An Identity Security Administrator received a request to audit a distribution list on a monthly cadence.
Place the following steps in the correct order in order to accomplish this task:

Answer:

Explanation:
* Gather data from requestor to build search query.
* Run the query to gather results.
* Save and name the search query.
* Schedule saved search query on a month cadence as requested.
The sequence follows the correct Identity Security Cloud Search workflow. First, the administrator must gather the audit requirements from the requestor, including which distribution list, identities, access attributes, or other conditions must be evaluated. Those requirements are then translated into an appropriate Search query. Second, the query must be executed so the administrator can confirm that it returns the intended records before automating it.
After validating the output, the administrator saves and names the query. Identity Security Cloud requires the query to exist as a saved search before a recurring subscription can be configured. Finally, the saved search is scheduled according to the requested monthly cadence. SailPoint supports subscriptions to saved searches with Daily, Weekly, and Monthly schedules and allows administrators to specify the numerical days of the month and execution times. Therefore, scheduling must occur after the query has been constructed, tested, and saved.
Study Guide Reference: Platform - Search, Building Search Queries, Saved Searches, Search Subscriptions and Scheduled Reporting.