Free Practice Questions for the SailPoint Identity Security Engineer IdentityIQ-Engineer Exam (2026 Updated)

This proposed solution is incorrect. A create-type lifecycle event trigger is used when a new identity is created or first detected in IdentityIQ. The requirement is not about a new identity; it is about an existing identity whose Division attribute changes from IT to Senior IT. That is an update or attribute-change scenario. A create event would not reliably fire when an existing user’s Division attribute is modified during aggregation or identity refresh. It also does not address the second required condition: the user must be a manager. The correct approach must detect the specific attribute transition and then evaluate the manager condition. Using a create trigger would either never launch the workflow for the intended case or launch it only at identity creation time, which is outside the stated requirement. This is a basic but important lifecycle-event design distinction: joiner/create events are not substitutes for mover or attribute-change events. References/topics: IdentityIQ Engineer — lifecycle events, create triggers, attribute-change triggers, mover events, identity refresh processing.

No. The challenge period is not designed to let the reviewer ' s manager challenge the reviewer ' s certification decisions. Its purpose is to give the affected user whose access is being removed an opportunity to respond to the revocation.

When a certification enters the optional challenge phase, IdentityIQ generates a work item and notification for users affected by revocation decisions. The affected identity can accept the loss of the role, entitlement, or account-group access, or challenge the revocation. Any challenged items must subsequently be handled as part of the certification lifecycle.

A reviewer ' s manager can be relevant to certification processing, but through different mechanisms. For example, escalation can transfer an unfinished access review to another identity, commonly the certifier ' s manager, and multi-level sign-off can introduce another approver after the original certifier. Those mechanisms must not be confused with the challenge phase.

Therefore, the proposition assigns challenge rights to the wrong actor. The person whose access is subject to revocation—not the original reviewer ' s manager—is the participant for whom the challenge period exists.

References/topics: IdentityIQ Engineer — certification challenge phase, revocation decisions, affected identity, escalation, multi-level sign-off.

=======

Based on the goals and scheduling parameters provided, the tasks should be scheduled in the following order to achieve efficient processing for a 24-hour period:

1st Check Expired Work Items (12:00 AM)

This task runs at midnight to check for expired work items. It’s important to run this first to clean up any pending tasks from the previous day.

1st Perform Identity Request Maintenance (2:00 AM)

This maintenance task is scheduled at 2:00 AM, a time when the system is least likely to be under load.

1st Aggregate Employee Authoritative Application (5:00 AM)

The aggregation for the Employee Authoritative application starts early in the day, at 5:00 AM.

1st Aggregate Contractor Authoritative Application (5:10 AM)

The Contractor Authoritative application aggregation is scheduled 10 minutes after the Employee aggregation, as per the goals.

1st Identity Refresh (5:20 AM)

Active Directory aggregation runs next at 5:20 AM.

2nd Aggregate Employee Authoritative Application (12:00 PM)

The second run for the Employee Authoritative application happens at noon.

2nd Aggregate Contractor Authoritative Application (12:10 PM)

At 12:10 PM, the Contractor Authoritative application runs again for its second aggregation.

2nd Identity Refresh (12:20 PM)

The second aggregation for Active Directory happens at 12:20 PM.

1st Aggregate Finance Authoritative Application (8:00 PM)

The Finance application aggregation is scheduled for 8:00 PM, which aligns with the goal of processing it in the evening.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Check Expired Work Items (12:00 AM)

This task is run first to ensure any expired or pending work items from the previous day are cleared out and do not interfere with the new day’s tasks. Running it at midnight ensures that any workflows or approvals with expirations are processed efficiently.

Identity Request Maintenance (2:00 AM)

This is a maintenance task that keeps the system running smoothly by managing identity requests. Scheduling it at 2:00 AM minimizes interference with other key business tasks since it ' s an off-peak hour.

Authoritative Application Aggregations (Employee/Contractor/Active Directory)

The authoritative applications (Employee, Contractor, Active Directory) need to be processed twice a day: once early in the morning and once at noon. Each aggregation must follow the specified order, as it ensures that the data flow is properly managed from the more critical Employee applications to the less frequent Contractor and Active Directory ones.

Finance Application (8:00 PM)

The Finance application is aggregated once a day, in the evening, after other high-priority applications have been processed. This ensures that financial data is up to date for reporting and compliance purposes, without overlapping with the core workday processes.

SailPoint IdentityIQ Scheduler Documentation (section on task scheduling and run-time configuration).

Yes. Account Groups are commonly used to represent entitlement-bearing group or application objects from a target system. SailPoint documentation uses the terms account group and application object closely, and many applications model access through membership in groups. During aggregation, an account may contain an entitlement attribute such as groups, memberOf, roles, or another group-membership attribute.

When the application also defines a group schema, IdentityIQ can aggregate the group objects themselves. The account schema ' s entitlement attribute is linked to the group schema by setting its type to the applicable native object type—commonly group. IdentityIQ can then associate the entitlement values found on accounts with the corresponding group objects.

These group values can become ManagedAttribute objects and appear in the Entitlement Catalog, where IdentityIQ can attach governance information such as owner, description, requestability, and certification metadata. This allows the target-system group to function as a governed entitlement.

Therefore, representing a particular group-based entitlement associated with accounts on a target system is an appropriate Account Group use case.

References/topics: IdentityIQ Engineer — Account Groups, Application Objects, group schemas, ManagedAttribute, Entitlement Catalog, account entitlements.

=======

No. An individual SPRight is a granular IdentityIQ product right, but roles do not normally grant an arbitrary standalone SPRight directly as a role entitlement. IdentityIQ groups SPRights into Capabilities , which provide logical collections of rights associated with administrative or functional job responsibilities.

The Role Editor provides a Granted IdentityIQ User Rights section where an engineer can associate IdentityIQ capabilities and scopes with a role. When that role is assigned and role provisioning is processed through Identity Refresh, the corresponding capabilities and scopes can be granted to the identity. This is the supported role-level abstraction.

The distinction matters because an SPRight controls granular access to specific IdentityIQ UI functions, tools, pages, or operations, while a Capability groups one or more SPRights into a maintainable authorization construct. Directly treating a single SPRight as an ordinary role option bypasses the intended rights-to-capability model.

Therefore, although a role can grant IdentityIQ user rights indirectly through configured capabilities, the proposed statement that the role is configured to include a single SPRight object is not the valid role configuration model.

References/topics: IdentityIQ Engineer — SPRight, Capability, Granted IdentityIQ User Rights, Role Editor, authorization model.

=======

Yes. The numbered placeholder model used by IdentityExtended.hbm.xml provides ten extended attributes by default—extended1 through extended10—and that numbered set can be expanded through extended20. This requires adding the appropriate property definitions to the extended Hibernate mapping and subsequently applying the corresponding database-schema extension process.

The distinction between numbered placeholder attributes and named attributes using ExtendedPropertyAccessor is important. Twenty is the traditional limit of the numbered SailPointObject extended-property slots; it is not an absolute claim that IdentityIQ can never support additional custom attributes. SailPoint provides ExtendedPropertyAccessor for named extended properties beyond the numbered placeholder model.

The configuration comments associated with IdentityExtended.hbm.xml explicitly state that ten extended attributes are mapped by default and that this can be raised to twenty. They also caution that excessive searchable/indexed attributes can degrade Identity Cube update performance.

Therefore, the proposition is correct specifically for adding further placeholder numbered extended attributes beyond the ten shown, through extended20 .

References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended1–extended20, searchable identity attributes, ExtendedPropertyAccessor, extended schema.

=======

This statement is not correct. IdentityIQ syslog event searching is not limited only to Incident Code lookups. Incident Code is useful when a user-facing error displays a code that can be traced back to a logged system event, but syslog analysis is broader than that. Administrators and engineers use syslog data to investigate operational errors, workflow failures, connector issues, provisioning errors, aggregation failures, authentication problems, and application exceptions. Advanced Analytics and log-search capabilities are intended to help filter and locate system events using more than a single incident-code value. Treating Incident Code as the only searchable attribute would make syslog analysis nearly useless for routine troubleshooting where no user-facing incident code is available. The correct engineering view is that Incident Code is one important search key, not the exclusive search mechanism. References/topics: IdentityIQ Engineer — syslog search, Advanced Analytics, incident code troubleshooting, system-error diagnosis, operational logging.

When setting up a new IdentityIQ test environment, it is important to assess the needs of the customer, including whether they would benefit from using a deployment accelerator.

Deployment accelerators are pre-configured sets of rules, policies, and workflows that can significantly reduce the time and effort required to deploy IdentityIQ in a test or production environment. These accelerators are particularly useful for rapidly setting up environments that align with common industry practices or specific compliance requirements.

Asking the customer whether they need a deployment accelerator is a valid and important question during the initial setup phase, as it helps to determine the best approach to configuring the test environment efficiently. Therefore, the correct answer is A. Yes.

In SailPoint IdentityIQ, the concept of a " role " is fundamental to the identity governance framework. The platform supports several default role types that are pre-configured to help organizations manage access effectively. The default role types include:

Business Role: Represents a collection of entitlements necessary for a specific job function within the organization.

IT Role: Aggregates technical entitlements that are typically assigned together, often linked to specific applications or systems.

Application Role: Tied to a specific application, representing roles within that application ' s context.

Composite Role: A combination of other roles, either business or IT, to form a higher-level role.

The term " Entitlement Role " is not recognized as a default role type in SailPoint IdentityIQ. While entitlements can be components of roles, " Entitlement Role " itself is not a predefined role type in the platform. Therefore, the correct answer is B. No.

Yes. IdentityIQ provides audit configuration capabilities through the user interface so administrators can manage much of the platform’s audit behavior without directly editing XML for every standard case. Audit configuration is used to control which events or actions are captured, allowing organizations to record relevant administrative, governance, provisioning, workflow, and compliance activity. This is important because excessive auditing can create unnecessary database volume and noise, while insufficient auditing can leave gaps in troubleshooting and compliance evidence. For standard audit controls, the Audit Configuration page is the normal administrative place to manage audit behavior. However, this does not mean every custom audit requirement can be completed only through the UI. Custom audit actions, custom reports, or custom rule/workflow audit writes may still require XML or BeanShell work. The statement says the majority of auditing is managed through the UI page, which is valid for standard IdentityIQ auditing operations. References/topics: IdentityIQ Engineer — Audit Configuration, audit events, audit actions, compliance evidence, custom audit extension.

No, the " Email Protocol " is not a setting that an engineer must set up to ensure successful communication with the SMTP server. Instead, the essential settings include the mail server address, port, authentication details (like username and password if required), and possibly the security settings (such as SSL/TLS). While the email protocol (e.g., SMTP) is implicitly involved, it is not a specific setting that needs to be configured separately within IdentityIQ. The critical setup revolves around configuring the mail server connection parameters.

SailPoint IdentityIQ Configuration Guide (Email and Notification Settings)

SailPoint IdentityIQ Administration Guide (SMTP Configuration for Email Notifications)

No. Profile Class is explicitly an optional application configuration property. Its purpose is role modeling, not connectivity to Active Directory. A Profile Class allows multiple applications to be logically associated with a larger application class so a single role profile can apply across those applications.

For example, several similar application instances can share the same Profile Class so that role-detection logic does not require a separate profile for every individual instance. This can simplify enterprise role modeling, but it is not necessary for IdentityIQ to connect to Active Directory, aggregate accounts or groups, correlate accounts, perform certifications, or provision access.

SailPoint ' s Edit Application documentation describes Profile Class as an optional class used to associate an application with a larger set of applications for role-modeling purposes. This differs fundamentally from required connector configuration such as application identity, schema, forest/domain information, and authentication details.

An engineer may therefore configure Profile Class when the organization ' s role model requires it, but an Active Directory application can be successfully configured and operated without one.

References/topics: IdentityIQ Engineer — Profile Class, Application Definition, role modeling, Active Directory connector, optional application properties.

=======

In SailPoint IdentityIQ, every Link object, which represents an account on an application for an identity, must be associated with an Identity object. The Link object is inherently tied to an identity, as it is a representation of that identity’s account on a target system. Without this association, the Link would not have context within IdentityIQ. This is a fundamental aspect of IdentityIQ ' s data model. Refer to the SailPoint IdentityIQ Data Model documentation for detailed information on the relationships between Link objects and Identity objects.

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

Yes, this is a valid action. When using the Services Standard Build (SSB) in SailPoint IdentityIQ, placing the patch jar file in the build ' s base/patch folder is a correct procedure, provided the patch version matches what the client is using. This allows the build process to incorporate the patch into the deployment, ensuring that the correct versions and fixes are applied to the IdentityIQ instance.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Patching and Version Management Guide

Yes. IdentityIQ workflow steps support several action types, and both Script and Rule actions execute logic implemented with Java BeanShell.

A Script action contains BeanShell code directly within the workflow step. This is useful for workflow-specific logic that is short or tightly coupled to that business process. In workflow XML, the script may appear inline or inside a nested < Script > < Source > ... < /Source > < /Script > block.

A Rule action also executes BeanShell code, but the code is encapsulated in a reusable IdentityIQ Rule object rather than embedded directly in the workflow. This is preferable when logic needs to be reused, separately maintained, or invoked by multiple workflows or other IdentityIQ components.

IdentityIQ distinguishes these action types from Subprocess , which launches another Workflow object, and Call Method , which invokes a compiled Java method exposed through the IdentityIQ workflow library.

SailPoint ' s workflow documentation explicitly describes Script as executing Java BeanShell code and Rule as executing a reusable workflow Rule containing Java BeanShell code. Therefore, the proposed statement accurately characterizes both action types.

References/topics: IdentityIQ Engineer — Workflow Step actions, Script, Rule, BeanShell, Subprocess, Call Method, Business Process Editor.

The purpose of an IdentityIQ certification is not to attest to a user ' s integrity. Certifications in IdentityIQ are designed to review and verify user access rights to ensure they are appropriate based on roles, policies, and organizational rules. The focus is on access management rather than personal qualities like integrity.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

Yes. IdentityIQ ' s Debug Logging functionality provides diagnostic information about the active logging configuration, including information associated with the currently loaded Log4j configuration. This is useful because troubleshooting IdentityIQ commonly requires an engineer to determine not merely what log level is active, but which logging configuration is actually being used by the running application .

That distinction matters in application-server environments where multiple configuration files, deployment paths, classpath resources, customized Log4j configuration, or node-specific settings may exist. Editing the wrong file produces no effective logging change and can waste substantial troubleshooting time.

The Debug Logging interface is also associated with runtime logger inspection and temporary adjustment of logging levels. However, engineers should treat runtime debug logging carefully: enabling DEBUG or TRACE for broad packages can produce significant log volume and performance impact. Persistent configuration changes should be made through the supported logging configuration and change-control process rather than assuming a runtime debug change permanently modifies the source configuration.

Therefore, the proposition that the Debug Logging page can identify the location of the currently loaded Log4j file is valid.

References/topics: IdentityIQ Engineer — Debug Logging, Log4j configuration, runtime logging levels, troubleshooting, application-server logging.

=======

The statement is true. In SailPoint IdentityIQ, it is possible to configure a role to include a set of IdentityIQ capabilities. Capabilities in IdentityIQ are permissions that grant users access to specific functionalities within the platform, such as managing identities, viewing reports, or administering roles. By associating a role with specific capabilities, you can control what actions users assigned to that role can perform within the IdentityIQ environment.

SailPoint IdentityIQ Administration Guide (Role Configuration and Capabilities Section)

SailPoint IdentityIQ Configuration Guide (Sections on Roles and Capabilities)

The statement is true. In the SailPoint IdentityIQ Reporting user interface, report templates are located on the " Reports " tab. These templates define the structure and parameters of reports but do not contain actual report data. Instances of reports, which are the actual generated reports containing data based on the templates, are located on the " My Reports " tab. The " My Reports " tab is used for viewing and managing reports that have been generated for a specific user.

SailPoint IdentityIQ Reporting Guide

SailPoint IdentityIQ Administration Guide (Section on Reporting Interface)

No, the Provisioning tab under the " Administrator Console " is not used to map the associated WorkflowCase to a particular Provisioning Transaction. The Provisioning tab is primarily for monitoring and managing provisioning operations, not for mapping workflow cases to transactions. Such mappings are typically handled within the workflow configuration itself, not through the Provisioning tab.

SailPoint IdentityIQ Workflow Guide (Handling Workflow and Provisioning Transactions)

SailPoint IdentityIQ Administration Guide (Provisioning Tab Limitations)

Yes. An account attribute must have an Attribute Name because the name provides the logical identifier IdentityIQ uses to reference that attribute throughout the application configuration and subsequent processing. In this scenario, the engineer needs an attribute representing whether an account is privileged. That attribute must be identifiable when its value is populated from source data, calculated by rule logic, exposed to Advanced Analytics, referenced from BeanShell, or evaluated in policies.

The Attribute Name is distinct from the source mapping and datatype. The name establishes what attribute is being defined ; the source mapping determines where or how its value is obtained; and the datatype specifies what kind of value IdentityIQ expects.

The existing Word bank tests this same scenario with Source Mappings: Application Rule, which it marks as required, and separately with Edit Mode: Read Only. Those do not duplicate this proposition because DOMC treats each configuration option independently.

Therefore, Attribute Name is necessary for the account-attribute definition.

References/topics: IdentityIQ Engineer — application schema, account attributes, attribute naming, source mappings, Advanced Analytics, policy attributes.

=======

This statement is incorrect. In SailPoint IdentityIQ email templates, entire blocks of text, including whole paragraphs, can indeed be conditionally included or omitted using the appropriate templating syntax such as #if, #else, and #end. The templating engine in IdentityIQ, which typically uses Apache Velocity, supports complex conditional logic that can control large sections of the email content, not just individual lines.

This is not a valid development step. A Quicklink is configured as an IdentityIQ object that exposes an action to users through the UI and can be configured to launch a workflow. The workflow does not contain or “host” the Quicklink object. The relationship is the other way around: the Quicklink references the workflow it should launch. To restrict the Quicklink to managers only, the engineer should configure visibility, population, capability, or dynamic eligibility logic so only manager identities can see or execute it. Then the Quicklink configuration should identify the workflow to invoke and pass any required arguments into that workflow. Placing a Quicklink object “on” the workflow is not how IdentityIQ Quicklink architecture works. The proposed solution confuses the launching object with the launched process. References/topics: IdentityIQ Engineer — Quicklink object, workflow launch configuration, manager-only visibility, population rules, workflow arguments.

The statement that the application server must be restarted after reloading the logging file through the Debug-Logging page is incorrect. SailPoint IdentityIQ allows you to reload the logging configuration from the Debug-Logging page without restarting the application server. The Debug-Logging page provides a way to dynamically reload the logging settings, including those in the log4j file, so that changes can take effect immediately without the need for a server restart.

Therefore, the correct answer is B. No.

Yes. IdentityIQ ' s authorization model uses granular SPRights and higher-level Capabilities to control access to product functions. SPRights govern access to menus, tools, tabs, pages, and individual operations. Capabilities group one or more of those rights into logical sets that can be assigned according to job responsibilities.

A capability can be assigned directly to an Identity through the identity ' s User Rights configuration. Capabilities may also be inherited indirectly through workgroup membership. Therefore, the capabilities available to a logged-in identity are one of the mechanisms IdentityIQ uses to determine which product features that user can see and what administrative or operational actions the user can perform.

Capabilities should not be confused with Scopes . Scopes constrain the objects or portions of the environment to which a user has visibility or control, whereas capabilities determine the functions/features the user is authorized to use. The two mechanisms can operate together.

SailPoint documentation explicitly states that identities can have capabilities assigned directly and that capabilities determine which IdentityIQ features users can access.

References/topics: IdentityIQ Engineer — SPRights, Capabilities, User Rights, authorization, workgroup-inherited rights, scopes.

=======

A Role Membership Certification is appropriate for this requirement because the hospital is trying to confirm that users assigned to a role are correct. The test is not about whether the role contains the right entitlements; that would point to Role Composition Certification. It is also not primarily about application ownership or account group membership. The wording says the business analysts want to verify the role assignment rules by certifying the users who have been assigned the role. That maps directly to a membership review: who is in the role, whether each membership is valid, and whether the assignment rule is producing the expected population. The security team can be configured as the certifier, final reviewer, or sign-off participant depending on certification ownership and sign-off configuration. Therefore, the proposed certification type achieves the stated goal. References/topics: IdentityIQ Engineer — Role Membership Certification, role assignment rules, certification ownership, sign-off, access review routing.

The statement is false. While it is true that logging and auditing require extra function calls and generate data, the suggestion that this data can be compressed to avoid storage issues and improve performance is misleading. In practice, while compression might save storage space, it does not inherently improve performance, particularly because the overhead of compression and decompression could negate the performance benefits. Effective performance management in IdentityIQ involves more nuanced approaches, such as optimizing the level of detail in logs, managing log rotation, and tuning the system for efficient I/O operations.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Performance Tuning Guide

The statement that " An Application object is not required to aggregate external user account information into IdentityIQ " is false. In SailPoint IdentityIQ, an Application object is essential for aggregating (importing) external user account information. The Application object defines the connection settings, schema, and mapping that enable IdentityIQ to connect to external systems and retrieve identity data. Without an Application object, IdentityIQ would not have the necessary configuration to establish a connection and aggregate user data from external sources.

SailPoint IdentityIQ Administration Guide (Section on Applications and Aggregation)

SailPoint IdentityIQ Integration and Configuration Guide

The provided BeanShell code snippet attempts to filter and print the names of GroupDefinition objects owned by " Randy.Knight. " However, the code contains a few issues that prevent it from functioning correctly as written:

Class Import: The GroupDefinition class should be imported explicitly at the beginning of the script, which is missing here.

Query Execution: The use of context.getObjectsByNumber(GroupDefinition.class, i) is incorrect. This method does not exist in this context. The correct approach would be to use context.getObjects() to retrieve the list of objects and iterate over them.

Looping Logic: The loop logic also contains a flaw. Instead of using a counter-based loop with context.getObjectsByNumber(), the recommended approach is to use context.search() to retrieve a list of filtered objects and then iterate through the results.

A corrected version of this code would look something like this:

import sailpoint.object.GroupDefinition;

import sailpoint.object.Filter;

import sailpoint.object.QueryOptions;

Filter filter = Filter.eq( " owner.name " , " Randy.Knight " );

QueryOptions qo = new QueryOptions();

qo.addFilter(filter);

List < GroupDefinition > groupDefinitions = context.getObjects(GroupDefinition.class, qo);

for (GroupDefinition group : groupDefinitions) {

System.out.println(group.getName());

}

In this corrected version:

We explicitly import GroupDefinition.

We retrieve the filtered objects with context.getObjects(GroupDefinition.class, qo) instead of getObjectsByNumber.

Thus, the original code is not correct as written. The correct answer is B. No.

Yes. LCM provisioning workflows contain control behavior for handling provisioning operations that are not completed synchronously. A queued result is materially different from a failed result: IdentityIQ has successfully submitted the request into a provisioning path, but the downstream operation has not necessarily completed yet.

LCM processing can therefore be configured so that asynchronous/queued provisioning does not cause the overall request workflow to be treated as an immediate provisioning failure. This is important for connectors and integrations where target operations are queued, brokered, or fulfilled asynchronously. Otherwise, the workflow could incorrectly follow failure handling merely because the target-system change was not completed during the same execution thread.

The engineer must still distinguish this from claiming that the target access has definitely been provisioned. “Successful” at this workflow stage means the request was accepted into the expected provisioning process. Subsequent transaction processing, retries, aggregation, or request maintenance can establish the final state.

This is precisely why provisioning status management is a workflow concern, whereas whether an application supports a particular account operation is an application/connector concern.

References/topics: IdentityIQ Engineer — LCM provisioning workflows, asynchronous provisioning, queued provisioning status, ProvisioningProject, provisioning transaction status, request maintenance.

=======

No. Setting the length of an IdentityIQ extended String attribute to 9000 is not a supported general mechanism for storing an identity image. The length value in IdentityExtended.hbm.xml influences how Hibernate maps the String property to a database column. It therefore has database-specific consequences and must not be treated as an arbitrary storage-capacity control.

The standard IdentityIQ extended-attribute configuration uses String properties with much smaller lengths—for example, length= " 450 " —specifically so the resulting columns remain suitable for searching and indexing. SailPoint ' s own configuration commentary warns that database platforms have different VARCHAR limitations and that sufficiently large String definitions may cause Hibernate to map the value to a LOB/blob-like type that cannot be used in the same way for searches.

An image is binary content and should not be modeled merely by making an extended searchable String column extremely large. Even an encoded image can exceed practical database/index limits and introduces unnecessary Identity Cube and persistence overhead.

Therefore, length= " 9000 " is not a prescribed IdentityIQ image-storage configuration.

References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended properties, Hibernate mappings, VARCHAR limits, searchable attributes, database schema design.

=======

No. An Account Group is not a mechanism for selecting a particular subset of user accounts during an Account Aggregation. IdentityIQ distinguishes between Account Aggregation and Account Group Aggregation . Account Aggregation reads account records from the target application and creates or updates Link objects, including the account ' s attributes and entitlements. The population or scope of accounts being aggregated is controlled by connector/application configuration such as search scope, source filters, iteration filters, partitions, or other connector-specific aggregation parameters.

Account Group Aggregation has a different purpose. It reads group or application-object information from applications that have an appropriate group schema. The resulting group information is used to represent governed entitlement objects, support group certifications, and expose group-related information within IdentityIQ.

Consequently, an Account Group is not used as a selector for saying “aggregate these particular accounts” during an Account Aggregation. That requirement must be implemented through the account aggregation configuration itself.

References/topics: IdentityIQ Engineer — Account Aggregation, Account Group Aggregation, Link objects, aggregation filters, group schemas.

=======

Yes, the current version and patch level of IdentityIQ can be found through the Debug-About page. The Debug-About page in SailPoint IdentityIQ provides critical information about the system, including the software version, patch level, and other configuration details. This page is a useful resource for administrators to quickly verify the IdentityIQ version and ensure that the correct patches have been applied.

Therefore, the correct answer is A. Yes.

The statement that a user ' s access to the Identity Warehouse is controlled by the QuickLink Populations they are a member of is incorrect. QuickLink Populations in IdentityIQ are used primarily for grouping identities for specific operations, such as access reviews, certifications, or specific application provisioning, rather than directly controlling access to the Identity Warehouse.

Access to the Identity Warehouse is governed by role-based access controls (RBAC), scopes, and the user ' s entitlements within IdentityIQ. These determine what data and functionality a user can access, including the information in the Identity Warehouse.

Thus, the correct answer is B. No.

No. IdentityIQ BeanShell rules do not all have the same input and output contract. Rule arguments and expected return values depend on the rule type and the execution context in which IdentityIQ invokes the rule.

For example, a correlation rule requires information relevant to account/identity correlation, while provisioning-related rules operate with provisioning plans, applications, accounts, or provisioning results. Workflow rules receive variables associated with the workflow context. Other rule types may return a Boolean, String, Identity, Map, object collection, transformed value, or no meaningful value at all.

IdentityIQ ' s Rule Registry and Rule Editor exist partly to expose this distinction. The Word bank itself states that the typical input variables for a rule are presented according to the Rule Registry, meaning they are determined by rule type rather than being universally identical. It also contains separate propositions concerning Rule Registry descriptions and Rule Editor Arguments.

Therefore, standardizing every BeanShell rule around identical arguments and returns would contradict IdentityIQ ' s rule architecture.

References/topics: IdentityIQ Engineer — BeanShell rules, Rule Registry, Arguments, Returns, rule type, runtime context.

=======

Syslog cannot be used to launch a certification using the search results. Launching a certification in IdentityIQ is a process that involves interacting with the application’s certification module, where you define parameters, select users or roles, and initiate the certification campaign. This process requires using the IdentityIQ user interface or APIs, not the Syslog, which is purely for logging purposes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ API and UI Guide

Yes, this is an example of a mover lifecycle event. A mover lifecycle event typically occurs when an individual ' s role or employment status within the organization changes, requiring updates to their accounts and access rights. In this scenario, a contractor whose accounts were previously disabled due to contract expiration needs those accounts re-enabled upon securing a new contract. This reactivation and adjustment of access rights based on a change in employment status fits the definition of a mover event.

Therefore, the correct answer is A. Yes.

This implementation is correct in structure. The code first resolves the Application object named MagicBox, then creates an IdentityService, then calls service.getLinks(identity, application) to retrieve the account links for that identity on the application. Because the requirement is to return all account names, using getLinks and iterating over the returned List < Link > is the right pattern. Each Link represents an account on an application, and getNativeIdentity() returns the account’s native identifier, which is the account name or unique account key from the target application. The null check prevents a null-pointer issue if no links are returned. In a production-quality version, an engineer might also handle a missing application object and ensure Java collection imports are available, but those do not invalidate the core implementation pattern shown. Compared with the flawed single-link version, this solution correctly handles multiple accounts. References/topics: IdentityIQ Engineer — IdentityService API, Application object lookup, Link collection retrieval, nativeIdentity, BeanShell utility methods.

Yes, the code provided in the second image is correct for including a rule library named " Common Rules Library " in a Rule. The correct syntax is to use class= " sailpoint.object.RuleLibrary " and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the " Common Rules Library. "

Correct Syntax (from the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

No. This is not a correct locking and persistence pattern for safely modifying a Policy object. The most serious problem is that the object is retrieved and modified before an appropriate transaction lock is obtained . If concurrent processing can update the same persistent object, the object should be obtained under the intended transaction lock before the modification is performed.

The code also never explicitly calls context.saveObject(object). SailPoint ' s recommended object-modification pattern obtains a transaction lock using ObjectUtil.transactionLock() or the appropriate ObjectUtil.lockObject() mechanism, modifies the locked object, calls context.saveObject(), and commits the transaction. In addition, calling context.decache(object) before committing is contrary to the normal persistence pattern because decaching removes the object from the Hibernate/SailPoint object cache before the persistence sequence has been properly completed.

A documented SailPoint example obtains the transaction lock first, performs the modification, saves the object, commits, and then decaches it. The proposed code does not follow that sequence.

References/topics: IdentityIQ Engineer — SailPointContext, ObjectUtil locking, transaction locks, saveObject, commitTransaction, object cache management.

=======

Owner is a required and important application configuration element in IdentityIQ. Application ownership establishes accountability for the connected system and is used across governance operations such as access reviews, application owner certifications, approval routing, policy handling, and administrative responsibility. IdentityIQ’s governance model depends heavily on ownership metadata because applications are not merely technical connector records; they are governed objects. Assigning an owner allows IdentityIQ to determine who is responsible for application access, certification decisions, and operational oversight. While some low-level object imports may technically create incomplete objects, from the application setup perspective an engineer should treat Owner as required. Without an owner, downstream governance functions become weak or ambiguous because IdentityIQ cannot reliably route application-specific reviews or approvals to the responsible business or technical authority. The proposed option is therefore valid as a required setup item. References/topics: IdentityIQ Engineer — application definition, application owner, governance accountability, certification ownership, access approval routing.

No. The statement is too broad and is incorrect specifically in the context of IdentityIQ Syslog events . IdentityIQ differentiates between normal Log4j logging and SyslogEvent records. Log4j can write ordinary application logging to configured log files, but IdentityIQ ' s higher-severity Syslog events are persisted in the IdentityIQ database so that they can be searched through Advanced Analytics and inspected through IdentityIQ administrative/debug functionality.

SailPoint documents that WARN, ERROR, and FATAL events can be stored in the IdentityIQ database. Lower-level events can instead be handled by Log4j when configured and are not necessarily persisted to the Syslog database table. SailPoint operational guidance further identifies spt_syslog_event as the database table containing persisted Syslog events.

Therefore, saying that IdentityIQ logging events are stored in a flat file instead of a database incorrectly collapses two separate logging mechanisms. Some Log4j output can certainly be file-based, but IdentityIQ SyslogEvent storage includes database persistence.

References/topics: IdentityIQ Engineer — SyslogEvent, Advanced Analytics Syslog Search, spt_syslog_event, Log4j, troubleshooting and logging architecture.

=======

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in the provisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.

The correct order for performing an initial installation of SailPoint IdentityIQ is:

Ensure all of the application servers are stopped.

Stopping all application servers is crucial to prevent any conflicts or transactional interference during the installation process.

Un-jar the IdentityIQ WAR file in the desired directory of each application server.

Extract the IdentityIQ WAR file in the appropriate location for the application server. This step deploys the IdentityIQ application code.

Configure iiq.properties file with database credentials and datasource.

The iiq.properties file must be updated with correct database credentials and datasource configurations to establish a connection to the IdentityIQ database.

Create the IdentityIQ database.

A new IdentityIQ database must be created for the system. This is the foundation where all IdentityIQ data will be stored.

Generate database schema to include custom attributes by executing ' iiq schema ' .

Use the iiq schema command to generate the necessary database schema. This includes tables, constraints, and other structural components for IdentityIQ.

Initialize default IdentityIQ system objects from ' iiq console ' using the ' import ' command.

Import default system objects like roles, policies, and configuration settings using the IdentityIQ console’s import feature. This sets up the base configuration.

Start all of the application servers.

Once everything is configured, start the application servers to make the IdentityIQ application available.

Apply the latest patch.

Finally, apply any patches to ensure the system is up to date with the latest security and feature enhancements.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Stopping all application servers is necessary to avoid file locks and ensure the WAR deployment and database setup processes can proceed smoothly.

Un-jarring the WAR file deploys IdentityIQ into the server directory structure, making its code accessible for execution.

Configuring the iiq.properties file connects IdentityIQ to the database, establishing where it will read and write data.

Creating the database is fundamental, as the IdentityIQ system relies on a structured data environment.

Generating the database schema via iiq schema builds out the tables and structures necessary for storing identity, access, and policy data.

Initializing system objects sets up core elements of IdentityIQ (like roles, capabilities, and system configurations) required for its operation.

Starting the application servers activates the IdentityIQ environment, allowing the system to begin processing requests.

Applying the latest patch ensures that the installation is up-to-date with all bug fixes, enhancements, and security updates from SailPoint.

SailPoint IdentityIQ Installation Guide (steps on fresh installation and post-installation configurations).

Yes. This is a valid Identity search use case because the relationship between an employee and their manager is normally represented on Identity objects through attributes such as manager, manager ID, supervisor, or reporting relationship. If the identity cube contains the manager relationship, Identity search or Advanced Analytics can be used to filter identities whose manager equals a specific person and then count the returned identities. This is completely different from using Syslog for the same purpose. The Word bank rejects Syslog for this scenario because Syslog is a logging facility, not an organizational data query mechanism. But the video asks about the Identity search type, and Identity search is the correct object domain for employee reporting relationships. The engineer must ensure that the manager attribute is populated and searchable or otherwise available to the search interface. References/topics: IdentityIQ Engineer — Identity search, manager attribute, identity cube, reporting relationships, Advanced Analytics filters.

Yes. The requirement concerns performing an operation against an existing account through the Manage Accounts functionality. The QuickLink population therefore needs to permit users in that population to manage existing accounts. Selecting “Allow managing existing accounts” establishes that population-level eligibility for operations involving accounts that already exist.

This configuration should be distinguished from the specific account operation itself. Lifecycle Manager ' s Manage Accounts configuration controls which account actions—such as enable, disable, unlock, or other supported operations—are available. The QuickLink-population setting determines whether the user is allowed to manage existing accounts through that interface. Both layers must align with the requested functionality.

This question is also genuinely different from the ODT ' s existing question. The bank asks about a user wanting to enable an account and proposes selecting the Rehire action. Here, the video specifically asks about unlocking an existing account and proposes a QuickLink-population setting.

Therefore, for the configuration proposed in this DOMC item, the answer is Yes.

References/topics: IdentityIQ Engineer — Lifecycle Manager, Manage Accounts QuickLink, QuickLink populations, existing-account management, account unlock, Manage Account Actions.

=======

Rapid Setup application onboarding is designed to simplify the initial configuration and does not typically provide advanced configuration options like specifying an account attribute and value filter to identify secondary accounts. Such detailed configurations often require custom scripting or detailed adjustments within the standard application setup, outside of the Rapid Setup interface.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Sections on Application Onboarding and Advanced Account Mapping)

Yes. Rapid Setup application onboarding can be used for common onboarding configuration, including account classification logic such as identifying service accounts based on an account attribute and value. Service accounts often need to be distinguished from normal human accounts because they may have different ownership, certification, correlation, requestability, password, and governance treatment. A typical configuration uses an account schema attribute and a value or pattern to flag accounts that should be treated as service accounts. This fits Rapid Setup’s purpose: allowing engineers to configure standard onboarding behavior without writing custom connector logic for every common case. The capability is still limited compared with full custom rules or advanced application configuration. If the service-account identification logic requires complex multi-attribute conditions, external lookups, or custom transformations, a rule or deeper application configuration may be needed. But the proposed action itself is a valid Rapid Setup onboarding configuration. References/topics: IdentityIQ Engineer — Rapid Setup, application onboarding, account classification, service accounts, account attribute filters.

Yes. IdentityIQ email templates use the Apache Velocity Template Language (VTL) , and these forms are valid Velocity reference syntaxes. $identityName is the normal shorthand reference. ${identityName} uses formal notation, which is particularly useful when the variable reference must be clearly separated from immediately adjacent characters. This permits the reference to be embedded or concatenated into surrounding text without Velocity interpreting the additional characters as part of the variable name.

The exclamation-mark form is a quiet reference . With $!identityName—or the formal quiet form $!{identityName}—Velocity suppresses the literal reference when the underlying value is null. This is useful in email templates because optional values should not produce visible strings such as $identityName when no value was supplied.

SailPoint ' s IdentityIQ documentation explicitly presents $identityName, ${identityName}, and $!identityName as VTL variable-reference forms and notes that the alternate forms are required in special situations. IdentityIQ email templates pass template arguments into the VelocityContext for this substitution.

References/topics: IdentityIQ Engineer — EmailTemplate objects, Apache Velocity, VTL references, formal references, quiet references.

=======

The primary and secondary colors in the IdentityIQ user interface are not set through the IdentityIQ Configuration > Miscellaneous page. Instead, these colors are typically configured through the style.css or other custom CSS files that are part of the IdentityIQ UI customization process. Administrators can define and modify the color scheme, fonts, and other style elements by editing the relevant CSS files or using the Branding feature within IdentityIQ.

Therefore, the correct answer is B. No.

The statement " The rule type must be IdentityAttribute " is correct. In SailPoint IdentityIQ, when writing a rule that is intended to map or manipulate identity attributes during the aggregation process, the rule type should be set to " IdentityAttribute " . This ensures that the rule is recognized and executed in the appropriate context for managing identity attributes.

Therefore, the correct answer is A. Yes.

The statement is incorrect. When writing and executing source mapping rules to populate identity attributes, the rule itself does not need to persist the identity attribute to the database. In SailPoint IdentityIQ, once the value for an identity attribute has been calculated by a source mapping rule, IdentityIQ automatically handles the persistence of this attribute to the database as part of the aggregation or provisioning process. The developer does not need to explicitly persist the attribute; this is managed by the system.

SailPoint IdentityIQ Source Mapping Guide

SailPoint IdentityIQ Administration Guide (Aggregation and Attribute Mapping Sections)

Yes. IdentityIQ role configuration can support conditional role requestability and assignment logic. A role does not have to be universally requestable for every identity. Engineers can restrict role availability through role configuration, assignment logic, population rules, request controls, or related role requirements depending on the implementation design. The proposed solution describes a role that can only be requested if the target user already has a related role. That is a valid access-governance pattern because role models often contain dependency relationships, prerequisites, or related-role structures. For example, a business role may make another IT role or application role meaningful only when the identity already satisfies a prerequisite access condition. This type of restriction prevents users from requesting access that is inappropriate outside a defined role relationship. The important engineering point is that IdentityIQ roles are not just static entitlement containers; they can include assignment rules, profiles, permitted/requestable behavior, and relationships that influence when they are visible or eligible during access requests. References/topics: IdentityIQ Engineer — role model design, requestable roles, role relationships, assignment rules, access-request governance.

Yes. IdentityIQ’s Lifecycle Manager workflows are built from reusable workflow components and subprocesses. Many standard LCM subprocesses can be called from custom workflows, provided the engineer understands the expected input variables, return variables, and control flags. This is a preferred engineering pattern because it avoids rewriting complex provisioning, approval, identity request, policy-checking, or notification logic from scratch. Input variables can alter behavior such as approval routing, provisioning mode, policy checking, notification behavior, target identity, requester, plan handling, and subprocess execution path. However, reuse requires discipline: the custom workflow must pass the correct variables, preserve expected types, and handle returned values correctly. Blindly calling an LCM subprocess without matching its contract can produce broken approvals or provisioning behavior. The proposed statement is therefore true because standard LCM subprocesses are intentionally reusable when controlled through documented workflow variables. References/topics: IdentityIQ Engineer — LCM workflows, subprocess reuse, workflow input variables, provisioning workflows, custom workflow development.

Yes. Policy checking behavior is one of the areas commonly controlled in LCM request workflows through workflow variables or configuration controlling policy evaluation mode. IdentityIQ can evaluate whether a requested access change would violate configured policies before the request is finalized or provisioned. Depending on configuration, the system can present policy violations to the requester, block submission, continue with warnings, or require additional approval/mitigation. The proposed behavior — checking whether an access request would violate policies and letting the requester review before submitting — aligns with interactive policy-checking behavior in LCM. This is an execution behavior of the request workflow, not an application schema setting. The engineer must still ensure policies are configured and enabled, but the workflow/control-variable layer can determine how those checks are applied during request submission. References/topics: IdentityIQ Engineer — LCM workflow control variables, policy checking, request policy violations, interactive policy review, access request governance.

Yes. A Boolean datatype is appropriate because the stated purpose is to flag privileged accounts . A flag normally represents a binary condition: the account either satisfies the privileged-account criteria or it does not. Consequently, true and false accurately represent the resulting classification.

The engineer can derive this Boolean from the Financial application ' s privileged attribute and/or calculate the result through logic involving the Keystore application ' s responsibility-code attribute. Once populated, the Boolean value can be referenced reliably from rules and policy conditions and can participate in searchable/analytics configuration when the associated attribute is configured appropriately.

This distinction also resolves the earlier Attribute Type: string proposition. A String could technically hold textual values, but the requirement here is specifically a Boolean privilege flag. Therefore, for this DOMC scenario, Boolean is the configuration that matches the requirement , while String should be answered No.

The bank already tests source mapping and edit mode for the same scenario but does not contain this Boolean proposition.

References/topics: IdentityIQ Engineer — account schema, Boolean attributes, privileged-account classification, source mapping, rules, policies.

=======

The statement that the Debug-Logging page does not have to be reloaded when the log4j file is altered while the application server is running is incorrect. In SailPoint IdentityIQ, if you modify the log4j configuration file while the application is running, you generally need to reload the Debug-Logging page to reflect those changes. Without reloading, the page will not display the updated logging configurations, and the changes will not take effect until the application server or the logging system within the server acknowledges those changes.

Therefore, the correct answer is B. No.

Yes, " Terminate Identity " is a default functionality of the Lifecycle Manager (LCM) module. This functionality is associated with the " Leaver " event, which manages the offboarding process for identities that are leaving the organization. The LCM module includes workflows that handle identity termination by deactivating accounts, removing access, and potentially triggering other actions needed to finalize the termination process.

Therefore, the correct answer is A. Yes.

Yes. Identity Attribute Changes are explicitly included among IdentityIQ ' s configurable built-in audit categories. Audit collection is not universally enabled for every possible event because recording large quantities of audit information has storage and performance implications. Administrators therefore select the activities that need to be captured through IdentityIQ ' s Audit Configuration.

SailPoint ' s IdentityIQ documentation lists several categories of auditable actions, including General Actions, Link Attribute Changes, Identity Attribute Changes , Class Actions, and SCIM Resource Actions. The Identity Attribute Changes category includes changes to identity-related information such as assigned roles, capabilities, authorized scopes, controlled scopes, passwords, and potentially configured extended identity attributes. Once the appropriate audit actions are enabled, resulting audit events can be searched through Advanced Analytics using the Audit search type.

This is different from merely enabling general application logging. Audit records provide governance-oriented evidence of defined actions, whereas application/server logging is primarily operational and diagnostic. Consequently, the proposition that built-in IdentityIQ audit functionality supports auditing Identity Attribute Changes is directly supported by the product configuration model.

References/topics: IdentityIQ Engineer — Audit Configuration, Identity Attribute Changes, Audit events, Advanced Analytics Audit search, governance logging.

=======

time → show how much time a command takes to run

source → execute a file of commands

run → launch a background task

import → import objects from a file

The statement that a BeanShell rule in IdentityIQ must always return an object derived from the abstract class sailpoint.object.SailPointObject is incorrect. While many rules in IdentityIQ may return objects that derive from SailPointObject, it is not a strict requirement. Rules can return various types of objects depending on their purpose and context. For example, a rule might return a String, Boolean, Map, or even null, depending on what the rule is designed to accomplish.

Therefore, the correct answer is B. No.

The statement is false. The " Run Rule " feature on the Debug-Object page is not intended for creating, modifying, or deleting SailPoint database objects. Instead, it is used to execute specific rules for testing and debugging purposes. While it allows you to test the logic of a rule by running it in isolation, it does not directly manipulate database objects. For creating, modifying, or deleting database objects, administrators would typically use the appropriate IdentityIQ APIs or database scripts.

SailPoint IdentityIQ Administration Guide (Debugging and Rule Management Sections)

SailPoint IdentityIQ Developer Guide (Working with Rules and Debugging Tools)

The statement is false. In SailPoint IdentityIQ, there is no strict limitation on nesting sub-workflows (subprocesses) up to 3 levels. You can nest sub-workflows as deeply as required by your business logic and system design. However, it is advisable to manage the complexity of nested workflows to ensure maintainability and performance, but there is no enforced limit of 3 levels for nesting.

SailPoint IdentityIQ Workflow Guide

SailPoint IdentityIQ Administration Guide (Sections on Workflow Design Best Practices)

Yes, specifying which access items may be requested can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In IdentityIQ, control variables within LCM workflows allow administrators to define the scope and criteria for access requests, including restricting or specifying which entitlements, roles, or applications can be requested by users. This is part of the request configuration process, where the access items that users can see and request are defined.

Therefore, the correct answer is A. Yes.

Yes. Domain information is a fundamental connection element when configuring IdentityIQ to interact with Active Directory. Active Directory is organized around forests and domains, and the connector must know the domain context in which user, group, membership, authentication, aggregation, and provisioning operations will occur.

In the IdentityIQ Active Directory connector ' s Domain Settings, the engineer configures the relevant forest and enters the Domain along with the required service-account information and authentication settings. The connector then uses this information to bind to the appropriate Active Directory domain controller environment and manage directory objects in the configured scope.

Specific connector releases also provide conveniences such as forest-level domain discovery or “Manage All Domains,” but these mechanisms do not eliminate the underlying Active Directory domain context. The connector still needs to know which domains it manages, whether they are explicitly configured or discovered under a forest configuration.

For the DOMC proposition as stated, Domain is therefore a required core Active Directory configuration concept, rather than an optional role-modeling or cosmetic application property.

References/topics: IdentityIQ Engineer — Active Directory connector, Domain Settings, forests and domains, service account configuration, connector authentication.

=======

This scenario describes an employee quitting their job and needing all of their accounts disabled, which aligns with a leaver lifecycle event rather than a mover event. A leaver event typically involves the deactivation of accounts and removal of access for users who are leaving the organization entirely, whereas a mover event involves changes to roles or access as part of an internal transition (e.g., promotion, transfer).

Therefore, the correct answer is B. No.

Yes, the Provisioning tab under the " Administrator Console " can be used to manually retry provisioning attempts for pending transactions. This feature allows administrators to retry failed provisioning operations or manually trigger provisioning actions that are in a pending state, providing greater control over the provisioning process.

SailPoint IdentityIQ Administration Guide (Provisioning Management and Manual Retry)

SailPoint IdentityIQ Provisioning Guide

The " Total Memory " value displayed on the JVM Memory page indicates the amount of memory currently allocated to the JVM heap. In the image provided, the " Total Memory " is shown as 725.617 MB. This is the amount of memory that the JVM heap is currently using, meaning it has been allocated and is available for the JVM to use.

SailPoint IdentityIQ Performance Tuning and Monitoring Guide

SailPoint IdentityIQ Administration Guide (JVM and Memory Management Sections)

Yes, " Business Role " is a default role type available in SailPoint IdentityIQ that a manager can request during the access request process. Business Roles typically represent a collection of entitlements or access rights that align with specific job functions or responsibilities within an organization. Managers can use this role type to extend or modify the access granted to an employee.

SailPoint IdentityIQ Role Management Guide

SailPoint IdentityIQ Administration Guide (Sections on Role Types and Access Request)

The statement " All Identity Mappings must use a rule to set the identity attribute " is incorrect. While source mapping rules can be used to populate identity attributes dynamically, it is not mandatory for all identity mappings to rely on a rule. Identity mappings can also be configured using direct mappings, where attributes from a source are directly mapped to IdentityIQ attributes without any rule-based logic.

Therefore, the correct answer is B. No.

No. A Bundle represents a role in IdentityIQ, and a Bundle profile is part of role definition logic, not something that must be associated directly to an Identity object. Profiles are used to describe conditions, constraints, or entitlement/application criteria associated with a role. Identities may be assigned roles, detected as matching roles, or evaluated against role profiles, but the Bundle profile itself is not required to be associated to a specific Identity object. This distinction is important because IdentityIQ’s role model is object-based: roles exist independently from the identities that hold them. A profile defines what the role means or how it is detected; identity role membership is a separate relationship. Saying that a Bundle profile must be associated with an Identity object incorrectly collapses role definition and identity assignment into one concept. References/topics: IdentityIQ Engineer — Bundle object, role profiles, role detection, role assignment, Identity object relationships.

This is a valid implementation pattern. The workflow requirement has three routing outcomes, and the proposed solution expresses them as three explicit transition elements. The first transition routes to Stop when the approval flag is false, which corresponds to the Reject or back action. The second transition routes to Audit when the comment variable is not null or empty, using sailpoint.tools.Util.isNotNullOrEmpty(comment). That satisfies the condition that the Approve action was used and the returned form field has a value. The final transition to Provision has no condition, making it the default fallback when the prior transition conditions are not satisfied. This is the correct style for workflow routing because the destination steps are explicitly declared through the to attribute, and the conditional routing is attached to each transition rather than relying on an invalid free-form return block. References/topics: IdentityIQ Engineer — workflow transitions, when conditions, script expressions, form approval routing, default workflow transition behavior.

The statement is false. In SailPoint IdentityIQ, while message files may indeed be added to support additional languages, the out-of-the-box supplied message files can also be modified. Administrators can customize these message files to adapt the text in the user interface to better suit the organization’s needs. This includes modifying existing translations or adding custom messages to meet specific requirements.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Configuration Guide (Customization of Message Files)

No. Create Entitlement is not one of the standard IdentityIQ Lifecycle Manager batch request operation types used for bulk access cleanup. The requirement concerns modifying users ' access: some identities need entitlements added while others need excessive access removed. IdentityIQ provides specific batch operations for those tasks.

SailPoint ' s supported batch request operations include Create Identity, Modify Identity, Create Account, Delete Account, Enable/Disable Account, Unlock Account, Add Role, Remove Role, Add Entitlement , Remove Entitlement , and Change Password. “Create Entitlement” does not appear as a standard batch request operation in this list. The distinction is fundamental: an entitlement is a governed access value represented through the application schema and usually as a ManagedAttribute in the Entitlement Catalog. Creating or maintaining that entitlement definition is different from granting an existing entitlement to identities.

For the described regional cleanup, Add Entitlement can repair missing access and Remove Entitlement can revoke excessive access. Therefore, “Create Entitlement” does not represent the appropriate supported batch request type and the proposed solution is false.

References/topics: IdentityIQ Engineer — Lifecycle Manager Batch Requests, AddEntitlement, RemoveEntitlement, ManagedAttribute versus entitlement assignment, bulk remediation.

=======

Yes, an Escalation Rule can be used to handle the scenario of automatically reassigning parts of an access review to a different certifier. In SailPoint IdentityIQ, Escalation Rules are often employed within certification campaigns to manage situations where a primary certifier has not completed their review within a specified timeframe. The rule can trigger actions such as reassigning the review items to a different certifier, thus ensuring that the certification process continues smoothly without delays.

Therefore, the correct answer is A. Yes.

In SailPoint IdentityIQ, what users can see and do is indeed partly controlled by their authorized scope. Authorized scopes define the range of objects (such as identities, roles, applications) that a user has access to. Scopes can be applied to limit access based on specific criteria, ensuring that users only interact with the data and functionalities relevant to their role or responsibility within the organization.

For example, a user with access to a specific scope may only view or manage identities within a certain department or geographical location, depending on how the scope is configured.

Therefore, the correct answer is A. Yes.