuration between environments, provisioning plans and debugging workflows. If the job advert names one product, spend most of your time on the level that leans towards it, and be ready to say how the other differs.
Before the interview: three stories to prepare
- An application you onboarded: the source, how accounts were correlated, what broke and how you found it.
- A certification or role change you led: what reviewers struggled with and what you changed in the design.
- A problem you debugged under time pressure: the symptom, the logs or reports you used, and the fix.
- For each story, write down one number: time saved, accounts cleaned up, findings closed or reviews completed.
Three sample questions, one per level
Sample questions with model answers
Foundations (0–2 years)
8. What is an access certification?
A review, periodic or triggered by an event such as a move, in which managers, application owners or others confirm or revoke who has which access. It is how organisations show auditors that access is still appropriate.
Practitioner (2–5 years)
29. What causes rubber-stamping in certifications and how do you reduce it?
Huge campaigns, unclear entitlement names and reviewers who do not understand the access. Reduce it by scoping campaigns, describing entitlements in business terms, highlighting risk or changes, and showing decision data.
Experienced (5+ years)
41. How would you plan an IdentityIQ to Identity Security Cloud move?
Inventory what IdentityIQ does today (applications, rules, workflows, roles, policies, campaigns), decide what to rebuild, simplify or retire, map custom code to transforms, workflows or rules, migrate in waves by application, and run both in parallel until reconciliation is clean.
3 of 60 questions are free on this page, with their model answers.
See what the practice exam includesHow to answer well
What separates a strong answer
- Name the product you used, IdentityIQ or Identity Security Cloud, and say which version or era if it matters.
- Give one real example: the application, the problem, what you changed and the result.
- Say what you would check first when something breaks; interviewers value a method more than a memorised fix.
- Use the business reason as well as the technical one: audit, risk, cost or time saved.
- Admit what you have not done and say how you would find out. Guessing at product details is easy to spot.
A question in the certification format
Some job adverts ask for a SailPoint certification too; check each description. The proctored exams use the Discrete Option Multiple Choice format, explained in our DOMC guide. This free question from our Identity Security Engineer practice exam is on lifecycle states, one of the practitioner topics, asked in exam form:
Free question · Identity and Lifecycle Management · DOMC format
An identity profile can move identities between lifecycle states such as active and inactive. What can a lifecycle state be configured to do when an identity enters it?
In the real exam you see one option at a time and answer Yes or No before the next appears. Judge each in turn:
- Option 1: Rename the identity in the authoritative HR system — Yes or No?
- Option 2: Enable or disable the identity’s accounts on chosen sources and grant chosen access profiles — Yes or No?
- Option 3: Change the identity’s password policy for every source automatically — Yes or No?
- Option 4: Start a certification campaign for the whole tenant — Yes or No?
Answer: Yes to option 2, “Enable or disable the identity’s accounts on chosen sources and grant chosen access profiles”, No to the others. Lifecycle states drive joiner-mover-leaver automation: on entering a state, ISC can enable or disable accounts on the sources you choose, remove access and grant access profiles. Deleting accounts is also possible, but only when the state’s identity state is Inactive (long-term) and only on specific sources that support deletion. Lifecycle states do not edit the HR record. SailPoint docs. A Yes to a wrong option, or a No to the correct one, costs you the question: SailPoint’s format page says that to get it right you must judge correctly every option you are shown, and its prep guides say the number of options you see varies.
An original ProSyllabus question, not a SailPoint exam question. Questions like it are in our Identity Security Engineer practice exam, in the DOMC format with a timer and a score for each exam domain; 3 of them are free there.
For the exam itself see our Identity Security Engineer exam guide and the IdentityIQ Engineer exam guide.
Frequently asked questions
Are these real SailPoint interview questions?
They are original questions written by ProSyllabus around the skills SailPoint’s own prep guides describe. They are not collected from any employer or exam.
Do I need a certification to get a SailPoint job?
It depends on the job: some adverts ask for one and many do not. In our view hands-on implementation experience is what you will be questioned on.
Should I learn IdentityIQ or Identity Security Cloud?
Learn the one used in the jobs you are applying for; adverts usually name the product. The governance ideas carry across both.
What is IdentityNow now called?
SailPoint renamed IdentityNow to Identity Security Cloud, and its developer documentation now calls the platform SailPoint Human Fabric.
What coding do SailPoint roles need?
IdentityIQ engineering uses BeanShell, Java-like scripting, and XML. Identity Security Cloud work uses JSON transforms, workflows and REST APIs, with rules for logic that configuration cannot express.
How should I prepare for a senior SailPoint interview?
Prepare two or three detailed project stories: an application onboarding, a role or certification redesign, and a problem you debugged, each with the result in numbers.
What questions should I ask the interviewer?
Which product and version they run, how many applications are connected, how certifications perform today, and what the first project for the hire would be.
How many questions should I expect?
It varies by employer. Our suggestion is to prepare for concept questions, scenario questions and questions about your own projects.
Sources
- official — SailPoint: Identity Security Engineer exam prep guide
- official — SailPoint: Identity Security Administrator exam prep guide
- official — SailPoint: Certified IdentityIQ Engineer exam prep guide
- official — SailPoint Developer Community: SailPoint Human Fabric overview (“previously named IdentityNow, then Identity Security Cloud”)
- official — SailPoint Developer Community: Authentication (tenant domain [tenant].api.identitynow.com)
official = a document published by the conducting body. reported = a news or coaching site we could not check against an original. Where sources disagree this page says so rather than picking one.
Try one free question in the DOMC format
Answer Yes or No to one option at a time, with no going back. Original questions, not SailPoint exam items.
Sit the exam twice before you pay $400 for it
- Two full mocks: 73 DOMC questions each, 120-minute clock
- 156 original questions across all 10 exam domains
- Every answer explained, with the SailPoint docs page it rests on
- Score for every domain, and a drill on your weakest
- Learn mode with all four options shown
Format last checked 18 Oct 2026 on SailPoint’s Identity Security Engineer prep guide.
