IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Questions and Answers

The statement that " All certifications include generation, the active period, sign-off, and the end period " is true. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization ' s policies.

SailPoint IdentityIQ Certification Administrator ' s Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)

Creating and loading a Custom Audit Report TaskDefinition XML and corresponding Custom Audit Report Form XML is indeed part of the process for setting up a custom audit report in SailPoint IdentityIQ. The TaskDefinition XML defines the report task, and the Form XML defines the user interface for running the report. These steps are essential to creating a custom audit report, and the solution correctly outlines a valid approach. Refer to the SailPoint IdentityIQ Reporting Guide, particularly the section on creating custom reports and forms, for more detailed instructions.

The provided BeanShell code snippet attempts to filter and print the names of GroupDefinition objects owned by " Randy.Knight. " However, the code contains a few issues that prevent it from functioning correctly as written:

Class Import: The GroupDefinition class should be imported explicitly at the beginning of the script, which is missing here.

Query Execution: The use of context.getObjectsByNumber(GroupDefinition.class, i) is incorrect. This method does not exist in this context. The correct approach would be to use context.getObjects() to retrieve the list of objects and iterate over them.

Looping Logic: The loop logic also contains a flaw. Instead of using a counter-based loop with context.getObjectsByNumber(), the recommended approach is to use context.search() to retrieve a list of filtered objects and then iterate through the results.

A corrected version of this code would look something like this:

import sailpoint.object.GroupDefinition;

import sailpoint.object.Filter;

import sailpoint.object.QueryOptions;

Filter filter = Filter.eq( " owner.name " , " Randy.Knight " );

QueryOptions qo = new QueryOptions();

qo.addFilter(filter);

List < GroupDefinition > groupDefinitions = context.getObjects(GroupDefinition.class, qo);

for (GroupDefinition group : groupDefinitions) {

System.out.println(group.getName());

}

In this corrected version:

We explicitly import GroupDefinition.

We retrieve the filtered objects with context.getObjects(GroupDefinition.class, qo) instead of getObjectsByNumber.

Thus, the original code is not correct as written. The correct answer is B. No.

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in the provisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.

Yes. If a user already has an account on an application and needs the ability to request an additional/new account through Manage User Access, the relevant LCM/QuickLink configuration must permit requesting new accounts. The proposed setting, “Allow requesting new accounts,” is specifically aligned with that requirement. Manage User Access and Manage Accounts behavior is controlled through Lifecycle Manager quicklink and population configuration, which determines what actions are visible and available to eligible users. Without enabling new-account requests for the appropriate QuickLink population, the user may only be able to manage existing account access or request entitlements for current accounts, not initiate a new account request on that application. This setting must also align with the application’s provisioning support and account creation policy. The configuration grants the UI/request capability; successful fulfillment still depends on application schema, create policy, approvals, and provisioning workflow. References/topics: IdentityIQ Engineer — LCM, Manage User Access, Manage Accounts QuickLink, QuickLink population, new account request, provisioning policy.

Not all Application objects in SailPoint IdentityIQ must have an Identity object as the owner. While it is common practice to assign an owner to an Application object for governance and administration purposes, it is not a strict requirement. Applications can exist without a direct association to an Identity object. The ownership concept in IdentityIQ is more of a best practice for accountability rather than a mandatory attribute. Refer to the SailPoint IdentityIQ Application Definition Guide for more information on the configuration and management of Application objects.

Syslog is not intended for querying or identifying specific objects, such as all Link objects from a particular application. Syslog is used to record events and log information related to system activities, errors, and operations. To identify all Link objects from a particular application, you would use IdentityIQ ' s internal search functionality or reports that allow you to filter and retrieve such objects. These tasks involve querying the database and application-specific data structures rather than examining log files.

SailPoint IdentityIQ Administration Guide (Section on Objects and Searching)

SailPoint IdentityIQ Configuration Guide (Understanding Link Objects)

The statement is false. While it is true that logging and auditing require extra function calls and generate data, the suggestion that this data can be compressed to avoid storage issues and improve performance is misleading. In practice, while compression might save storage space, it does not inherently improve performance, particularly because the overhead of compression and decompression could negate the performance benefits. Effective performance management in IdentityIQ involves more nuanced approaches, such as optimizing the level of detail in logs, managing log rotation, and tuning the system for efficient I/O operations.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Performance Tuning Guide

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

Yes, this is a valid action. When using the Services Standard Build (SSB) in SailPoint IdentityIQ, placing the patch jar file in the build ' s base/patch folder is a correct procedure, provided the patch version matches what the client is using. This allows the build process to incorporate the patch into the deployment, ensuring that the correct versions and fixes are applied to the IdentityIQ instance.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Patching and Version Management Guide

Yes, defining account correlation via a rule is an action that can be performed as part of configuring an application definition in SailPoint IdentityIQ. Account correlation rules are often used to determine how accounts from different sources are linked to identities within IdentityIQ. These rules allow for complex logic to be applied when matching accounts to identities, beyond simple attribute matching.

SailPoint IdentityIQ Administration Guide (Section on Account Correlation)

SailPoint IdentityIQ Application Configuration Guide (Using Rules for Account Correlation)

In SailPoint IdentityIQ, a Workgroup can indeed be used to provide a group of users with specific capabilities. Workgroups are collections of users that can be assigned roles, tasks, and permissions. By associating capabilities with a Workgroup, all members of that Workgroup will inherit the capabilities defined.

This feature is commonly used to manage teams or departments that need to share specific privileges, such as the ability to approve access requests or manage certifications. Configuring capabilities for a Workgroup is a standard practice within IdentityIQ to simplify permission management and ensure consistent access control across the group.

Therefore, the correct answer is A. Yes.

Schedule Policy Composition Certification is not a valid action for handling an individual Account Policy violation. A policy violation owner acts on a violation by making a decision about that violation: allow it, remediate it, mitigate it, or route it according to configured compliance processes. A Policy Composition Certification is a separate governance activity used to review the construction or definition of policies; it is not an immediate action available on a single violation record. The proposed solution also mismatches the policy type. The stem concerns an Account Policy violation, which typically relates to account-count or account-condition rules, not policy-composition review. The Word bank separately identifies Account policies as limiting the number of accounts a user can have on a system. Scheduling a certification might help long-term governance hygiene, but it does not dispose of the current policy violation. References/topics: IdentityIQ Engineer — Account Policy violations, violation owner actions, certification types, policy composition certification, compliance remediation workflow.

Yes. IdentityIQ supports certain UI branding customizations, but product attribution requirements still matter. If a customer removes SailPoint branding from a prominent UI location such as the header bar, the product attribution should still be preserved elsewhere, such as in the copyright footer with wording like “Powered by SailPoint IdentityIQ.” This reflects the distinction between cosmetic branding changes and removal of required product identification. From an engineering standpoint, UI customization should be implemented carefully so it survives upgrades as much as possible and does not violate branding, licensing, or support expectations. Teams should also document all branding changes because customized UI files are commonly impacted during upgrades and patching. The proposed statement is valid because it preserves SailPoint product attribution while allowing the customer to modify the visible header branding. References/topics: IdentityIQ Engineer — UI customization, branding requirements, copyright footer, upgrade-safe customization, customer-specific UI changes.

The statement that workflows can be run directly from the Debug-Object page is incorrect. The Debug-Object page in SailPoint IdentityIQ is primarily used for inspecting and interacting with objects within the system, such as viewing their attributes, relationships, and states. However, running workflows is typically done through the IdentityIQ interface under the appropriate sections for workflow management or through the IdentityIQ Console, not directly from the Debug-Object page.

Therefore, the correct answer is B. No.

The statement is false. In SailPoint IdentityIQ, while message files may indeed be added to support additional languages, the out-of-the-box supplied message files can also be modified. Administrators can customize these message files to adapt the text in the user interface to better suit the organization’s needs. This includes modifying existing translations or adding custom messages to meet specific requirements.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Configuration Guide (Customization of Message Files)

This statement is not correct. IdentityIQ syslog event searching is not limited only to Incident Code lookups. Incident Code is useful when a user-facing error displays a code that can be traced back to a logged system event, but syslog analysis is broader than that. Administrators and engineers use syslog data to investigate operational errors, workflow failures, connector issues, provisioning errors, aggregation failures, authentication problems, and application exceptions. Advanced Analytics and log-search capabilities are intended to help filter and locate system events using more than a single incident-code value. Treating Incident Code as the only searchable attribute would make syslog analysis nearly useless for routine troubleshooting where no user-facing incident code is available. The correct engineering view is that Incident Code is one important search key, not the exclusive search mechanism. References/topics: IdentityIQ Engineer — syslog search, Advanced Analytics, incident code troubleshooting, system-error diagnosis, operational logging.

Yes. The requirement explicitly says the value must be listed as an entitlement on Identity Cubes. In IdentityIQ attribute configuration, marking an attribute as an entitlement-type attribute is what allows the value to be treated and displayed in entitlement/access contexts rather than merely as ordinary profile data. The rest of the requirements describe source mappings and usability: Workday is authoritative, Contractor file is fallback, the value should be usable in rules, and it should appear as an Advanced Analytics option. Those needs may require additional configuration such as source mappings, searchable/indexed behavior, and edit-mode considerations. However, the specific proposed option is “Entitlement,” and that maps directly to Usage 4. Without setting the attribute appropriately, the value may exist on the identity but not appear as an entitlement on the Identity Cube. Therefore, this configuration option is needed. References/topics: IdentityIQ Engineer — identity attribute configuration, entitlement flag, Identity Cube display, Advanced Analytics, source mappings.

Yes, the code provided in the second image is correct for including a rule library named " Common Rules Library " in a Rule. The correct syntax is to use class= " sailpoint.object.RuleLibrary " and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the " Common Rules Library. "

Correct Syntax (from the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

Yes. The Run Rule capability in the IdentityIQ debug/admin tooling is useful for executing BeanShell rule logic and viewing the result, especially during development or troubleshooting. When an engineer writes a simple rule that returns a value, the Run Rule feature can be used to validate the logic and observe the returned output. This is useful for quick testing of rules that evaluate identity attributes, build strings, test object lookups, or verify small pieces of BeanShell logic before embedding the rule into a workflow, lifecycle event, policy, certification configuration, or application configuration. However, this feature must be used carefully because rule execution can interact with real IdentityIQ objects depending on the code. The benefit described in the proposed solution is narrow and valid: displaying the return value of simple code is a legitimate use case. It is not the same as saying the feature should be used for unrestricted database manipulation. References/topics: IdentityIQ Engineer — Debug pages, Run Rule, BeanShell rules, rule testing, troubleshooting.

This proposed implementation is not valid as written. The logic is conceptually understandable, but the XML structure is not the correct IdentityIQ workflow transition pattern. In IdentityIQ workflows, transitions are normally declared using < Transition > elements with a destination, such as to= " StepName " , and optional conditional logic through a when expression or scripted evaluation. A raw < Source > block directly inside < Transition > returning destination names is not the standard structure for expressing multiple workflow routing paths after a form step. The engineer’s requirement is to route to Stop when the reject/back action is used, route to Audit when approval occurs and the comment variable is populated, and route to Provision as the fallback. That should be implemented as separate transition definitions with explicit destination steps and conditions. The proposed XML does not properly bind the returned values to valid transition destinations in the expected workflow syntax. References/topics: IdentityIQ Engineer — workflow XML, transition elements, form step routing, BeanShell expressions, Business Process Editor.

Owner is a required and important application configuration element in IdentityIQ. Application ownership establishes accountability for the connected system and is used across governance operations such as access reviews, application owner certifications, approval routing, policy handling, and administrative responsibility. IdentityIQ’s governance model depends heavily on ownership metadata because applications are not merely technical connector records; they are governed objects. Assigning an owner allows IdentityIQ to determine who is responsible for application access, certification decisions, and operational oversight. While some low-level object imports may technically create incomplete objects, from the application setup perspective an engineer should treat Owner as required. Without an owner, downstream governance functions become weak or ambiguous because IdentityIQ cannot reliably route application-specific reviews or approvals to the responsible business or technical authority. The proposed option is therefore valid as a required setup item. References/topics: IdentityIQ Engineer — application definition, application owner, governance accountability, certification ownership, access approval routing.

Yes, this statement is true. The default language of IdentityIQ can be changed from English by replacing the appropriate message files. Administrators can modify or replace the default English message files with those for another language, which will then become the system’s default language. This allows IdentityIQ to be localized according to the organization ' s language preferences.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Administration Guide (Language Settings and Message File Management Sections)

Yes, the sets of columns displayed in most tables in the IdentityIQ user interface are controlled by entries in the ColumnConfig elements of the UIConfig object. The UIConfig object in IdentityIQ is responsible for defining various aspects of the user interface, including the configuration of columns that are displayed in tables throughout the application. By modifying the ColumnConfig elements within this object, administrators can customize which columns appear in specific tables, including their order, visibility, and labels.

Therefore, the correct answer is A. Yes.

An AfterProvisioning rule in SailPoint IdentityIQ is typically used to execute custom logic after the provisioning process has been completed successfully. However, if provisioning fails, this rule will not be triggered because it is specifically designed for post-successful provisioning activities. To log an error message in the audit record when provisioning fails, a better approach would be to use a provisioning error handler or configure a specific workflow that captures errors and logs them accordingly. The AfterProvisioning rule is not the correct solution for this use case. Refer to the SailPoint IdentityIQ Provisioning and Workflow documentation for appropriate methods of handling provisioning errors and audit logging.

No. IdentityIQ report execution is based on task/report scheduling behavior, and the platform is not limited to running reports only once per day. Reports can be executed manually or scheduled according to supported scheduling options, depending on task configuration and administrative requirements. A daily schedule is only one possible cadence. IdentityIQ reporting is built on task infrastructure, and report templates can generate report instances based on selected parameters, filters, and schedules. In real deployments, organizations may schedule reports daily, weekly, monthly, or at other configured intervals depending on governance, compliance, and operational needs. The proposed solution is too restrictive because it says “at most once per day,” which incorrectly imposes a limitation that is not inherent to IdentityIQ reporting. The accurate concept is that reports can be scheduled, but the frequency depends on the task scheduler configuration and the report’s business purpose. References/topics: IdentityIQ Engineer — reporting, report templates, scheduled reports, task execution, report instances.

The statement that a BeanShell rule in IdentityIQ must always return an object derived from the abstract class sailpoint.object.SailPointObject is incorrect. While many rules in IdentityIQ may return objects that derive from SailPointObject, it is not a strict requirement. Rules can return various types of objects depending on their purpose and context. For example, a rule might return a String, Boolean, Map, or even null, depending on what the rule is designed to accomplish.

Therefore, the correct answer is B. No.

Allow is a valid action when acting on a policy violation, assuming the policy violation owner has the required permissions. In IdentityIQ compliance workflows, not every violation is immediately remediated. Some violations are business-approved exceptions, temporary exceptions, or accepted risks. The Allow action is used to acknowledge that the violation may remain in place, often with justification, comments, expiration, or compensating-control context depending on configuration. This is different from remediation, where access is changed or removed, and different from mitigation, where a mitigating control is attached. In the Account Policy context, the violation may indicate that a user exceeds a permitted account condition. If the business determines the condition is acceptable, the owner may allow it rather than immediately remove or alter an account. This is a legitimate compliance decision, provided the user has permission to take that action. References/topics: IdentityIQ Engineer — policy violation lifecycle, Account Policy, allow/exception handling, mitigation, remediation, Compliance Manager.

Setting the configuration option " Edit Mode: Read Only " on the account attribute would not meet the requirements as specified. The requirement to " Calculate from: Keystore application, responsibility-code attribute " implies that the attribute needs to be dynamically calculated or updated based on another attribute. If the attribute is set to " Read Only, " it cannot be modified, which would prevent it from being calculated or updated as needed. Therefore, " Edit Mode: Read Only " should not be used in this scenario.

SailPoint IdentityIQ Administration Guide (Sections on Account Attributes and Attribute Calculation)

SailPoint IdentityIQ Configuration Guide (Field Properties and Edit Modes)

Yes, this is an example of a mover lifecycle event. A mover lifecycle event typically occurs when an individual ' s role or employment status within the organization changes, requiring updates to their accounts and access rights. In this scenario, a contractor whose accounts were previously disabled due to contract expiration needs those accounts re-enabled upon securing a new contract. This reactivation and adjustment of access rights based on a change in employment status fits the definition of a mover event.

Therefore, the correct answer is A. Yes.

This statement is correct. IdentityIQ uses rule types and rule metadata to guide engineers when creating or editing rules. The Rule Registry describes expected rule behavior, including contextual information such as the rule’s purpose, expected inputs, and often the intended output or return behavior. This is important because IdentityIQ rules are not generic scripts running in isolation; they execute in specific product contexts such as aggregation, correlation, provisioning, workflow, certification, policy evaluation, or lifecycle processing. The rule editor can expose information derived from the rule registry so that an engineer understands which variables are available and what the rule is expected to return. This reduces implementation errors, especially in DOMC-style topics where a wrong return type or missing context variable can cause runtime failures. The Word bank separately confirms that the BeanShell rule editor lists typical input variables based on the rule registry. References/topics: IdentityIQ Engineer — Rule Registry, BeanShell rule editor, rule metadata, expected inputs, expected outputs.

The statement that " the staging period is required " for certifications is not true. In SailPoint IdentityIQ, the staging period is an optional phase during the certification campaign configuration. The staging period is used to pre-generate certifications and allow for any preparatory actions or adjustments before the certifications are officially launched and sent to reviewers. However, it is not a mandatory component for all certification campaigns.

Administrators may choose to bypass the staging period entirely depending on the specific requirements of the certification process or the urgency of the certification campaign. Therefore, while the staging period can be beneficial for managing large or complex certifications, it is not a required step.

SailPoint IdentityIQ Certification Overview Guide

SailPoint IdentityIQ Administration Guide (Sections on Certification Configuration and Staging Period)

Yes, " Terminate Identity " is a default functionality of the Lifecycle Manager (LCM) module. This functionality is associated with the " Leaver " event, which manages the offboarding process for identities that are leaving the organization. The LCM module includes workflows that handle identity termination by deactivating accounts, removing access, and potentially triggering other actions needed to finalize the termination process.

Therefore, the correct answer is A. Yes.

The statement " All Identity Mappings must use a rule to set the identity attribute " is incorrect. While source mapping rules can be used to populate identity attributes dynamically, it is not mandatory for all identity mappings to rely on a rule. Identity mappings can also be configured using direct mappings, where attributes from a source are directly mapped to IdentityIQ attributes without any rule-based logic.

Therefore, the correct answer is B. No.

Yes. IdentityIQ reports are closely tied to the platform’s task framework. Out-of-the-box report templates are represented as task/report definitions, and these definitions describe how the report is executed, what arguments or filters it accepts, and how the resulting report instance is generated. In IdentityIQ, scheduled and executable background operations commonly use TaskDefinition objects, and reporting is implemented through this same general task infrastructure. A report definition is not the same thing as a generated report result. The TaskDefinition defines the report template or executable report behavior, while a run of that report creates task/report result data. This distinction matters because an engineer may inspect, export, import, customize, or troubleshoot report definitions through IdentityIQ objects. The proposed statement is therefore valid for out-of-the-box reports as report definitions/templates. References/topics: IdentityIQ Engineer — reporting framework, TaskDefinition objects, report templates, task execution, generated report results.

The four minimum steps necessary to extend attributes in an IdentityIQ database after it has been created, in the correct order, are:

Update the corresponding hibernate file with the new attributes.

The Hibernate mapping file needs to be updated with the new attributes so that the SailPoint IdentityIQ application is aware of the new columns or properties in the database. This step ensures that the object-relational mapping (ORM) reflects the updated data model.

Run the command to generate the script to update the IdentityIQ database.

After updating the Hibernate file, a schema update script is generated. This script contains the necessary SQL commands to modify the database schema based on the new attributes added in the Hibernate file.

Shut down the application server and then run the generated extendedSchema script on the IdentityIQ database.

Before applying schema changes, the application server must be stopped to avoid any transactional conflicts. Afterward, the extendedSchema script is run on the database to apply the new attributes.

Start the application server and update the corresponding ObjectConfig.

Once the database schema is updated, restart the IdentityIQ application server and modify the ObjectConfig in SailPoint to register the new attributes for use within the IdentityIQ platform.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Updating the Hibernate File: This step involves modifying the Hibernate XML or annotation-based mapping files to reflect the new attributes that are being added to the database. SailPoint IdentityIQ uses Hibernate as its ORM, and any new database fields must first be defined at this layer.

Generating the Schema Update Script: SailPoint provides a command (usually via iiq console or build tools) that reads the updated Hibernate mapping and generates a database-specific script to alter the schema. This ensures that the database is modified in a way that matches the application ' s expectations.

Running the Schema Update Script: With the application server stopped, the schema update script is executed on the database. This step adds the new columns, indexes, or constraints that are required for the extended attributes.

Updating the ObjectConfig: Once the database is updated and the application server is running again, the ObjectConfig (typically located in the IdentityIQ admin UI) must be updated to incorporate the new fields. This step ensures that these new attributes are accessible to workflows, forms, and identity data within the system.

SailPoint IdentityIQ Installation and Configuration Guide (sections on extending the data model and schema updates).

Yes. Bundle is the IdentityIQ object model class used for roles, and it can be extended to store client-specific role metadata through the supported extended schema process. Custom role programs often require extra attributes on roles, such as risk category, ownership tier, regulatory classification, business unit, lifecycle state, approval model, or migration metadata. Updating the corresponding Hibernate mapping file is part of how persistent object extensions are introduced. However, the mapping update is only one step. The engineer must generate the database schema update script, apply it to the database in the correct operational state, and update ObjectConfig so IdentityIQ understands and exposes the custom attribute properly. The Word bank describes this same extension sequence: update the mapping layer, generate the schema script, run it on the IdentityIQ database, then update ObjectConfig after restart. Therefore, Bundle is a valid object for this type of client-specific data extension. References/topics: IdentityIQ Engineer — Bundle object, role extension, Hibernate mapping, extended schema, ObjectConfig, database schema update.

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)

Yes. A self-service registration workflow needs a Registration Identity Provisioning Policy because the policy defines what identity data must be collected, displayed, validated, or constrained during registration. LCM Registration is not merely a generic workflow button; it needs a controlled data-entry model for creating or initiating an identity record through self-service. The Registration Identity Provisioning Policy provides that model by defining registration fields, required inputs, allowed values, validation behavior, and potentially default or derived values. Without it, the workflow lacks the structured policy definition needed to support registration-specific identity creation. This is separate from ordinary Create Identity or Edit Identity policies because self-service registration usually has different security and usability requirements. Public or semi-public registration should expose only carefully selected fields and should validate values tightly. Therefore, the proposed configuration is required for the self-service registration use case. References/topics: IdentityIQ Engineer — LCM Registration, self-service registration workflow, Identity Provisioning Policies, registration fields, validation logic.

The best policy types for defining each access policy are as follows:

Users cannot be members of the AccountsPayable group in AD and have the CreateVendor access right in the Vendor System application at the same time.Answer: Entitlement SOD

This policy deals with conflicting access rights at the entitlement level (i.e., group membership and specific access rights). " Entitlement Separation of Duties " (SOD) ensures that users don ' t have access to conflicting entitlements.

Users can have two accounts on a given system, but no more.Answer: Account

This policy pertains to the number of accounts a user can have on a system. The " Account " policy type manages restrictions on how many accounts users can possess.

Users who have either the VPN role or the Travel role cannot also be in the Contractor role.Answer: Role SOD

This policy involves conflicting roles. " Role Separation of Duties " (Role SOD) ensures that users cannot have conflicting roles, such as VPN and Contractor, or Travel and Contractor.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Entitlement SOD: This policy prevents users from having conflicting access rights. In this case, being in the AccountsPayable group while also having access to create vendors creates a potential conflict. IdentityIQ uses Entitlement SOD to handle these scenarios by preventing such combinations of entitlements.

Account: This type of policy limits the number of accounts users can have on a given system. By setting up an Account policy, IdentityIQ ensures that a user cannot exceed the set number of accounts (e.g., two accounts on a system).

Role SOD: When dealing with conflicting roles (such as VPN or Travel role conflicting with a Contractor role), Role SOD policies ensure that users do not end up in roles that violate governance or security policies. This type of policy ensures role-based access conflicts are mitigated in IdentityIQ.

SailPoint IdentityIQ Compliance Manager Guide (section on defining and managing Separation of Duties (SOD) policies).

The purpose of an IdentityIQ certification is not to attest to a user ' s integrity. Certifications in IdentityIQ are designed to review and verify user access rights to ensure they are appropriate based on roles, policies, and organizational rules. The focus is on access management rather than personal qualities like integrity.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

The Create Identity Provisioning Policy in SailPoint IdentityIQ is designed to apply specific provisioning rules and actions during the creation of identities, especially when aggregating data from authoritative sources. These policies ensure that newly created identities have valid and authorized attribute values based on organizational rules and compliance requirements.

During identity aggregation from an authoritative source, the provisioning policy can enforce rules such as role assignments, attribute validation, and other actions necessary to ensure that the identity is created correctly and securely.

Therefore, the correct answer is A. Yes.

Inserting the " Managers " QuickLink population as the dynamic scope in the QuickLink object is a valid step when creating a custom QuickLink that should only be accessible by managers. QuickLink populations are used to define which users have access to specific QuickLinks based on criteria like role, department, or other attributes. By assigning the " Managers " population, only users who are members of that population will see and be able to launch the QuickLink.

Therefore, the correct answer is A. Yes.

No, this is not a valid action. When setting up or using the Services Standard Build (SSB) for a SailPoint IdentityIQ instance, the client ' s identityiq.war file should not be placed in the home directory of the build. The WAR file should be deployed to the appropriate application server ' s deployment directory, not in the home directory of the build itself. The SSB process typically involves more structured deployment processes that adhere to best practices for application deployment.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Deployment Best Practices

The configuration option " Comment Character " is not required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Comment Character " option is generally used for handling comment lines in flat files or CSV file-based connectors. Since SCIM 2.0 is a RESTful API-based protocol designed for managing identities in a standardized way, this option does not apply to SCIM 2.0 integrations. Therefore, it is not a necessary configuration when working with SCIM 2.0 applications.

SailPoint IdentityIQ SCIM 2.0 Integration Guide

SailPoint IdentityIQ Application Configuration Guide (SCIM and REST API sections)

Yes. IdentityIQ Debug pages provide administrative access to persisted objects and can support object deletion, including deletion of individual objects and, depending on the view and selection mechanism, bulk deletion of selected objects. This capability is powerful and risky. Engineers must not treat Debug deletion like ordinary UI cleanup because IdentityIQ objects often have dependencies. Deleting a rule, workflow, application, form, task definition, policy, identity, or certification-related object can break references and cause runtime failures. Bulk deletion is especially dangerous because it can remove many objects without the safeguards provided by normal functional pages. The statement is valid from a usability/control perspective, but it should be understood as an administrative capability, not a recommended routine practice. Proper change control, export backups, dependency analysis, and non-production validation are mandatory before deleting objects through Debug. References/topics: IdentityIQ Engineer — Debug-Object page, object deletion, bulk object actions, object dependencies, administrative safeguards.

This is not a valid step for creating a custom audit event and associated report. A Custom Certification Event Schedule relates to certification scheduling or certification-event processing, not to defining a new audit action in the audit framework. A ruleRunner task can execute a rule, but simply creating a certification event schedule and ruleRunner task does not establish a custom audit event type, does not register the event in AuditConfig, and does not create a report capable of querying that audit data. For a custom audit event, the engineer must define the audit action/event, ensure the code path writes the audit event with the appropriate attributes, and then create or configure a report that can retrieve and display those audit records. The proposed solution is pointed at the wrong subsystem. It confuses certification scheduling automation with audit event definition and reporting. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction, custom audit events, audit reporting, ruleRunner task limitations.

No. Identity search should not be used to diagnose system errors presented in the UI. A UI error is normally investigated through syslog, application logs, stack traces, incident codes, debug logging, or server-side log files. Identity search returns identity records and identity-related data; it does not expose detailed exception traces, system error messages, connector failures, workflow stack traces, or servlet/application errors. The Word bank’s Syslog version confirms the correct direction: Syslog can be used to identify details of a system error presented in the UI because IdentityIQ logs detailed errors and stack traces there. Since this video item changes the search type to Identity, the answer changes. Identity search may help locate the user affected by a failed operation, but it is not the tool for retrieving the error details themselves. References/topics: IdentityIQ Engineer — Identity search, Syslog search, incident code, UI error troubleshooting, logging and diagnostics.

This proposed solution is incorrect. A create-type lifecycle event trigger is used when a new identity is created or first detected in IdentityIQ. The requirement is not about a new identity; it is about an existing identity whose Division attribute changes from IT to Senior IT. That is an update or attribute-change scenario. A create event would not reliably fire when an existing user’s Division attribute is modified during aggregation or identity refresh. It also does not address the second required condition: the user must be a manager. The correct approach must detect the specific attribute transition and then evaluate the manager condition. Using a create trigger would either never launch the workflow for the intended case or launch it only at identity creation time, which is outside the stated requirement. This is a basic but important lifecycle-event design distinction: joiner/create events are not substitutes for mover or attribute-change events. References/topics: IdentityIQ Engineer — lifecycle events, create triggers, attribute-change triggers, mover events, identity refresh processing.

The workflow transition condition shown in the image is Transition to= " Approve " when= " identityName != null " . This condition checks whether the identityName variable is not null. In the provided scenario, the identityName variable has a value of " Catherine.Simmons, " which is clearly not null. Therefore, the condition for transitioning to the " Approve " step will evaluate as true, meaning the workflow will indeed continue to the " Approve " step.

However, it seems like the question might be worded incorrectly as it asks if the workflow will continue to the " Approve " step when it actually will. If this was an error and the intention was to determine if it should not continue, the answer would have been " No. " But based on the logic, the workflow will continue to the " Approve " step.

SailPoint IdentityIQ Workflow Documentation

SailPoint IdentityIQ Scripting Guide (Conditions and Transitions in Workflows)

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

In SailPoint IdentityIQ, certain objects, such as the Link object, cannot be directly extended by updating the corresponding .HBM (Hibernate Mapping) file. Modifying or extending core IdentityIQ objects typically requires a deeper level of customization involving the extension of the application schema and possibly custom Java code. The .HBM files are part of IdentityIQ ' s internal persistence framework, and altering them is not a supported or recommended method for extending objects in a production environment. Customization should instead be done using SailPoint’s supported extension points, such as using ManagedAttributes or CustomAttributes within the IdentityIQ application framework. For guidelines on extending IdentityIQ objects, refer to the SailPoint IdentityIQ Customization Guide and best practices documentation.

Top of Form

Bottom of Form

No. IdentityIQ report results are not simply stored as files on the application servers as a universal rule. IdentityIQ is a database-backed governance platform, and generated report metadata/results are associated with task/report result objects and persisted through the platform’s data model. While report exports or generated files may be downloaded or temporarily handled by the application server at runtime, the statement “all report results are stored on IdentityIQ application servers” is technically inaccurate. In clustered deployments, relying on local application-server storage for all report results would also be problematic because multiple application servers may serve the same IdentityIQ environment. IdentityIQ centralizes configuration, task history, report metadata, identities, applications, and governance objects through its database-backed object model. Therefore, the correct understanding is that reports are run by the IdentityIQ task/reporting framework and report result information is managed by IdentityIQ, not universally stored as local application-server files. References/topics: IdentityIQ Engineer — reporting architecture, task results, report instances, application server versus database persistence.

The Rapid Setup user interface in SailPoint IdentityIQ is designed to simplify and streamline common configuration tasks, particularly during the initial setup of IdentityIQ environments. However, it has certain limitations in terms of granularity and customization.

In this case, the requirement is to disable an account on a particular application for one set of users and delete the account for another set of users during administrative terminations. The Rapid Setup interface does not provide options to differentiate between user groups for different actions (disable vs. delete) within the same termination event.

This level of specificity—applying different actions based on user group membership—would require a more advanced setup, possibly involving custom rules or workflows rather than using the Rapid Setup options. Therefore, the correct answer is B. No.

Yes. Policy checking behavior is one of the areas commonly controlled in LCM request workflows through workflow variables or configuration controlling policy evaluation mode. IdentityIQ can evaluate whether a requested access change would violate configured policies before the request is finalized or provisioned. Depending on configuration, the system can present policy violations to the requester, block submission, continue with warnings, or require additional approval/mitigation. The proposed behavior — checking whether an access request would violate policies and letting the requester review before submitting — aligns with interactive policy-checking behavior in LCM. This is an execution behavior of the request workflow, not an application schema setting. The engineer must still ensure policies are configured and enabled, but the workflow/control-variable layer can determine how those checks are applied during request submission. References/topics: IdentityIQ Engineer — LCM workflow control variables, policy checking, request policy violations, interactive policy review, access request governance.

Yes. The IdentityIQ version is essential information when setting up a new sandbox environment. Version affects installation steps, supported Java versions, supported application servers, database compatibility, connector behavior, patch requirements, schema scripts, upgrade paths, and available product features. A sandbox is usually intended to mirror or safely test changes for another environment, so the engineer must know which IdentityIQ version the sandbox should run. Without the version, the engineer could deploy the wrong WAR file, apply incompatible patches, use the wrong schema scripts, or test behavior that does not match production. Version also matters for customizations such as rules, workflows, Quicklinks, UI branding, extended attributes, and connector configuration because APIs and supported patterns can differ between releases. Therefore, IdentityIQ version is not optional background information; it is a core environment-planning input. References/topics: IdentityIQ Engineer — sandbox setup, installation planning, version compatibility, patching, environment parity.