IdentityIQ-Associate SailPoint Certified IdentityIQ Associate Exam Questions and Answers

Yes. In SailPoint IdentityIQ, the Identity Warehouse presents identity-centered information collected and modeled inside the IdentityCube. Entitlements are part of that identity view because they represent the user’s permissions or access rights on connected applications. During aggregation, IdentityIQ reads account data from applications, including entitlement-bearing attributes such as groups, roles, permissions, or other managed access values. These are stored on the identity’s application accounts and surfaced in the Identity Warehouse so reviewers, administrators, and governance users can understand what access the identity currently has.

This is distinct from identity attributes such as department, manager, location, or lifecycle state. Entitlements describe access on target systems and are central to access reviews, policy evaluation, role modeling, and access request decisions. Displaying entitlements in the Identity Warehouse allows IdentityIQ to provide a complete access profile for the identity, including accounts, assigned roles, detected roles, policy violations, and application permissions.

Therefore, entitlements are displayed as part of the Identity Warehouse identity details. Reference topics: Identity Modeling, IdentityCube contents, Identity Warehouse, application accounts, entitlement aggregation, managed attributes, and access visibility.

No. Marking an attribute as multi-valued does not, by itself, cause IdentityIQ to treat that attribute as an entitlement or include its values in the Entitlement Catalog. In an application schema, the multi-valued setting only indicates that the account attribute can contain more than one value. It describes data structure, not governance meaning.

To include access values in the Entitlement Catalog, the relevant schema attribute must be configured as an entitlement-bearing attribute, or group objects must be properly configured and aggregated through the application’s group schema where applicable. IdentityIQ then recognizes those values as governable access rights and can represent them as managed attributes in the Entitlement Catalog. Once cataloged, they can be reviewed, certified, requested, described, owned, risk-scored, and governed by policy.

For example, an account attribute such as “groups” may be multi-valued, but IdentityIQ must also know that those values represent access rights. Without entitlement configuration, the aggregation stores attribute values on the account but does not properly model them as catalog entitlements.

Reference topics: Access Modeling, Entitlement Catalog, managed attributes, application schema attributes, entitlement attribute configuration, group schema, and account aggregation.

Yes. In SailPoint IdentityIQ, tasks are used to automate repeatable system processes that build, update, and maintain IdentityIQ data. Tasks are executable operations that can be run manually or scheduled to run at defined intervals. They are commonly used for core operational activities such as account aggregation, group aggregation, identity refresh, role processing, certification generation support, report execution, data maintenance, and other background processing.

This statement accurately describes the purpose of tasks because much of IdentityIQ’s governance model depends on current and processed data. For example, aggregation tasks bring account and entitlement data from applications into IdentityIQ. Identity Refresh tasks update IdentityCubes, calculate role assignments, process lifecycle events, evaluate policies, and refresh identity attributes. Maintenance tasks help keep stored information consistent and usable.

Tasks differ from workflows because tasks are primarily system-executed jobs, while workflows coordinate business processes, approvals, provisioning logic, and human interaction. Therefore, tasks are correctly described as mechanisms that automate the operational processes used to build, update, and maintain information inside IdentityIQ.

Reference topics: Foundational Concepts, tasks versus workflows, aggregation tasks, identity refresh, IdentityCube maintenance, application data processing, and system automation.

No. BeanShell rules are not required to implement aggregation in SailPoint IdentityIQ. Aggregation is a standard IdentityIQ function performed through an application definition, connector configuration, schema definition, correlation settings, and aggregation task execution. Many common connectors can aggregate accounts and groups without any custom rule because the connector and schema configuration provide the required instructions for reading objects from the source system.

Rules are used when additional customization is needed. For example, an aggregation rule may transform incoming attribute values, filter records, normalize data, customize correlation behavior, or handle source-specific logic that cannot be expressed through standard configuration. However, this makes rules optional extension points, not mandatory components of aggregation.

A properly configured application can aggregate accounts using its connector settings, account schema, group schema, and aggregation task options alone. Rules should be introduced only when the standard connector behavior and configuration do not satisfy the implementation requirements.

Reference topics: Applications, aggregation tasks, connector configuration, account schema, group schema, correlation options, application rules, connector rules, and IdentityIQ extensibility through BeanShell rules.

The statement is true in the context of IdentityIQ manager correlation. IdentityIQ does not infer an identity’s manager relationship without source data that identifies the manager. The authoritative application, typically an HR or personnel source, provides the trusted identity records and should include a manager reference attribute, such as manager ID, employee number, username, distinguished name, or another value that can be correlated to an existing IdentityIQ identity.

During aggregation and identity refresh, IdentityIQ uses configured manager correlation logic to resolve that manager reference to an IdentityCube representing the manager. Once resolved, the manager relationship can support governance functions such as manager certifications, access request approvals, lifecycle approvals, escalations, and reporting hierarchy-based controls. Without a manager reference from the authoritative source, IdentityIQ may still contain identities, accounts, and access, but it cannot reliably establish reporting relationships for those identities through standard manager correlation.

This is distinct from manually assigning relationships or using custom logic; the standard governance model expects manager data to originate from the authoritative identity source. Reference topics: Identity Modeling — manager correlation, IdentityCube attributes, authoritative identity data; Governance — manager-based certifications and approvals; User-Driven Requests — manager approval routing.

Yes. In SailPoint IdentityIQ, an application definition represents an external system or managed source and contains the configuration IdentityIQ needs to connect to and interact with that system. The selected connector determines which connectivity settings are required, and the application definition stores those values. Examples can include server host, port, credentials, JDBC URL, file path, API endpoint, tenant information, authentication parameters, or other connector-specific settings.

This connectivity information enables IdentityIQ to perform operations such as account aggregation, group aggregation, schema discovery, entitlement collection, and provisioning where the connector supports write operations. The exact fields vary by connector type, which is why an LDAP, JDBC, Delimited File, Active Directory, or Web Services application may expose different configuration requirements.

Therefore, the statement is accurate: application definitions contain the communication and connectivity configuration used by IdentityIQ to access the application. Reference topics: Applications, application definition, connector selection, connector-dependent settings, account aggregation, schema configuration, and provisioning support.

The statement is false. The Identity Refresh task is used to update and recalculate identity-related data in IdentityIQ, not to manage open work item reminders. Its purpose is to refresh IdentityCubes after aggregation or identity data changes. Depending on selected task options, Identity Refresh can recalculate identity attributes, apply correlation-related updates, refresh role assignments and detections, evaluate policies, process lifecycle events, update risk-related data, and ensure that the identity model reflects the current state of authoritative and application data.

Open work items belong to IdentityIQ’s workflow and governance execution layer. Reminders, escalations, expirations, and related work item follow-up behavior are handled through work item configuration, workflow behavior, certification configuration, and maintenance-style processing rather than the Identity Refresh task. Although Identity Refresh may trigger downstream actions such as lifecycle events or policy evaluation, it is not the task responsible for notifying users about pending approvals or review items.

Therefore, sending reminders for open work items is outside the purpose of Identity Refresh. Reference topics: Identity Modeling — common Identity Refresh options; Foundational Concepts — tasks versus workflows; Governance — work items, certifications, reminders, and escalation behavior.

Defining corporate reporting hierarchies is not a primary purpose of Identity Governance and Administration. In SailPoint IdentityIQ, reporting hierarchy data is typically consumed from an authoritative source, such as an HR system, rather than created as the central objective of IGA. IdentityIQ may use manager relationships for identity correlation, access reviews, approval routing, escalation, lifecycle processing, and certification ownership, but the system’s purpose is not to design or maintain the enterprise organizational chart.

IGA focuses on identity security outcomes: determining who users are, what access they have, whether that access is appropriate, how access was granted, and how inappropriate or risky access should be remediated. Manager and reporting-line data supports these controls, but it is supporting identity context, not the governance objective itself.

For example, a manager attribute may be used during Identity Refresh, certification generation, or access request approval. However, the business function of defining the reporting hierarchy normally remains with HR or organizational management systems.

Reference topics: Foundational Concepts — purpose of identity security; Identity Modeling — manager correlation and IdentityCube attributes; Governance — certification ownership and approval routing.

No. This definition does not describe an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the central identity record that represents a person or identity within IdentityIQ. It consolidates identity attributes, correlated application accounts, entitlements, assigned roles, detected roles, manager relationship, policy violations, lifecycle state, and other governance-relevant information. The Identity Cube is the primary object used by IdentityIQ to understand who a user is and what access that user has across connected systems.

The statement given describes provisioning, not an Identity Cube. Provisioning is the process of adding, removing, or modifying a user’s access on an application. Examples include creating an account, changing account attributes, adding an entitlement, removing group membership, disabling an account, or deleting an account.

Therefore, the definition is inaccurate because it describes an access-change process, while an Identity Cube is an identity data model. Reference topics: Identity Modeling, IdentityCube contents, application account correlation, entitlements, roles, Provisioning, account requests, and access-change fulfillment.

Yes. In SailPoint IdentityIQ, an entitlement represents an access right, permission, privilege, group membership, role membership, or similar access-granting value on an application. Entitlements are discovered from application account data during aggregation and are commonly modeled in IdentityIQ through schema attributes marked as entitlement attributes. Once aggregated, these values may appear in the entitlement catalog as managed attributes, where they can be reviewed, requested, certified, governed by policies, and associated with roles.

The definition “an access right on an application” is accurate because entitlements describe what an identity’s account is allowed to do or access within a connected system. Examples include Active Directory group membership, database roles, application permissions, cloud groups, or other system-specific access values. IdentityIQ uses entitlements as core governance objects for certifications, access requests, policy checks, role modeling, and provisioning.

This definition is intentionally broad because different target systems represent access differently. IdentityIQ normalizes those application-specific access values into entitlement concepts for identity governance.

Reference topics: Access Modeling, entitlement catalog, managed attributes, application schema, entitlement aggregation, certifications, access requests, and provisioning.

‘

The statement is true. In SailPoint IdentityIQ, group factories are used to generate identity groups dynamically based on identity attribute values or configured grouping logic. A group factory defines the rule or attribute basis for grouping identities, but the actual creation or refresh of the resulting groups occurs when the appropriate task is executed. For example, a group factory might be configured to create groups by department, location, cost center, or business unit. When the task runs, IdentityIQ evaluates identities against the factory definition and creates or updates the corresponding groups.

This differs from populations, which are typically defined sets of identities used for targeting, filtering, reporting, or governance scoping. Group factories are more generation-oriented because they can produce multiple group objects from identity data. The task execution step is important because it materializes the groups so they can be used in IdentityIQ operations.

Therefore, new groups can be created as a result of executing a task tied to group factory processing. Reference topics: Identity Modeling — groups and populations, group factories, identity grouping, and task-driven group creation.

Yes. Aggregation partitioning in SailPoint IdentityIQ is a performance and scalability option used to divide a large aggregation workload into smaller units of work. Instead of processing the entire aggregation as one continuous task on a single execution thread, IdentityIQ can partition the work so multiple task executors can process different portions of the aggregation workload concurrently.

This is especially useful in large environments where applications contain many accounts, groups, or entitlement records. Partitioning can improve throughput by distributing processing across multiple hosts in an IdentityIQ deployment and by allowing multiple threads per host to participate in the aggregation workload. The goal is to reduce total aggregation runtime while maintaining controlled processing of account and entitlement data.

Partitioning is not the same as connector-based delta processing. Delta processing depends on connector support for identifying changed records, while partitioning concerns how the aggregation workload is divided and executed. Therefore, the statement is accurate.

Reference topics: Applications, aggregation task options, aggregation partitioning, account aggregation, performance optimization, task execution, and multi-host processing.

No. IdentityIQ capabilities are used to control what a user can do inside SailPoint IdentityIQ, not to grant elevated permissions on a connected target application. A capability defines access to IdentityIQ functions such as administration, reporting, certification management, policy management, role management, access request functions, or other internal product features. Capabilities are part of IdentityIQ’s internal authorization model and determine which menus, pages, actions, and administrative operations a logged-in IdentityIQ user may perform.

Elevated permissions on a connected application must be granted through governed access, such as requesting or provisioning an account, entitlement, role, or permission on that target system. That process is handled through access requests, approval workflows, provisioning plans, connector operations, and application-specific provisioning policies. For example, adding a privileged group in Active Directory or assigning an administrative application role would be modeled as target-system access, not as an IdentityIQ capability.

Therefore, granting an IdentityIQ capability is appropriate when the user needs additional permissions within IdentityIQ itself, not when they need elevated access on an external connected application. Reference topics: Identity Modeling — how IdentityIQ access is granted to users; User-Driven Requests — access requests; Provisioning — target application access fulfillment.

The statement is false. IdentityIQ does not apply a universal rule that removes uncorrelated IdentityCubes after 30 days. Uncorrelated accounts or uncorrelated identity records result from aggregation and correlation processing when IdentityIQ cannot confidently associate an account from an application with an existing IdentityCube. These records remain available for administrative review and remediation until they are resolved through correlation logic, manual correlation, re-aggregation, identity refresh activity, or configured cleanup processes.

The key point is that retention and removal behavior is configuration-driven, not controlled by a fixed 30-day product rule. Administrators may use tasks, aggregation settings, pruning behavior, or lifecycle processes to clean up stale identity or account data, but such actions depend on implementation choices and task configuration. IdentityIQ preserves uncorrelated data because it may represent a real account requiring governance, certification, policy evaluation, or investigation.

Therefore, the assertion that uncorrelated IdentityCubes are automatically removed after 30 days is incorrect. Reference topics: Applications, uncorrelated account resolution, correlation configuration, aggregation results, IdentityCube association, identity refresh, and administrative cleanup tasks.

The statement is true. In SailPoint IdentityIQ, account attributes are defined on the application’s account schema. The application definition tells IdentityIQ how to represent accounts from a connected source, and the account schema specifies which attributes exist on those accounts. Examples may include account ID, display name, email, status, department, groups, roles, permissions, or other source-specific fields returned by the connector during aggregation.

This is distinct from identity attributes, which are stored on the IdentityCube and represent normalized identity-level data used across IdentityIQ. Account attributes belong to application account links, while identity attributes belong to the identity model. During aggregation, IdentityIQ reads account data according to the application schema and stores the discovered values as account/link attributes. Some account schema attributes may also be marked as managed when their values represent entitlement-like access that should be governed through the Entitlement Catalog.

Therefore, account attributes are correctly defined in the application account schema. Reference topics: Applications — application definitions, account schema attributes, schema attribute properties; Identity Modeling — identity attributes versus account attributes; Access Modeling — managed attributes and entitlement catalog.

Yes. Rapid Setup in SailPoint IdentityIQ is designed to accelerate application onboarding by creating and configuring the application definitions required for IdentityIQ to manage data from connected systems. An application definition is the IdentityIQ object that represents an external source or target system and stores the connector selection, connectivity settings, schema information, aggregation behavior, correlation configuration, and related governance options.

Rapid Setup reduces the amount of manual configuration normally required when defining applications. Instead of building every application definition entirely through the standard detailed configuration screens, Rapid Setup guides the administrator through a simplified setup path and creates the required IdentityIQ application objects from that configuration. Those application definitions can then be used for aggregation, correlation, entitlement discovery, access modeling, and downstream governance processes.

This does not mean Rapid Setup eliminates the need for validation. Administrators must still verify schemas, correlation rules, entitlement treatment, and provisioning behavior. However, the statement is accurate because creating application definitions is a core function of Rapid Setup.

Reference topics: Applications, Rapid Setup, application definitions, connector configuration, schema configuration, aggregation, correlation, and entitlement discovery.

The statement is false. In SailPoint IdentityIQ, groups and populations are used to classify, filter, and organize identities for governance, reporting, certifications, and targeted user experiences. A population is a defined collection of identities, and group factories can dynamically create identity groups based on configured identity attributes. These constructs are useful for segmentation, analysis, and campaign targeting, but they are not the standard objects assigned as owners of IdentityIQ objects.

Ownership in IdentityIQ is normally assigned to an identity or to a workgroup. A workgroup is used when ownership or responsibility must be shared by multiple users, such as application owners, certification owners, entitlement owners, or approval groups. This distinction matters because ownership drives accountability, work item assignment, approvals, escalations, and administrative responsibility. Populations and generated groups do not function as accountable owners in the same way workgroups do.

Therefore, while groups and populations can influence governance scope and visibility, they are not assigned as object owners. Reference topics: Identity Modeling — groups and populations; Foundational Concepts — common objects and usage; Governance — ownership, certifications, and work item responsibility.

Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed designates that the values discovered for that attribute are treated as managed entitlement values and promoted into the Entitlement Catalog. This is typically used for attributes that represent access, such as groups, roles, permissions, profiles, or other application-specific entitlement assignments. During aggregation, IdentityIQ reads account data from the application. When a schema attribute is marked as managed, the distinct values of that attribute can become ManagedAttribute objects, allowing IdentityIQ to govern them as cataloged access items.

This catalog promotion is important because raw technical values often need business context before they can be reviewed, requested, approved, certified, or reported on. The Entitlement Catalog can store metadata such as display name, description, owner, requestability, classification, and other governance attributes. These values then become usable in access certifications, access requests, reports, policy evaluation, and role modeling.

Therefore, the statement accurately describes the managed attribute function. Reference topics: Applications — account schema attribute properties; Access Modeling — entitlement catalog; Governance — certification content and entitlement review.