IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Questions and Answers

The scenario described involves disabling an account and removing all its entitlements on a particular application during Mover events. The Rapid Setup user interface in SailPoint IdentityIQ primarily handles common configurations like enabling or disabling accounts, assigning or unassigning roles, and triggering certifications during lifecycle events.

However, the combination of disabling an account and removing all its entitlements for a Mover event typically involves more detailed configuration that goes beyond the capabilities of the Rapid Setup interface. Achieving this would generally require creating a custom workflow or a specific rule that handles both disabling the account and removing entitlements based on the Mover event triggers.

Thus, the Rapid Setup UI cannot achieve this level of detailed configuration, making the correct answer B. No.

This is not a joiner lifecycle event. The person already existed in the organization and previously had accounts. The scenario says their access was disabled and now needs to be reinstated, which is a rehire or reactivation process. In IdentityIQ, that is fundamentally different from onboarding a brand-new employee. A joiner process generally provisions new access and new accounts for a person who is newly hired or newly introduced to the identity-governance system. A rehire or reinstatement process should evaluate prior access, reactivate appropriate accounts, restore or recalculate roles, and avoid re-enabling access that is no longer valid. The phrase “previous accounts enabled” is the key clue: existing accounts are being reactivated, not newly created. Therefore, this proposed scenario should not be classified as a joiner lifecycle event. References/topics: IdentityIQ Engineer — joiner/mover/leaver model, rehire processing, account reactivation, LCM workflow routing, disabled account enablement.

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

This statement is correct. The IdentityIQ rule editor is designed to assist engineers when writing BeanShell rules by exposing rule-context information, including available arguments/input variables for the selected rule type. In the editor, variables shown in the arguments list are not decorative; they represent objects or values IdentityIQ makes available to the rule at runtime. Being able to insert an input variable by interacting with the argument list is consistent with the purpose of the rule editor: helping the developer use the correct variable names and avoid spelling or context mistakes. This is especially important because rule arguments differ by rule type. A correlation rule, provisioning rule, workflow rule, and certification rule may each expose different variables. The proposed solution is therefore valid because the Rule Editor can use the rule registry metadata to present available arguments and support insertion into the BeanShell source. References/topics: IdentityIQ Engineer — BeanShell Rule Editor, rule arguments, Rule Registry, input variables, rule development tooling.

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

Yes. In IdentityIQ workflow processing, a wait step is not simply a client-side pause or a frozen browser session. The workflow case is persisted and resumed after the wait condition has elapsed and the maintenance process revives eligible workflow cases. A wait= " 1 " attribute represents a minimum wait period, and the workflow does not necessarily resume at the exact instant the wait expires. It resumes when IdentityIQ’s background maintenance processing detects that the wait period is over and advances the workflow. That is why the wording says “at least one minute” and “on the next run of the Perform Maintenance Task.” This distinction matters operationally: workflow timing depends on both the configured wait value and the maintenance task schedule. Engineers should not use wait steps when exact real-time execution is required. References/topics: IdentityIQ Engineer — workflow wait attribute, persisted workflow cases, Perform Maintenance task, background workflow resumption, workflow step behavior.

The statement is false. While it is true that logging and auditing require extra function calls and generate data, the suggestion that this data can be compressed to avoid storage issues and improve performance is misleading. In practice, while compression might save storage space, it does not inherently improve performance, particularly because the overhead of compression and decompression could negate the performance benefits. Effective performance management in IdentityIQ involves more nuanced approaches, such as optimizing the level of detail in logs, managing log rotation, and tuning the system for efficient I/O operations.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Performance Tuning Guide

Allowing a user to create a new identity cube in IdentityIQ is not a scenario that can be achieved through QuickLink populations. QuickLink populations are used to define which users have access to specific QuickLinks or tasks in the IdentityIQ interface. They do not control the creation of identity cubes, which is a function typically handled through the aggregation process, API calls, or specific administrative actions within the IdentityIQ platform. The creation of an identity cube involves data import and transformation processes, not just a UI-level permission.

Therefore, the correct answer is B. No.

No. Launching certification campaigns is not default Lifecycle Manager functionality. Lifecycle Manager focuses on identity lifecycle and access-request operations such as joiner, mover, leaver processing, access requests, account management, approvals, and provisioning workflows. Certification campaigns belong to IdentityIQ’s access review and compliance/certification capabilities, not LCM’s default functional scope. Certifications are used to review access, roles, entitlements, policy violations, or account/group membership and then require reviewers to approve, revoke, or otherwise act on access. LCM may interact with certification results indirectly because remediation from a certification can trigger provisioning or access changes, but launching the campaign itself is a certification/compliance function. This question tests whether the engineer separates lifecycle-request processing from access-review governance. Mixing them up leads to poor module design and incorrect implementation expectations. References/topics: IdentityIQ Engineer — Lifecycle Manager, access request, provisioning workflows, certification campaigns, Compliance Manager.

No. Out-of-the-box LCM workflow control variables govern the runtime behavior of an LCM process , not the population of users authorized to launch the entry point. Control variables can influence processing such as approvals, notifications, policy checking, provisioning behavior, background/foreground execution, templates, and other workflow decisions.

Determining who can launch an LCM operation belongs at the authorization and QuickLink layer. IdentityIQ commonly controls QuickLink availability through QuickLink populations, capabilities, dynamic scopes, and related visibility or access configuration. Once an authorized user launches the operation, the associated LCM workflow executes using its configured control variables.

This architectural distinction matters. A workflow variable can change what happens after invocation, but it should not be confused with the security mechanism that decides whether a particular identity is permitted to invoke that functionality in the first place.

The question bank itself distinguishes this design layer in related LCM propositions: workflow variables control execution behavior, while application or UI eligibility is configured elsewhere.

References/topics: IdentityIQ Engineer — LCM workflow control variables, QuickLinks, QuickLink populations, capabilities, workflow authorization, dynamic scopes.

=======

No. The challenge period is not designed to let the reviewer ' s manager challenge the reviewer ' s certification decisions. Its purpose is to give the affected user whose access is being removed an opportunity to respond to the revocation.

When a certification enters the optional challenge phase, IdentityIQ generates a work item and notification for users affected by revocation decisions. The affected identity can accept the loss of the role, entitlement, or account-group access, or challenge the revocation. Any challenged items must subsequently be handled as part of the certification lifecycle.

A reviewer ' s manager can be relevant to certification processing, but through different mechanisms. For example, escalation can transfer an unfinished access review to another identity, commonly the certifier ' s manager, and multi-level sign-off can introduce another approver after the original certifier. Those mechanisms must not be confused with the challenge phase.

Therefore, the proposition assigns challenge rights to the wrong actor. The person whose access is subject to revocation—not the original reviewer ' s manager—is the participant for whom the challenge period exists.

References/topics: IdentityIQ Engineer — certification challenge phase, revocation decisions, affected identity, escalation, multi-level sign-off.

=======

No. Specifying which applications support new account requests is not normally achieved by changing control variables in the out-of-the-box LCM workflows. That behavior is driven by application configuration, provisioning support, account creation policies, schemas, QuickLink configuration, and requestability settings. LCM workflow control variables influence how an already-launched workflow behaves: approval handling, policy checking, provisioning behavior, notifications, foreground/background behavior, trace/debug options, and similar execution controls. They do not define whether an application itself supports account creation. For an application to support new-account requests, the application must support provisioning, have the relevant create-account capability/configuration, and expose the request path through LCM/QuickLink settings. Putting this into workflow control variables would be the wrong design layer. References/topics: IdentityIQ Engineer — LCM workflows, control variables, application provisioning configuration, Create Account policy, Manage Accounts/Manage User Access.

Not all Application objects in SailPoint IdentityIQ must have an Identity object as the owner. While it is common practice to assign an owner to an Application object for governance and administration purposes, it is not a strict requirement. Applications can exist without a direct association to an Identity object. The ownership concept in IdentityIQ is more of a best practice for accountability rather than a mandatory attribute. Refer to the SailPoint IdentityIQ Application Definition Guide for more information on the configuration and management of Application objects.

This is not a clean joiner lifecycle event. A joiner event normally represents a person newly entering the organization or being newly onboarded into managed access, usually requiring new identity setup, new accounts, baseline access, roles, approvals, and provisioning. The proposed scenario describes a contractor whose previous relationship ended, whose accounts were disabled, and who now has a new contract requiring previous accounts to be enabled. That is closer to a rehire/reactivation or account-enable lifecycle event than a first-time joiner. The distinction matters in IdentityIQ because a true joiner process may create accounts and assign initial access, while a rehire/reactivation process may restore, enable, or reassess previously existing accounts and access. Treating this as a joiner could create duplicate accounts or duplicate access instead of properly reactivating existing Links/accounts. References/topics: IdentityIQ Engineer — Lifecycle Manager, joiner event, rehire/reactivation, account enablement, identity lifecycle workflow design.

This proposed implementation is not valid as written. The logic is conceptually understandable, but the XML structure is not the correct IdentityIQ workflow transition pattern. In IdentityIQ workflows, transitions are normally declared using < Transition > elements with a destination, such as to= " StepName " , and optional conditional logic through a when expression or scripted evaluation. A raw < Source > block directly inside < Transition > returning destination names is not the standard structure for expressing multiple workflow routing paths after a form step. The engineer’s requirement is to route to Stop when the reject/back action is used, route to Audit when approval occurs and the comment variable is populated, and route to Provision as the fallback. That should be implemented as separate transition definitions with explicit destination steps and conditions. The proposed XML does not properly bind the returned values to valid transition destinations in the expected workflow syntax. References/topics: IdentityIQ Engineer — workflow XML, transition elements, form step routing, BeanShell expressions, Business Process Editor.

The statement that supported platforms of an older version of IdentityIQ will always be supported in newer versions of IdentityIQ is incorrect. As SailPoint releases new versions of IdentityIQ, the list of supported platforms (such as specific versions of Java, databases, application servers, etc.) may change. Newer versions of IdentityIQ might deprecate support for older platforms or require newer versions of software components. It is essential to consult the Release Notes or the Supported Platforms documentation for the specific IdentityIQ version to ensure compatibility.

Thus, the correct answer is B. No.

Yes. IdentityIQ email templates use the Apache Velocity Template Language (VTL) , and these forms are valid Velocity reference syntaxes. $identityName is the normal shorthand reference. ${identityName} uses formal notation, which is particularly useful when the variable reference must be clearly separated from immediately adjacent characters. This permits the reference to be embedded or concatenated into surrounding text without Velocity interpreting the additional characters as part of the variable name.

The exclamation-mark form is a quiet reference . With $!identityName—or the formal quiet form $!{identityName}—Velocity suppresses the literal reference when the underlying value is null. This is useful in email templates because optional values should not produce visible strings such as $identityName when no value was supplied.

SailPoint ' s IdentityIQ documentation explicitly presents $identityName, ${identityName}, and $!identityName as VTL variable-reference forms and notes that the alternate forms are required in special situations. IdentityIQ email templates pass template arguments into the VelocityContext for this substitution.

References/topics: IdentityIQ Engineer — EmailTemplate objects, Apache Velocity, VTL references, formal references, quiet references.

=======

In SailPoint IdentityIQ, a Workgroup can indeed be used to provide a group of users with specific capabilities. Workgroups are collections of users that can be assigned roles, tasks, and permissions. By associating capabilities with a Workgroup, all members of that Workgroup will inherit the capabilities defined.

This feature is commonly used to manage teams or departments that need to share specific privileges, such as the ability to approve access requests or manage certifications. Configuring capabilities for a Workgroup is a standard practice within IdentityIQ to simplify permission management and ensure consistent access control across the group.

Therefore, the correct answer is A. Yes.

Inserting the " Managers " QuickLink population as the dynamic scope in the QuickLink object is a valid step when creating a custom QuickLink that should only be accessible by managers. QuickLink populations are used to define which users have access to specific QuickLinks based on criteria like role, department, or other attributes. By assigning the " Managers " population, only users who are members of that population will see and be able to launch the QuickLink.

Therefore, the correct answer is A. Yes.

Rapid Setup does allow for specifying account correlation by mapping an identity attribute to an account attribute. This is a standard part of the onboarding process where you define how IdentityIQ should correlate accounts to identities. This basic mapping functionality is included in Rapid Setup to facilitate straightforward account correlation during application onboarding.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Mapping Sections)

The four minimum steps necessary to extend attributes in an IdentityIQ database after it has been created, in the correct order, are:

Update the corresponding hibernate file with the new attributes.

The Hibernate mapping file needs to be updated with the new attributes so that the SailPoint IdentityIQ application is aware of the new columns or properties in the database. This step ensures that the object-relational mapping (ORM) reflects the updated data model.

Run the command to generate the script to update the IdentityIQ database.

After updating the Hibernate file, a schema update script is generated. This script contains the necessary SQL commands to modify the database schema based on the new attributes added in the Hibernate file.

Shut down the application server and then run the generated extendedSchema script on the IdentityIQ database.

Before applying schema changes, the application server must be stopped to avoid any transactional conflicts. Afterward, the extendedSchema script is run on the database to apply the new attributes.

Start the application server and update the corresponding ObjectConfig.

Once the database schema is updated, restart the IdentityIQ application server and modify the ObjectConfig in SailPoint to register the new attributes for use within the IdentityIQ platform.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Updating the Hibernate File: This step involves modifying the Hibernate XML or annotation-based mapping files to reflect the new attributes that are being added to the database. SailPoint IdentityIQ uses Hibernate as its ORM, and any new database fields must first be defined at this layer.

Generating the Schema Update Script: SailPoint provides a command (usually via iiq console or build tools) that reads the updated Hibernate mapping and generates a database-specific script to alter the schema. This ensures that the database is modified in a way that matches the application ' s expectations.

Running the Schema Update Script: With the application server stopped, the schema update script is executed on the database. This step adds the new columns, indexes, or constraints that are required for the extended attributes.

Updating the ObjectConfig: Once the database is updated and the application server is running again, the ObjectConfig (typically located in the IdentityIQ admin UI) must be updated to incorporate the new fields. This step ensures that these new attributes are accessible to workflows, forms, and identity data within the system.

SailPoint IdentityIQ Installation and Configuration Guide (sections on extending the data model and schema updates).

The statement is incorrect. Email templates in SailPoint IdentityIQ are not restricted to just Identity object attributes or methods. They can access attributes and methods of any object passed to the template through its input arguments, including WorkItems, CertificationItems, and others. The template system allows the use of various objects’ properties as long as they are properly referenced within the script or template context.

Yes. An Escalation Rule is designed exactly for this type of certification/access-review handling. In IdentityIQ certifications, an escalation process can be configured so that when a reviewer does not complete required certification work within a defined period, the work item can be escalated, reassigned, or otherwise routed according to business logic. The proposed scenario says that if an access review remains incomplete after 7 days, it should be reassigned to the certifier’s manager. That is a valid escalation pattern because the triggering condition is time-based non-completion, and the action is reassignment to another responsible reviewer. The certifier’s manager can be resolved from the identity relationship and used as the new owner or recipient of the escalated work item. The key point is that escalation rules are not used to generate certifications; they are used to control what happens when review work is overdue or requires escalation. References/topics: IdentityIQ Engineer — certification lifecycle, access review work items, escalation rules, reviewer reassignment.

Yes. This is the classic joiner lifecycle event. The person has not previously been with the company, has now been hired, and needs new access and new accounts. In IdentityIQ Lifecycle Manager terms, a joiner process usually starts from an authoritative-source change such as a new HR record. The process may create or activate the Identity Cube, assign birthright roles, request or automatically provision accounts, calculate policies, trigger approvals, and send notifications. Unlike rehire or reinstatement scenarios, there are no existing disabled accounts to restore. The access model should be built from onboarding rules, role assignment logic, provisioning policies, application create policies, and approval workflows. This is exactly why joiner workflows exist: to standardize new-person onboarding and ensure access is created consistently, securely, and audibly. References/topics: IdentityIQ Engineer — joiner lifecycle event, LCM onboarding, birthright access, account creation, provisioning policy, role assignment.

No. An individual SPRight is a granular IdentityIQ product right, but roles do not normally grant an arbitrary standalone SPRight directly as a role entitlement. IdentityIQ groups SPRights into Capabilities , which provide logical collections of rights associated with administrative or functional job responsibilities.

The Role Editor provides a Granted IdentityIQ User Rights section where an engineer can associate IdentityIQ capabilities and scopes with a role. When that role is assigned and role provisioning is processed through Identity Refresh, the corresponding capabilities and scopes can be granted to the identity. This is the supported role-level abstraction.

The distinction matters because an SPRight controls granular access to specific IdentityIQ UI functions, tools, pages, or operations, while a Capability groups one or more SPRights into a maintainable authorization construct. Directly treating a single SPRight as an ordinary role option bypasses the intended rights-to-capability model.

Therefore, although a role can grant IdentityIQ user rights indirectly through configured capabilities, the proposed statement that the role is configured to include a single SPRight object is not the valid role configuration model.

References/topics: IdentityIQ Engineer — SPRight, Capability, Granted IdentityIQ User Rights, Role Editor, authorization model.

=======

Yes. A self-service registration workflow needs a Registration Identity Provisioning Policy because the policy defines what identity data must be collected, displayed, validated, or constrained during registration. LCM Registration is not merely a generic workflow button; it needs a controlled data-entry model for creating or initiating an identity record through self-service. The Registration Identity Provisioning Policy provides that model by defining registration fields, required inputs, allowed values, validation behavior, and potentially default or derived values. Without it, the workflow lacks the structured policy definition needed to support registration-specific identity creation. This is separate from ordinary Create Identity or Edit Identity policies because self-service registration usually has different security and usability requirements. Public or semi-public registration should expose only carefully selected fields and should validate values tightly. Therefore, the proposed configuration is required for the self-service registration use case. References/topics: IdentityIQ Engineer — LCM Registration, self-service registration workflow, Identity Provisioning Policies, registration fields, validation logic.

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in the provisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.

This is not a valid development step. A Quicklink is configured as an IdentityIQ object that exposes an action to users through the UI and can be configured to launch a workflow. The workflow does not contain or “host” the Quicklink object. The relationship is the other way around: the Quicklink references the workflow it should launch. To restrict the Quicklink to managers only, the engineer should configure visibility, population, capability, or dynamic eligibility logic so only manager identities can see or execute it. Then the Quicklink configuration should identify the workflow to invoke and pass any required arguments into that workflow. Placing a Quicklink object “on” the workflow is not how IdentityIQ Quicklink architecture works. The proposed solution confuses the launching object with the launched process. References/topics: IdentityIQ Engineer — Quicklink object, workflow launch configuration, manager-only visibility, population rules, workflow arguments.

Yes, specifying which access items may be requested can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In IdentityIQ, control variables within LCM workflows allow administrators to define the scope and criteria for access requests, including restricting or specifying which entitlements, roles, or applications can be requested by users. This is part of the request configuration process, where the access items that users can see and request are defined.

Therefore, the correct answer is A. Yes.

No. QuickLink population membership is not an exclusive one-population relationship. IdentityIQ can evaluate an identity against multiple QuickLink population definitions, and the same identity can satisfy the membership criteria for multiple populations.

QuickLink populations are used to govern which QuickLinks users can access and, for “For Others” use cases, which target identities they may act upon. Populations can be based on identity attributes, capabilities, workgroups, individual identities, or other configured membership logic. Because those criteria can overlap, there is no general requirement that an identity belong to only one population.

For example, the same employee could satisfy a Managers population, a particular geographic population, and another population associated with access-request functionality. IdentityIQ evaluates the applicable configuration rather than forcing those groups to be mutually exclusive.

The Word bank itself contains examples where QuickLink population configuration controls access to manager-only QuickLinks, reinforcing that populations represent authorization groupings rather than a single-valued classification.

Therefore, “at most one QuickLink population” is false.

References/topics: IdentityIQ Engineer — QuickLink populations, authentication and authorization, population membership, capabilities, workgroups, QuickLink visibility.

=======

Yes. Account Groups are commonly used to represent entitlement-bearing group or application objects from a target system. SailPoint documentation uses the terms account group and application object closely, and many applications model access through membership in groups. During aggregation, an account may contain an entitlement attribute such as groups, memberOf, roles, or another group-membership attribute.

When the application also defines a group schema, IdentityIQ can aggregate the group objects themselves. The account schema ' s entitlement attribute is linked to the group schema by setting its type to the applicable native object type—commonly group. IdentityIQ can then associate the entitlement values found on accounts with the corresponding group objects.

These group values can become ManagedAttribute objects and appear in the Entitlement Catalog, where IdentityIQ can attach governance information such as owner, description, requestability, and certification metadata. This allows the target-system group to function as a governed entitlement.

Therefore, representing a particular group-based entitlement associated with accounts on a target system is an appropriate Account Group use case.

References/topics: IdentityIQ Engineer — Account Groups, Application Objects, group schemas, ManagedAttribute, Entitlement Catalog, account entitlements.

=======

No. IdentityExtended.hbm.xml defines extended persistence mappings for additional Identity attributes; it does not represent the complete set of attributes available on the Identity object. Therefore, seeing custom mappings such as employeeId and status in the displayed configuration does not mean that these are the only identity attributes in the installation.

IdentityIQ requires several fundamental identity attributes for normal product operation. SailPoint specifically identifies core attributes including ID, manager, email, firstname, and lastname in Identity Mapping configuration. These standard properties exist independently of customer-defined extended fields. The numbered extended properties and custom named properties shown in IdentityExtended.hbm.xml supplement that standard Identity object model rather than replacing it.

The Word bank contains a different proposition for this same IdentityExtended.hbm.xml scenario concerning how many additional searchable attributes can be configured, demonstrating that the extended mapping is specifically concerned with schema extension rather than defining the entire Identity object.

Therefore, the conclusion that firstname and lastname would be missing simply because they are not shown in this extended mapping is incorrect.

References/topics: IdentityIQ Engineer — Identity object, Identity Mappings, IdentityExtended.hbm.xml, core identity attributes, extended attributes, searchable attributes.

=======

Yes. IdentityIQ supports certain UI branding customizations, but product attribution requirements still matter. If a customer removes SailPoint branding from a prominent UI location such as the header bar, the product attribution should still be preserved elsewhere, such as in the copyright footer with wording like “Powered by SailPoint IdentityIQ.” This reflects the distinction between cosmetic branding changes and removal of required product identification. From an engineering standpoint, UI customization should be implemented carefully so it survives upgrades as much as possible and does not violate branding, licensing, or support expectations. Teams should also document all branding changes because customized UI files are commonly impacted during upgrades and patching. The proposed statement is valid because it preserves SailPoint product attribution while allowing the customer to modify the visible header branding. References/topics: IdentityIQ Engineer — UI customization, branding requirements, copyright footer, upgrade-safe customization, customer-specific UI changes.

This implementation is not correct. The requirement is to return all account names for an identity on the application MagicBox, but the code retrieves only a single Link by calling service.getLink(identity, " MagicBox " ). Even worse, the while (link != null) loop never changes the link variable, so if a link is found, the loop becomes infinite and repeatedly adds the same native identity. A correct implementation must retrieve the application object, obtain all matching Link objects for the identity and application, iterate over that list, and add each link’s native identity once. There is also no visible import for ArrayList or List, although BeanShell environments may sometimes tolerate imports differently. The fatal issue remains the flawed loop and single-link retrieval. IdentityIQ account data is represented by Link objects, and multiple accounts may exist for the same identity on the same application depending on connector and policy design. References/topics: IdentityIQ Engineer — IdentityService, Link objects, native identity, BeanShell API usage, account lookup logic.

Yes. For a Risk Policy violation, Certify is a valid action when the user handling the violation has the necessary permissions. IdentityIQ policy types can expose different response options, and the available disposition is not identical for every policy category.

Certify allows the responsible governance user to initiate certification-related review rather than simply accepting the violation or immediately remediating access. This is useful when a risk violation identifies access or identity conditions that warrant a formal review by an appropriate certifier before a final access decision is made.

This question must also be kept separate from the Account Policy propositions in the Word bank. The bank contains Account Policy propositions such as Schedule Policy Composition Certification—which it marks invalid—and Allow, which it marks valid. The policy type in the video is specifically Risk Policy , and DOMC evaluates the proposed action in that policy-type context.

Therefore, Certify is a valid option for the stated Risk Policy violation.

References/topics: IdentityIQ Engineer — Risk Policy, policy violations, Certify action, Compliance Manager, certification launch, violation disposition.

=======

This is a valid process. The requirement has two parts: detect a specific Division transition and confirm that the identity is a manager. A rule-based lifecycle event trigger is appropriate when the condition is more complex than a simple single-attribute check. The rule can inspect the previous and new values of the Division attribute and return true only when the value changes from IT to Senior IT. It can also evaluate the identity’s managerStatus value on the Identity Cube to confirm that the user is a manager. Returning true from the rule allows IdentityIQ to launch the associated workflow only for identities that satisfy both conditions. This approach avoids the flaw of triggering on the wrong attribute and gives the engineer precise control over the lifecycle event condition. The key is that the rule must be written against the correct before-and-after identity data available during refresh or lifecycle-event evaluation. References/topics: IdentityIQ Engineer — rule-based lifecycle triggers, identity attribute changes, Identity Cube attributes, workflow launch rules, mover-event logic.

One of the primary purposes of an IdentityIQ certification is to provide reviewers with a snapshot of a user ' s system access at a given point in time. This snapshot allows managers, auditors, or other designated reviewers to verify whether the access privileges assigned to a user are appropriate, based on their job responsibilities and compliance requirements. By reviewing this snapshot, organizations can identify and remediate any inappropriate or excessive access, thus maintaining a secure and compliant environment.

Therefore, the correct answer is A. Yes.

This is a valid implementation pattern. The workflow requirement has three routing outcomes, and the proposed solution expresses them as three explicit transition elements. The first transition routes to Stop when the approval flag is false, which corresponds to the Reject or back action. The second transition routes to Audit when the comment variable is not null or empty, using sailpoint.tools.Util.isNotNullOrEmpty(comment). That satisfies the condition that the Approve action was used and the returned form field has a value. The final transition to Provision has no condition, making it the default fallback when the prior transition conditions are not satisfied. This is the correct style for workflow routing because the destination steps are explicitly declared through the to attribute, and the conditional routing is attached to each transition rather than relying on an invalid free-form return block. References/topics: IdentityIQ Engineer — workflow transitions, when conditions, script expressions, form approval routing, default workflow transition behavior.

The statement is false. In SailPoint IdentityIQ, while message files may indeed be added to support additional languages, the out-of-the-box supplied message files can also be modified. Administrators can customize these message files to adapt the text in the user interface to better suit the organization’s needs. This includes modifying existing translations or adding custom messages to meet specific requirements.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Configuration Guide (Customization of Message Files)

time → show how much time a command takes to run

source → execute a file of commands

run → launch a background task

import → import objects from a file

In SailPoint IdentityIQ, every Link object, which represents an account on an application for an identity, must be associated with an Identity object. The Link object is inherently tied to an identity, as it is a representation of that identity’s account on a target system. Without this association, the Link would not have context within IdentityIQ. This is a fundamental aspect of IdentityIQ ' s data model. Refer to the SailPoint IdentityIQ Data Model documentation for detailed information on the relationships between Link objects and Identity objects.

The correct sequence of steps to turn on Certifications logging at the severity log level of trace is as follows:

Edit the file: [IdentityIQ installation] > WEB-INF > classes > log4j.properties.

This step involves accessing the configuration file where logging parameters are managed. The log4j.properties file is crucial for adjusting logging settings such as the log level for specific modules in SailPoint IdentityIQ.

Uncomment the out-of-the-box logger #log4j.logger.sailpoint.api.Certification=info.

This step enables the logger for Certification by removing the comment from the respective line in the log4j.properties file. This makes the logger active for the certification process.

Change the log level to trace and save.

After uncommenting the logger, change the log level from info to trace. The trace level provides the most detailed logging, capturing comprehensive information about the certification process for troubleshooting.

Restart the application server.

Restarting the application server is necessary for the changes in the log4j.properties file to take effect. SailPoint IdentityIQ reads the updated configuration during the startup process.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Editing the log4j.properties file is a standard practice in SailPoint IdentityIQ for configuring logging. This file, located in the WEB-INF/classes directory, controls how and what IdentityIQ logs for different components.

Uncommenting the specific logger is needed to ensure that the system is logging the events related to certification. The commented line #log4j.logger.sailpoint.api.Certification=info can be found in the default configuration and needs to be activated for proper logging.

Setting the log level to trace is crucial because trace provides the most detailed logging, which is essential for deep debugging or tracking granular details about the certifications in IdentityIQ.

Restarting the server ensures that the changes to the logging configuration are applied, as the settings in log4j.properties are only read during the startup phase.

SailPoint IdentityIQ Log Management and Troubleshooting Guide (section on adjusting log levels and configurations).

No. Identity search is designed to search Identity objects and identity-related attributes, not to count certification campaigns or certification items in a specific lifecycle phase. “Revocation phase” belongs to the certification/remediation process, not the Identity object itself. To identify the number of certifications currently in revocation, an engineer should use certification search, certification reports, task/report output, or direct certification-related reporting depending on implementation permissions. Using Identity search would return identities, not certification phase counts. Even if an identity is involved in a revocation action, the certification’s phase/status is not the primary searchable object in Identity search. This is similar to the Word bank’s distinction that Syslog search is for log events and not for unrelated governance object queries. The proposed use case is therefore outside the Identity search type’s purpose. References/topics: IdentityIQ Engineer — Identity search, certification lifecycle, revocation phase, certification reporting, Advanced Analytics.

In SailPoint IdentityIQ, the specific configuration that allows a user to enable an account for themselves or a subordinate through the " Manage Accounts " option does not necessarily need to be configured in Lifecycle Manager (LCM) alone. While LCM does provide extensive capabilities for account management actions like provisioning, rehire, and more, enabling an account is primarily tied to the permissions and entitlements granted to the user through their role, capabilities, and access profiles.

To address the specific functionality described:

Manage Accounts is typically a part of IdentityIQ’s broader account management capabilities, which are not exclusively tied to LCM. The ability to enable or disable accounts can be governed by rules and workflows within IdentityIQ, and these may or may not be linked directly to LCM configurations.

Rehire Action in LCM: The " Rehire " action within LCM Configuration is specific to processes related to reactivating an employee’s identity when they are rehired. This does not directly relate to enabling an account from the " Manage Accounts " screen. Rehire workflows typically involve reinstating the user’s previous access, which could include enabling accounts, but this is a broader process.

Permissions and Roles: The ability to enable accounts is often governed by the permissions assigned to a user’s role within IdentityIQ. These permissions may be granted outside of LCM configurations and handled by IdentityIQ’s access governance framework.

Workflow Configurations: Enabling or disabling an account could also be tied to specific workflows, which can be configured separately from LCM, using IdentityIQ’s workflow engine. These workflows determine the steps and approvals required to perform such actions.

SailPoint IdentityIQ Configuration Guide: Account Management

SailPoint IdentityIQ Lifecycle Manager Configuration Guide

SailPoint IdentityIQ Administration Guide (Sections on Roles and Permissions, Workflow Configurations)

Yes. This is a recognized IdentityIQ BeanShell debugging technique for inspecting the variables available in the current rule ' s BeanShell namespace. BeanShell exposes the namespace variable names through this.variables. The loop processes each name, evaluates it through eval(name), determines whether its value is void, null, or an actual Java object, and prints the variable together with its runtime type and value.

This is valuable because the effective variables available to a rule can depend on both the rule type and the context from which that rule is invoked. The Rule Editor documents normal Arguments and Returns, but runtime inspection can expose the actual namespace provided during a specific execution.

SailPoint ' s published debugging example uses essentially this same pattern and describes it as dumping all variables available in the BeanShell namespace. Newer versions of the example add a check to skip transient, because that name is a Java reserved word and can cause eval() problems in some workflow contexts. That refinement does not invalidate the basic diagnostic technique shown in the question.

References/topics: IdentityIQ Engineer — BeanShell namespace, Rule Editor Arguments/Returns, this.variables, eval(), rule debugging.

=======

Yes, an Escalation Rule can be used to handle the scenario of automatically reassigning parts of an access review to a different certifier. In SailPoint IdentityIQ, Escalation Rules are often employed within certification campaigns to manage situations where a primary certifier has not completed their review within a specified timeframe. The rule can trigger actions such as reassigning the review items to a different certifier, thus ensuring that the certification process continues smoothly without delays.

Therefore, the correct answer is A. Yes.

Certifying user expense reports is not a purpose of IdentityIQ certification. IdentityIQ certifications are focused on access and identity governance, specifically reviewing and validating user access rights within systems. Expense report certification would be a different process, typically managed by financial or expense management systems, not by IdentityIQ.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

Yes. IdentityIQ workflow steps support several action types, and both Script and Rule actions execute logic implemented with Java BeanShell.

A Script action contains BeanShell code directly within the workflow step. This is useful for workflow-specific logic that is short or tightly coupled to that business process. In workflow XML, the script may appear inline or inside a nested < Script > < Source > ... < /Source > < /Script > block.

A Rule action also executes BeanShell code, but the code is encapsulated in a reusable IdentityIQ Rule object rather than embedded directly in the workflow. This is preferable when logic needs to be reused, separately maintained, or invoked by multiple workflows or other IdentityIQ components.

IdentityIQ distinguishes these action types from Subprocess , which launches another Workflow object, and Call Method , which invokes a compiled Java method exposed through the IdentityIQ workflow library.

SailPoint ' s workflow documentation explicitly describes Script as executing Java BeanShell code and Rule as executing a reusable workflow Rule containing Java BeanShell code. Therefore, the proposed statement accurately characterizes both action types.

References/topics: IdentityIQ Engineer — Workflow Step actions, Script, Rule, BeanShell, Subprocess, Call Method, Business Process Editor.

This is a valid step. To create a custom audit event in IdentityIQ, the event/action must be registered so the audit framework recognizes it. Adding an AuditAction entry in the AuditConfig object XML is the correct type of configuration because it defines the audit action name, display name, and enabled state. The name value is the internal audit action identifier that code, rules, workflows, or tasks can use when writing audit records. The displayName provides the readable label, and enabled= " true " allows the event to be captured. This step alone is not the entire solution because the engineer must also write logic to create the audit record and configure a report to query and display it. However, the question asks whether this is one of the required steps, and it is. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction XML, custom audit actions, audit event enablement, audit report setup.

Yes. Every configured IdentityIQ application requires a Name because the Application object must have a unique logical identifier within IdentityIQ. The Name is not an Active Directory-specific connector parameter such as a domain controller, service account, or forest; it is a fundamental property of the IdentityIQ Application object itself.

IdentityIQ uses the application name throughout the platform when referencing the configured source or target. Application definitions, aggregation tasks, provisioning plans, rules, certifications, policies, reports, ManagedAttributes, Link objects, and workflow logic can all rely on the application identity. Without a usable application name, IdentityIQ could not reliably distinguish one configured Application object from another.

SailPoint ' s application configuration procedure therefore begins with the Details page and requires the engineer to enter the application Name before configuring connector-specific settings. The application type then determines the additional Active Directory configuration fields that become available.

Thus, regardless of the fact that this application uses the Active Directory connector, Name remains a required configuration option.

References/topics: IdentityIQ Engineer — Application object, Application Definition, Name, connector configuration, Active Directory application onboarding.

=======

No. Profile Class is explicitly an optional application configuration property. Its purpose is role modeling, not connectivity to Active Directory. A Profile Class allows multiple applications to be logically associated with a larger application class so a single role profile can apply across those applications.

For example, several similar application instances can share the same Profile Class so that role-detection logic does not require a separate profile for every individual instance. This can simplify enterprise role modeling, but it is not necessary for IdentityIQ to connect to Active Directory, aggregate accounts or groups, correlate accounts, perform certifications, or provision access.

SailPoint ' s Edit Application documentation describes Profile Class as an optional class used to associate an application with a larger set of applications for role-modeling purposes. This differs fundamentally from required connector configuration such as application identity, schema, forest/domain information, and authentication details.

An engineer may therefore configure Profile Class when the organization ' s role model requires it, but an Active Directory application can be successfully configured and operated without one.

References/topics: IdentityIQ Engineer — Profile Class, Application Definition, role modeling, Active Directory connector, optional application properties.

=======

Yes. The Run Rule capability in the IdentityIQ debug/admin tooling is useful for executing BeanShell rule logic and viewing the result, especially during development or troubleshooting. When an engineer writes a simple rule that returns a value, the Run Rule feature can be used to validate the logic and observe the returned output. This is useful for quick testing of rules that evaluate identity attributes, build strings, test object lookups, or verify small pieces of BeanShell logic before embedding the rule into a workflow, lifecycle event, policy, certification configuration, or application configuration. However, this feature must be used carefully because rule execution can interact with real IdentityIQ objects depending on the code. The benefit described in the proposed solution is narrow and valid: displaying the return value of simple code is a legitimate use case. It is not the same as saying the feature should be used for unrestricted database manipulation. References/topics: IdentityIQ Engineer — Debug pages, Run Rule, BeanShell rules, rule testing, troubleshooting.

The statement that the Debug-Logging page does not have to be reloaded when the log4j file is altered while the application server is running is incorrect. In SailPoint IdentityIQ, if you modify the log4j configuration file while the application is running, you generally need to reload the Debug-Logging page to reflect those changes. Without reloading, the page will not display the updated logging configurations, and the changes will not take effect until the application server or the logging system within the server acknowledges those changes.

Therefore, the correct answer is B. No.

Yes. Sub-workflows are an established IdentityIQ workflow-design mechanism for decomposing a large business process into smaller, reusable units. Instead of placing provisioning, approval, initialization, policy-checking, notification, and other logic into one oversized master workflow, an engineer can move logically independent functions into workflows designated as Subprocess workflows. The parent workflow then invokes those subprocesses at the appropriate processing steps.

SailPoint specifically identifies simplification of the master workflow as one of the benefits of subprocess workflows. The design also improves maintainability because individual subprocesses can be understood, tested, modified, and reused independently. Reusability is particularly important in Lifecycle Manager implementations because several business processes can require the same approval, provisioning, or initialization behavior. IdentityIQ workflow steps can use a Subprocess action to launch another defined workflow and wait until it completes. Variables and results can also be exchanged between parent and subprocess workflows.

The statement is therefore technically correct: subprocesses are not merely permitted; breaking complex workflows into manageable reusable components is a core reason for using them.

References/topics: IdentityIQ Engineer — Workflow Basics, subprocess workflows, master workflows, reusable business processes, Workflow Step action types.

=======

Placing a QuickLink object directly on a workflow is not a valid step in the development of a custom QuickLink. QuickLinks are used to provide users with easy access to specific tasks or workflows through the IdentityIQ interface, but the QuickLink itself is not embedded within the workflow. Instead, the QuickLink is created as a separate object and associated with the desired workflow or task that it is meant to launch.

The correct approach would involve creating a QuickLink that points to the workflow and then controlling access to the QuickLink by restricting it to a specific QuickLink population (e.g., " Managers " ). Therefore, the correct answer is B. No.

Yes, the sets of columns displayed in most tables in the IdentityIQ user interface are controlled by entries in the ColumnConfig elements of the UIConfig object. The UIConfig object in IdentityIQ is responsible for defining various aspects of the user interface, including the configuration of columns that are displayed in tables throughout the application. By modifying the ColumnConfig elements within this object, administrators can customize which columns appear in specific tables, including their order, visibility, and labels.

Therefore, the correct answer is A. Yes.

Yes, " Terminate Identity " is a default functionality of the Lifecycle Manager (LCM) module. This functionality is associated with the " Leaver " event, which manages the offboarding process for identities that are leaving the organization. The LCM module includes workflows that handle identity termination by deactivating accounts, removing access, and potentially triggering other actions needed to finalize the termination process.

Therefore, the correct answer is A. Yes.

In SailPoint IdentityIQ, the configuration in IdentityExtended.hbm.xml file as shown in the image indeed outlines the use of extended identity attributes. These attributes (extended1, extended2, etc.) are custom attributes that are appended to the standard identity object model to store additional identity-related data.

According to the official SailPoint IdentityIQ documentation, when defining identity mappings under Global Settings > Identity Attributes, only up to 12 additional attributes can be made searchable within the IdentityIQ system. This limitation is crucial because it directly impacts the efficiency of search operations in large environments, where making too many attributes searchable can significantly slow down performance.

Once you define these 12 searchable attributes, any additional attributes can still be added, but they will not be indexed for search operations. This means that while the data in these attributes can be used in workflows, reports, and other operations, they cannot be used in search filters in the IdentityIQ user interface.

This limitation is particularly important when planning the design of the identity schema, as it affects both performance and usability. Therefore, the statement in question is correct and accurately reflects the constraints imposed by SailPoint IdentityIQ in terms of searchable identity attributes.

Yes. Identity Attribute Changes are explicitly included among IdentityIQ ' s configurable built-in audit categories. Audit collection is not universally enabled for every possible event because recording large quantities of audit information has storage and performance implications. Administrators therefore select the activities that need to be captured through IdentityIQ ' s Audit Configuration.

SailPoint ' s IdentityIQ documentation lists several categories of auditable actions, including General Actions, Link Attribute Changes, Identity Attribute Changes , Class Actions, and SCIM Resource Actions. The Identity Attribute Changes category includes changes to identity-related information such as assigned roles, capabilities, authorized scopes, controlled scopes, passwords, and potentially configured extended identity attributes. Once the appropriate audit actions are enabled, resulting audit events can be searched through Advanced Analytics using the Audit search type.

This is different from merely enabling general application logging. Audit records provide governance-oriented evidence of defined actions, whereas application/server logging is primarily operational and diagnostic. Consequently, the proposition that built-in IdentityIQ audit functionality supports auditing Identity Attribute Changes is directly supported by the product configuration model.

References/topics: IdentityIQ Engineer — Audit Configuration, Identity Attribute Changes, Audit events, Advanced Analytics Audit search, governance logging.

=======

Yes. IdentityIQ roles can be configured to include permissions as part of the access represented by the role. A role is fundamentally a logical collection of access that can include application entitlements and permission-based profile definitions. SailPoint describes roles as collections of permissions that group underlying system access into meaningful business or technical units.

Within a role profile, IdentityIQ supports Attribute Permissions in addition to attribute rules. Permissions define rights against targets on an application. An engineer can select rights such as create, read, update, delete, or execute and associate those rights with the appropriate target. These permission definitions become part of the role profile and therefore form part of the access granted through the role.

This should not be confused with IdentityIQ administrative SPRight objects. Application-level permissions contained in a role profile are governed access on target systems, whereas SPRights control functionality inside IdentityIQ itself. IdentityIQ roles can also grant capabilities and scopes when that feature is enabled.

Therefore, configuring a role to contain a set of permissions is a valid role configuration.

References/topics: IdentityIQ Engineer — Role Modeling, role profiles, attribute permissions, entitlements, targets and rights.

=======

Yes, this is a valid step to take when importing SailPoint XML file objects into IdentityIQ. The IdentityIQ console (iiq console) is a command-line tool used for various administrative tasks, including importing and exporting XML objects.

To import an XML object through the IdentityIQ console, the general procedure involves:

Navigating to the IdentityIQ installation directory.

Running the console with the import command:

iiq console import < filename > .xml

The console will process the XML file, importing the defined objects (roles, policies, identity mappings, etc.) into the IdentityIQ database.

This method is officially documented and is a common practice for importing configuration and objects into SailPoint IdentityIQ. Therefore, the answer is A. Yes.

Mail Server Certificate is not a universally required IdentityIQ mail setting for successful SMTP communication. IdentityIQ needs the SMTP host/server information, the SMTP port, and, where required by the environment, authentication details such as username and password, plus TLS/SSL-related settings. A mail server certificate may be relevant in environments using encrypted SMTP where the certificate chain must be trusted by the JVM truststore, but that does not make “Mail Server Certificate” a required IdentityIQ configuration field in every SMTP setup. Many SMTP relay configurations work with host and port only, or with host, port, and credentials. The key engineering distinction is between mandatory connection parameters and optional security/trust configuration. If TLS validation fails, certificate trust may need to be configured at the Java/application-server layer, but it is not the baseline required IdentityIQ mail-server setting. References/topics: IdentityIQ Engineer — email notifications, SMTP configuration, mail host, SMTP port, authentication, TLS/SSL trust configuration.

The " Total Memory " value displayed on the JVM Memory page indicates the amount of memory currently allocated to the JVM heap. In the image provided, the " Total Memory " is shown as 725.617 MB. This is the amount of memory that the JVM heap is currently using, meaning it has been allocated and is available for the JVM to use.

SailPoint IdentityIQ Performance Tuning and Monitoring Guide

SailPoint IdentityIQ Administration Guide (JVM and Memory Management Sections)

In SailPoint IdentityIQ, when dealing with a policy violation of the type " Role Separation of Duties (SOD) Policy, " there are specific actions that the policy violation owner can take. These options typically include:

Mitigate: Applying a mitigating control to the violation.

Remediate: Addressing the violation by removing or altering access.

Accept: Acknowledging the violation without making changes, which usually requires justification.

Forward: Assigning the violation to another individual or group for resolution.

The option " Schedule Policy Composition Certification " is not a valid action for addressing a Role SOD Policy violation directly. The concept of scheduling a certification is related to periodic review processes, not immediate policy violation handling. Certification campaigns are scheduled and executed to review roles, entitlements, or policies, but this is not an action taken in response to a specific policy violation.

Thus, " Schedule Policy Composition Certification " is not an appropriate or valid option in this context, and the correct answer is B. No.

No. Identity search should not be used to diagnose system errors presented in the UI. A UI error is normally investigated through syslog, application logs, stack traces, incident codes, debug logging, or server-side log files. Identity search returns identity records and identity-related data; it does not expose detailed exception traces, system error messages, connector failures, workflow stack traces, or servlet/application errors. The Word bank’s Syslog version confirms the correct direction: Syslog can be used to identify details of a system error presented in the UI because IdentityIQ logs detailed errors and stack traces there. Since this video item changes the search type to Identity, the answer changes. Identity search may help locate the user affected by a failed operation, but it is not the tool for retrieving the error details themselves. References/topics: IdentityIQ Engineer — Identity search, Syslog search, incident code, UI error troubleshooting, logging and diagnostics.

Yes. If a user already has an account on an application and needs the ability to request an additional/new account through Manage User Access, the relevant LCM/QuickLink configuration must permit requesting new accounts. The proposed setting, “Allow requesting new accounts,” is specifically aligned with that requirement. Manage User Access and Manage Accounts behavior is controlled through Lifecycle Manager quicklink and population configuration, which determines what actions are visible and available to eligible users. Without enabling new-account requests for the appropriate QuickLink population, the user may only be able to manage existing account access or request entitlements for current accounts, not initiate a new account request on that application. This setting must also align with the application’s provisioning support and account creation policy. The configuration grants the UI/request capability; successful fulfillment still depends on application schema, create policy, approvals, and provisioning workflow. References/topics: IdentityIQ Engineer — LCM, Manage User Access, Manage Accounts QuickLink, QuickLink population, new account request, provisioning policy.

No. A standard Correlation Rule and a Manager Correlation Rule perform different functions in IdentityIQ. The scenario specifically requires resolving a manager reference—an employee ' s manager employee number must be matched to the correct Identity despite several employee-number formats. That is manager correlation, not ordinary account-to-identity correlation.

A Correlation Rule is used when IdentityIQ needs custom logic to associate an application account with an Identity and simple attribute-based account correlation is insufficient. By contrast, SailPoint defines a Manager Correlation Rule specifically for establishing the Manager–Direct Report relationship between Identity objects when simple manager attribute mapping cannot accommodate the required matching logic.

Here, the presence of several employee-number formats is exactly the type of complexity that makes custom manager-correlation logic appropriate. The rule can normalize or otherwise interpret those formats and return the identity representing the correct manager.

This proposition is separate from the earlier video proposition using “Write a ManagerCorrelation rule,” which is the correct solution. Under DOMC rules, changing the proposed rule type creates a separate question.

Therefore, writing a generic Correlation Rule does not correctly target the required manager-resolution process.

References/topics: IdentityIQ Engineer — Manager Correlation Rule, Correlation Rule, manager relationships, application aggregation, account correlation, Identity Cube relationships.

=======

No. The proposed XML is not correct because the reference class is wrong. In IdentityIQ, rule libraries are represented through rule objects used as reusable BeanShell libraries. When a rule references a common library, the referenced object should be a Rule object, not a nonstandard sailpoint.object.RuleLibrary class. The correct pattern is to reference the library as a rule by name under the rule’s referenced-rules section. Rule libraries allow shared methods and reusable code to be included across multiple rules, which is important for reducing duplication and maintaining consistent logic. However, XML object references must use the correct IdentityIQ object class. If the class does not correspond to the persisted object type, the import or runtime resolution can fail. The concept of referencing a common rules library is valid, but this specific code is not. References/topics: IdentityIQ Engineer — Rule libraries, ReferencedRules XML, Rule object references, BeanShell code reuse, XML object configuration.

The workflow transition condition shown in the image is Transition to= " Approve " when= " identityName != null " . This condition checks whether the identityName variable is not null. In the provided scenario, the identityName variable has a value of " Catherine.Simmons, " which is clearly not null. Therefore, the condition for transitioning to the " Approve " step will evaluate as true, meaning the workflow will indeed continue to the " Approve " step.

However, it seems like the question might be worded incorrectly as it asks if the workflow will continue to the " Approve " step when it actually will. If this was an error and the intention was to determine if it should not continue, the answer would have been " No. " But based on the logic, the workflow will continue to the " Approve " step.

SailPoint IdentityIQ Workflow Documentation

SailPoint IdentityIQ Scripting Guide (Conditions and Transitions in Workflows)

No. Upgrading the IdentityIQ web application does not automatically upgrade an independently installed IQService instance. IQService is a native Windows service installed on Windows hosts to support functionality requiring Windows APIs, including certain Active Directory provisioning operations and other Windows-specific connector capabilities.

SailPoint ' s IdentityIQ documentation states that the IQService version must match the IdentityIQ server version, including patch versions, and explicitly says that when one is upgraded, the other must also be upgraded. This is an operational requirement—not evidence of an automatic upgrade mechanism. The implementation engineer must deploy the appropriate IQService binaries and follow the required service upgrade or replacement procedure on each relevant Windows host.

Failing to align the versions can cause compatibility issues between IdentityIQ and IQService, particularly for connector requests, authentication/encryption behavior, provisioning, or Windows-native operations. The service configuration, port, TLS/certificate configuration, and service account should also be validated after upgrading.

Therefore, IQService must be deliberately upgraded alongside IdentityIQ; it is not automatically replaced merely because IdentityIQ itself was upgraded.

References/topics: IdentityIQ Engineer — IQService installation, version compatibility, IdentityIQ upgrades, Windows connector services, patch alignment.

=======

Filter String is not required when setting up every IdentityIQ application. A filter string is a connector-specific or configuration-specific option used in some application definitions to limit which accounts, groups, or objects are included during aggregation or connector operations. For example, LDAP-style connectors may use filters to restrict returned accounts, and other connector types may expose filter-like options depending on the source system. That does not make Filter String a universal mandatory field. IdentityIQ applications require core configuration such as application name, connector/type selection, schema information, and account identity handling, but not every application needs a filter. Some applications aggregate all accounts from the configured source, while others use connector-specific search, API, file, or database settings. Treating Filter String as universally required would be wrong because it depends on connector type and business filtering requirements. References/topics: IdentityIQ Engineer — application definition, connector configuration, aggregation filtering, required versus optional application settings.

No. IdentityIQ does not require a dedicated Catch step to accompany every individual workflow step capable of throwing an exception. Such a requirement would make workflows unnecessarily verbose and would not reflect normal workflow exception-handling design.

Workflow steps can execute scripts, rules, subprocesses, methods, approvals, and other operations, many of which can theoretically throw runtime exceptions. Exception handling can be designed at an appropriate level depending on the workflow ' s requirements. BeanShell logic can explicitly use exception handling where necessary, subprocess behavior can be handled by the calling process, and workflow-level failure processing can deal with unhandled exceptions.

A Catch construct is useful when the workflow needs to intercept a particular failure and intentionally route execution into recovery, cleanup, notification, auditing, or another controlled path. It is therefore an exception-handling mechanism , not a mandatory companion to every potentially failing step.

The Word bank already tests other workflow-step semantics, including the available Script, Rule, Subprocess, and Call Method actions; those are separate concepts from mandatory exception handling. The universal wording “must accompany every step” makes this proposition false.

References/topics: IdentityIQ Engineer — workflow step types, exception handling, Catch processing, BeanShell exceptions, subprocess failure handling, workflow error paths.

Schedule Policy Composition Certification is not a valid action for handling an individual Account Policy violation. A policy violation owner acts on a violation by making a decision about that violation: allow it, remediate it, mitigate it, or route it according to configured compliance processes. A Policy Composition Certification is a separate governance activity used to review the construction or definition of policies; it is not an immediate action available on a single violation record. The proposed solution also mismatches the policy type. The stem concerns an Account Policy violation, which typically relates to account-count or account-condition rules, not policy-composition review. The Word bank separately identifies Account policies as limiting the number of accounts a user can have on a system. Scheduling a certification might help long-term governance hygiene, but it does not dispose of the current policy violation. References/topics: IdentityIQ Engineer — Account Policy violations, violation owner actions, certification types, policy composition certification, compliance remediation workflow.

No. Create Entitlement is not one of the standard IdentityIQ Lifecycle Manager batch request operation types used for bulk access cleanup. The requirement concerns modifying users ' access: some identities need entitlements added while others need excessive access removed. IdentityIQ provides specific batch operations for those tasks.

SailPoint ' s supported batch request operations include Create Identity, Modify Identity, Create Account, Delete Account, Enable/Disable Account, Unlock Account, Add Role, Remove Role, Add Entitlement , Remove Entitlement , and Change Password. “Create Entitlement” does not appear as a standard batch request operation in this list. The distinction is fundamental: an entitlement is a governed access value represented through the application schema and usually as a ManagedAttribute in the Entitlement Catalog. Creating or maintaining that entitlement definition is different from granting an existing entitlement to identities.

For the described regional cleanup, Add Entitlement can repair missing access and Remove Entitlement can revoke excessive access. Therefore, “Create Entitlement” does not represent the appropriate supported batch request type and the proposed solution is false.

References/topics: IdentityIQ Engineer — Lifecycle Manager Batch Requests, AddEntitlement, RemoveEntitlement, ManagedAttribute versus entitlement assignment, bulk remediation.

=======

The statement is true. In SailPoint IdentityIQ, it is possible to configure a role to include a set of IdentityIQ capabilities. Capabilities in IdentityIQ are permissions that grant users access to specific functionalities within the platform, such as managing identities, viewing reports, or administering roles. By associating a role with specific capabilities, you can control what actions users assigned to that role can perform within the IdentityIQ environment.

SailPoint IdentityIQ Administration Guide (Role Configuration and Capabilities Section)

SailPoint IdentityIQ Configuration Guide (Sections on Roles and Capabilities)

This proposed solution is not correct. In IdentityIQ, features and functional access are controlled primarily through capabilities, not scopes. Capabilities determine whether a user can perform administrative or functional actions such as managing identities, accessing reports, configuring applications, launching tasks, or using privileged pages. Scopes, by contrast, are generally used to restrict which objects or data a user can see or act upon. For example, a scoped administrator may only be able to view or administer identities, applications, or work items within an assigned organizational boundary. That is object/data visibility control, not feature enablement. Saying that scopes control “the features that are used” confuses two different authorization layers. The correct IdentityIQ distinction is: capabilities control functional permissions, while scopes constrain object access boundaries. References/topics: IdentityIQ Engineer — authentication, authorization, capabilities, scopes, delegated administration.