SailPoint IdentityIQ-Engineer Dumps

No. The account attribute is intended to function as a privileged-account flag , so the resulting value should represent one Boolean state for each account: privileged or not privileged. Nothing in the stated requirements indicates that the attribute needs to contain multiple simultaneous values.

IdentityIQ uses the Multi-Valued property for attributes that legitimately contain collections of values. Typical examples include group memberships, roles, permissions, or entitlement attributes where a single account can hold many values at once. A privilege flag does not have that structure.

Selecting Multi-Valued would change how IdentityIQ interprets and processes the attribute. Instead of treating it as a single value such as true or false, IdentityIQ would treat the attribute as a collection. That complicates rule comparisons, policy evaluation, search behavior, and attribute handling without satisfying any stated business requirement.

The fact that data may be evaluated from more than one source does not make the resulting attribute multi-valued. Multiple input sources can still produce one calculated Boolean result.

Therefore, Multi-Valued is not needed.

References/topics: IdentityIQ Engineer — single-valued versus multi-valued schema attributes, Boolean privilege flags, entitlement attributes, application schema design.

=======

Yes, the statement is true. Both logging and auditing in SailPoint IdentityIQ can have a negative influence on performance because they involve additional function calls within the application. These processes generate data that needs to be stored, which can impact performance if not managed properly. Extensive logging and auditing, particularly at high levels of detail, can lead to increased I/O and storage usage, potentially slowing down system operations.

SailPoint IdentityIQ Performance Tuning Guide

SailPoint IdentityIQ Logging and Auditing Guide (Impact on Performance)

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.

The workflow transition condition shown in the image is Transition to= " Approve " when= " identityName != null " . This condition checks whether the identityName variable is not null. In the provided scenario, the identityName variable has a value of " Catherine.Simmons, " which is clearly not null. Therefore, the condition for transitioning to the " Approve " step will evaluate as true, meaning the workflow will indeed continue to the " Approve " step.

However, it seems like the question might be worded incorrectly as it asks if the workflow will continue to the " Approve " step when it actually will. If this was an error and the intention was to determine if it should not continue, the answer would have been " No. " But based on the logic, the workflow will continue to the " Approve " step.

SailPoint IdentityIQ Workflow Documentation

SailPoint IdentityIQ Scripting Guide (Conditions and Transitions in Workflows)

Yes. A Boolean datatype is appropriate because the stated purpose is to flag privileged accounts . A flag normally represents a binary condition: the account either satisfies the privileged-account criteria or it does not. Consequently, true and false accurately represent the resulting classification.

The engineer can derive this Boolean from the Financial application ' s privileged attribute and/or calculate the result through logic involving the Keystore application ' s responsibility-code attribute. Once populated, the Boolean value can be referenced reliably from rules and policy conditions and can participate in searchable/analytics configuration when the associated attribute is configured appropriately.

This distinction also resolves the earlier Attribute Type: string proposition. A String could technically hold textual values, but the requirement here is specifically a Boolean privilege flag. Therefore, for this DOMC scenario, Boolean is the configuration that matches the requirement , while String should be answered No.

The bank already tests source mapping and edit mode for the same scenario but does not contain this Boolean proposition.

References/topics: IdentityIQ Engineer — account schema, Boolean attributes, privileged-account classification, source mapping, rules, policies.

=======

Yes. Once the custom audit action and report definition have been created and loaded into IdentityIQ, configuring and scheduling the resulting custom report through Intelligence > Reports is a valid step in completing the reporting solution.

IdentityIQ ' s reporting framework exposes standard and custom report definitions through the Reports UI. A report can be opened and configured with the required filters or parameters, saved as an appropriate report instance, executed immediately, or scheduled for future and recurring execution. SailPoint documents that reports can be scheduled to execute once, hourly, daily, weekly, monthly, quarterly, or annually.

For a custom audit-report implementation, this scheduling step logically follows the underlying development work: the custom AuditAction must first be defined, executable logic must actually create AuditEvent records using that action, and a custom report definition must be created that queries the required audit data. Scheduling the report does not replace any of those earlier implementation steps, but it is a legitimate final operational step once the custom report exists.

Therefore, this proposed solution is one valid step toward accomplishing the stated goal.

References/topics: IdentityIQ Engineer — custom AuditEvent reporting, custom TaskDefinition reports, Intelligence > Reports, report scheduling, recurring compliance reporting.

The primary and secondary colors in the IdentityIQ user interface are not set through the IdentityIQ Configuration > Miscellaneous page. Instead, these colors are typically configured through the style.css or other custom CSS files that are part of the IdentityIQ UI customization process. Administrators can define and modify the color scheme, fonts, and other style elements by editing the relevant CSS files or using the Branding feature within IdentityIQ.

Therefore, the correct answer is B. No.

The statement that " the staging period is required " for certifications is not true. In SailPoint IdentityIQ, the staging period is an optional phase during the certification campaign configuration. The staging period is used to pre-generate certifications and allow for any preparatory actions or adjustments before the certifications are officially launched and sent to reviewers. However, it is not a mandatory component for all certification campaigns.

Administrators may choose to bypass the staging period entirely depending on the specific requirements of the certification process or the urgency of the certification campaign. Therefore, while the staging period can be beneficial for managing large or complex certifications, it is not a required step.

SailPoint IdentityIQ Certification Overview Guide

SailPoint IdentityIQ Administration Guide (Sections on Certification Configuration and Staging Period)

This implementation is not correct. The requirement is to return all account names for an identity on the application MagicBox, but the code retrieves only a single Link by calling service.getLink(identity, " MagicBox " ). Even worse, the while (link != null) loop never changes the link variable, so if a link is found, the loop becomes infinite and repeatedly adds the same native identity. A correct implementation must retrieve the application object, obtain all matching Link objects for the identity and application, iterate over that list, and add each link’s native identity once. There is also no visible import for ArrayList or List, although BeanShell environments may sometimes tolerate imports differently. The fatal issue remains the flawed loop and single-link retrieval. IdentityIQ account data is represented by Link objects, and multiple accounts may exist for the same identity on the same application depending on connector and policy design. References/topics: IdentityIQ Engineer — IdentityService, Link objects, native identity, BeanShell API usage, account lookup logic.

Yes. The requirement concerns performing an operation against an existing account through the Manage Accounts functionality. The QuickLink population therefore needs to permit users in that population to manage existing accounts. Selecting “Allow managing existing accounts” establishes that population-level eligibility for operations involving accounts that already exist.

This configuration should be distinguished from the specific account operation itself. Lifecycle Manager ' s Manage Accounts configuration controls which account actions—such as enable, disable, unlock, or other supported operations—are available. The QuickLink-population setting determines whether the user is allowed to manage existing accounts through that interface. Both layers must align with the requested functionality.

This question is also genuinely different from the ODT ' s existing question. The bank asks about a user wanting to enable an account and proposes selecting the Rehire action. Here, the video specifically asks about unlocking an existing account and proposes a QuickLink-population setting.

Therefore, for the configuration proposed in this DOMC item, the answer is Yes.

References/topics: IdentityIQ Engineer — Lifecycle Manager, Manage Accounts QuickLink, QuickLink populations, existing-account management, account unlock, Manage Account Actions.

=======

Allow is a valid action when acting on a policy violation, assuming the policy violation owner has the required permissions. In IdentityIQ compliance workflows, not every violation is immediately remediated. Some violations are business-approved exceptions, temporary exceptions, or accepted risks. The Allow action is used to acknowledge that the violation may remain in place, often with justification, comments, expiration, or compensating-control context depending on configuration. This is different from remediation, where access is changed or removed, and different from mitigation, where a mitigating control is attached. In the Account Policy context, the violation may indicate that a user exceeds a permitted account condition. If the business determines the condition is acceptable, the owner may allow it rather than immediately remove or alter an account. This is a legitimate compliance decision, provided the user has permission to take that action. References/topics: IdentityIQ Engineer — policy violation lifecycle, Account Policy, allow/exception handling, mitigation, remediation, Compliance Manager.

When setting up a new IdentityIQ test environment, it is important to assess the needs of the customer, including whether they would benefit from using a deployment accelerator.

Deployment accelerators are pre-configured sets of rules, policies, and workflows that can significantly reduce the time and effort required to deploy IdentityIQ in a test or production environment. These accelerators are particularly useful for rapidly setting up environments that align with common industry practices or specific compliance requirements.

Asking the customer whether they need a deployment accelerator is a valid and important question during the initial setup phase, as it helps to determine the best approach to configuring the test environment efficiently. Therefore, the correct answer is A. Yes.

Yes. This is exactly what the Managed property on an application schema attribute is designed to accomplish. During application configuration, an engineer can mark an account attribute as Managed. When IdentityIQ subsequently aggregates accounts, the distinct values of that attribute can be promoted into ManagedAttribute objects. Those objects are the records represented and governed through the Entitlement Catalog.

SailPoint documentation explicitly states that attributes designated as Managed can be viewed and managed from the Entitlement Catalog . Managed attributes can also receive governance metadata such as an owner, description, display name, and requestable status, and can participate in policies and risk calculations. For example, if an account attribute such as memberOf or groups is managed, the aggregated group values can become individual ManagedAttribute records.

The Entitlement flag and the Managed flag are related but distinct. Entitlement indicates that the attribute represents access that IdentityIQ should track. Managed promotes its values into first-class managed objects and makes them available through the Entitlement Catalog. Therefore the proposed action is valid application-definition configuration.

References/topics: IdentityIQ Engineer — Application Schema, Managed attributes, ManagedAttribute object, Entitlement Catalog, account aggregation.

=======

Yes. IdentityIQ reports are closely tied to the platform’s task framework. Out-of-the-box report templates are represented as task/report definitions, and these definitions describe how the report is executed, what arguments or filters it accepts, and how the resulting report instance is generated. In IdentityIQ, scheduled and executable background operations commonly use TaskDefinition objects, and reporting is implemented through this same general task infrastructure. A report definition is not the same thing as a generated report result. The TaskDefinition defines the report template or executable report behavior, while a run of that report creates task/report result data. This distinction matters because an engineer may inspect, export, import, customize, or troubleshoot report definitions through IdentityIQ objects. The proposed statement is therefore valid for out-of-the-box reports as report definitions/templates. References/topics: IdentityIQ Engineer — reporting framework, TaskDefinition objects, report templates, task execution, generated report results.

This statement is correct. IdentityIQ uses rule types and rule metadata to guide engineers when creating or editing rules. The Rule Registry describes expected rule behavior, including contextual information such as the rule’s purpose, expected inputs, and often the intended output or return behavior. This is important because IdentityIQ rules are not generic scripts running in isolation; they execute in specific product contexts such as aggregation, correlation, provisioning, workflow, certification, policy evaluation, or lifecycle processing. The rule editor can expose information derived from the rule registry so that an engineer understands which variables are available and what the rule is expected to return. This reduces implementation errors, especially in DOMC-style topics where a wrong return type or missing context variable can cause runtime failures. The Word bank separately confirms that the BeanShell rule editor lists typical input variables based on the rule registry. References/topics: IdentityIQ Engineer — Rule Registry, BeanShell rule editor, rule metadata, expected inputs, expected outputs.

Yes, the text on the login page of IdentityIQ is set through message keys in the message catalog. The message catalog in IdentityIQ contains localized text strings that are used throughout the user interface, including on the login page. By modifying the appropriate message keys in the catalog, you can customize the text that appears on the login page to match the organization ' s branding or messaging requirements.

Therefore, the correct answer is A. Yes.

In SailPoint IdentityIQ, a Workgroup can indeed be used to provide a group of users with specific capabilities. Workgroups are collections of users that can be assigned roles, tasks, and permissions. By associating capabilities with a Workgroup, all members of that Workgroup will inherit the capabilities defined.

This feature is commonly used to manage teams or departments that need to share specific privileges, such as the ability to approve access requests or manage certifications. Configuring capabilities for a Workgroup is a standard practice within IdentityIQ to simplify permission management and ensure consistent access control across the group.

Therefore, the correct answer is A. Yes.

No. IdentityIQ certifications are used to review and attest access, roles, entitlements, account group memberships, policy violations, or other governance items. They are not designed to ensure “SailPoint” itself is compliant with ISO 9001, and ISO 9001 is not a government regulation in the way the proposed solution states. ISO 9001 is a quality management standard, not an access-governance regulation that IdentityIQ certifications directly enforce. An organization may use IdentityIQ certification evidence as part of broader compliance programs, but the certification’s direct purpose is access review: confirming that users have appropriate access and that inappropriate access is revoked, remediated, or justified. The wording is wrong both in target and scope. The certification process supports customer governance/compliance objectives, not SailPoint corporate ISO compliance. References/topics: IdentityIQ Engineer — certification purpose, access review, compliance evidence, entitlement review, role review, governance controls.

No. Whether an application supports password change requests through the IdentityIQ UI is not controlled by generic LCM workflow control variables. Password-change support depends on the application connector’s capabilities, password-management configuration, application settings, schema/support for password operations, policies, and QuickLink/user-interface configuration. The workflow may process or route a password-change request once launched, but it does not define which target applications support that operation. That capability must be configured at the application/connector and password-management layer. Mixing these layers would create a brittle design: workflow variables should govern execution behavior, while application configuration defines available account operations. Therefore, the proposed solution is not achievable merely by configuring out-of-the-box LCM workflow control variables. References/topics: IdentityIQ Engineer — password management, application connector capabilities, LCM workflows, QuickLink password change, account operation support.

Yes. A ManagedAttribute represents managed access originating from an IdentityIQ application—for example an entitlement value, account group, or permission. Consequently, its definition includes an association with the Application object that supplies or owns that managed access.

The Entitlement Catalog makes this relationship explicit. For each managed attribute, IdentityIQ displays an Application property identifying the application associated with the attribute. The remaining ManagedAttribute metadata—such as Type, Attribute or Target, Value, owner, requestability, classifications, and associated roles—is interpreted within that application ' s schema and governance context.

This relationship is important because identical entitlement values can exist on different systems but represent completely different access. IdentityIQ therefore requires application context to uniquely and correctly interpret the entitlement. For example, a value called Administrators on one Active Directory application is not inherently the same governed entitlement as Administrators on another target.

A ManagedAttribute can participate in roles, certifications, requests, classifications, and policy evaluation, but those governance relationships do not remove its underlying application association.

References/topics: IdentityIQ Engineer — ManagedAttribute object, Application object, Entitlement Catalog, managed entitlements, application schemas.

=======

No. Identity search is designed to search Identity objects and identity-related attributes, not to count certification campaigns or certification items in a specific lifecycle phase. “Revocation phase” belongs to the certification/remediation process, not the Identity object itself. To identify the number of certifications currently in revocation, an engineer should use certification search, certification reports, task/report output, or direct certification-related reporting depending on implementation permissions. Using Identity search would return identities, not certification phase counts. Even if an identity is involved in a revocation action, the certification’s phase/status is not the primary searchable object in Identity search. This is similar to the Word bank’s distinction that Syslog search is for log events and not for unrelated governance object queries. The proposed use case is therefore outside the Identity search type’s purpose. References/topics: IdentityIQ Engineer — Identity search, certification lifecycle, revocation phase, certification reporting, Advanced Analytics.

The statement that a BeanShell rule in IdentityIQ must always return an object derived from the abstract class sailpoint.object.SailPointObject is incorrect. While many rules in IdentityIQ may return objects that derive from SailPointObject, it is not a strict requirement. Rules can return various types of objects depending on their purpose and context. For example, a rule might return a String, Boolean, Map, or even null, depending on what the rule is designed to accomplish.

Therefore, the correct answer is B. No.

In SailPoint IdentityIQ, what users can see and do is indeed partly controlled by their authorized scope. Authorized scopes define the range of objects (such as identities, roles, applications) that a user has access to. Scopes can be applied to limit access based on specific criteria, ensuring that users only interact with the data and functionalities relevant to their role or responsibility within the organization.

For example, a user with access to a specific scope may only view or manage identities within a certain department or geographical location, depending on how the scope is configured.

Therefore, the correct answer is A. Yes.

Yes, disabling all notifications can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In SailPoint IdentityIQ, most workflows, including those in LCM, use control variables to manage various settings, such as whether notifications should be sent. By setting the appropriate control variable (e.g., disabling email notifications) within the workflow configuration, you can effectively suppress all notifications related to that workflow.

Therefore, the correct answer is A. Yes.

No. QuickLink population membership is not an exclusive one-population relationship. IdentityIQ can evaluate an identity against multiple QuickLink population definitions, and the same identity can satisfy the membership criteria for multiple populations.

QuickLink populations are used to govern which QuickLinks users can access and, for “For Others” use cases, which target identities they may act upon. Populations can be based on identity attributes, capabilities, workgroups, individual identities, or other configured membership logic. Because those criteria can overlap, there is no general requirement that an identity belong to only one population.

For example, the same employee could satisfy a Managers population, a particular geographic population, and another population associated with access-request functionality. IdentityIQ evaluates the applicable configuration rather than forcing those groups to be mutually exclusive.

The Word bank itself contains examples where QuickLink population configuration controls access to manager-only QuickLinks, reinforcing that populations represent authorization groupings rather than a single-valued classification.

Therefore, “at most one QuickLink population” is false.

References/topics: IdentityIQ Engineer — QuickLink populations, authentication and authorization, population membership, capabilities, workgroups, QuickLink visibility.

=======

The statement is false. In SailPoint IdentityIQ, syslog events can indeed be sent to Log4j. The system allows for flexible configuration where logging can be directed to multiple outputs, including both syslog and Log4j. This flexibility enables organizations to route logs according to their needs while maintaining security and compliance.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Administration Guide (Syslog Configuration and Log4j Integration)

No. The Provisioning area of the Administrator Console is focused on provisioning transactions , not on providing the current connector/application connection-health status for the associated target application.

A provisioning transaction can provide information about the access request and its processing state—for example whether provisioning is pending, completed, failed, or otherwise awaiting processing. Engineers can use transaction information to investigate provisioning behavior and determine which application and operations are involved. That is not equivalent to displaying whether the underlying application connector is presently connected or healthy.

Application connectivity is investigated through application configuration/testing and the relevant application or connector diagnostic mechanisms. A transaction can fail because of connectivity, authentication, connector configuration, target-system errors, invalid data, workflow problems, or many other causes. Consequently, the transaction state cannot simply be interpreted as the application ' s connection status.

The distinction is tested directly by this DOMC proposition: provisioning transaction monitoring and application connectivity monitoring are separate administrative functions.

References/topics: IdentityIQ Engineer — Administrator Console, Provisioning Transactions, Application connectivity testing, connector troubleshooting, provisioning status.

=======

The " Name " configuration option is required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Name " field is a mandatory identifier for the application within IdentityIQ. This name is used throughout the system to reference the application and is critical for configuration, management, and integration processes. Without specifying a name, IdentityIQ cannot properly identify and interact with the SCIM 2.0 application.

SailPoint IdentityIQ SCIM 2.0 Application Configuration Guide

SailPoint IdentityIQ Administration Guide (Application Setup and Naming Conventions)

This implementation is correct in structure. The code first resolves the Application object named MagicBox, then creates an IdentityService, then calls service.getLinks(identity, application) to retrieve the account links for that identity on the application. Because the requirement is to return all account names, using getLinks and iterating over the returned List < Link > is the right pattern. Each Link represents an account on an application, and getNativeIdentity() returns the account’s native identifier, which is the account name or unique account key from the target application. The null check prevents a null-pointer issue if no links are returned. In a production-quality version, an engineer might also handle a missing application object and ensure Java collection imports are available, but those do not invalidate the core implementation pattern shown. Compared with the flawed single-link version, this solution correctly handles multiple accounts. References/topics: IdentityIQ Engineer — IdentityService API, Application object lookup, Link collection retrieval, nativeIdentity, BeanShell utility methods.

In SailPoint IdentityIQ, certain objects, such as the Link object, cannot be directly extended by updating the corresponding .HBM (Hibernate Mapping) file. Modifying or extending core IdentityIQ objects typically requires a deeper level of customization involving the extension of the application schema and possibly custom Java code. The .HBM files are part of IdentityIQ ' s internal persistence framework, and altering them is not a supported or recommended method for extending objects in a production environment. Customization should instead be done using SailPoint’s supported extension points, such as using ManagedAttributes or CustomAttributes within the IdentityIQ application framework. For guidelines on extending IdentityIQ objects, refer to the SailPoint IdentityIQ Customization Guide and best practices documentation.

Top of Form

Bottom of Form

Yes. The number of identities is relevant information when planning an IdentityIQ sandbox because it establishes the approximate scale and workload characteristics of the customer environment. A sandbox does not normally need a literal production clone containing every identity, but an engineer must understand production scale to decide how representative the sample data and infrastructure should be and what kinds of performance or processing behavior need to be tested.

SailPoint recommends separating development, test, and production and specifically describes a sandbox using sample data as a safe environment for testing rules under realistic conditions. Identity volume materially affects operations that iterate across Identity Cubes, including Identity Refresh, policy evaluation, certifications, correlation, role propagation, and other background processing. IdentityIQ ' s own Environment Information Report records the number of identities together with application, account, role, certification, processor, database, and version information—demonstrating that identity count is a meaningful environment characteristic.

Therefore, an engineer gathering requirements for a new sandbox should know the customer ' s identity population even when only a representative subset will ultimately be loaded.

References/topics: IdentityIQ Engineer — sandbox planning, realistic test data, environment sizing, identity volume, Identity Refresh, Environment Information Report.

=======

Yes, the Provisioning tab under the " Administrator Console " in IdentityIQ can be used to view the specific operations on each attribute being provisioned. This tab provides detailed visibility into the provisioning operations, including which attributes are being modified, created, or removed as part of the provisioning process. This is essential for administrators to monitor and troubleshoot provisioning tasks.

SailPoint IdentityIQ Administration Guide (Provisioning Tab Overview)

SailPoint IdentityIQ Provisioning Guide

In SailPoint IdentityIQ, the specific configuration that allows a user to enable an account for themselves or a subordinate through the " Manage Accounts " option does not necessarily need to be configured in Lifecycle Manager (LCM) alone. While LCM does provide extensive capabilities for account management actions like provisioning, rehire, and more, enabling an account is primarily tied to the permissions and entitlements granted to the user through their role, capabilities, and access profiles.

To address the specific functionality described:

Manage Accounts is typically a part of IdentityIQ’s broader account management capabilities, which are not exclusively tied to LCM. The ability to enable or disable accounts can be governed by rules and workflows within IdentityIQ, and these may or may not be linked directly to LCM configurations.

Rehire Action in LCM: The " Rehire " action within LCM Configuration is specific to processes related to reactivating an employee’s identity when they are rehired. This does not directly relate to enabling an account from the " Manage Accounts " screen. Rehire workflows typically involve reinstating the user’s previous access, which could include enabling accounts, but this is a broader process.

Permissions and Roles: The ability to enable accounts is often governed by the permissions assigned to a user’s role within IdentityIQ. These permissions may be granted outside of LCM configurations and handled by IdentityIQ’s access governance framework.

Workflow Configurations: Enabling or disabling an account could also be tied to specific workflows, which can be configured separately from LCM, using IdentityIQ’s workflow engine. These workflows determine the steps and approvals required to perform such actions.

SailPoint IdentityIQ Configuration Guide: Account Management

SailPoint IdentityIQ Lifecycle Manager Configuration Guide

SailPoint IdentityIQ Administration Guide (Sections on Roles and Permissions, Workflow Configurations)

No. A Bundle represents a role in IdentityIQ, and a Bundle profile is part of role definition logic, not something that must be associated directly to an Identity object. Profiles are used to describe conditions, constraints, or entitlement/application criteria associated with a role. Identities may be assigned roles, detected as matching roles, or evaluated against role profiles, but the Bundle profile itself is not required to be associated to a specific Identity object. This distinction is important because IdentityIQ’s role model is object-based: roles exist independently from the identities that hold them. A profile defines what the role means or how it is detected; identity role membership is a separate relationship. Saying that a Bundle profile must be associated with an Identity object incorrectly collapses role definition and identity assignment into one concept. References/topics: IdentityIQ Engineer — Bundle object, role profiles, role detection, role assignment, Identity object relationships.

Yes. IdentityIQ roles can be configured to include permissions as part of the access represented by the role. A role is fundamentally a logical collection of access that can include application entitlements and permission-based profile definitions. SailPoint describes roles as collections of permissions that group underlying system access into meaningful business or technical units.

Within a role profile, IdentityIQ supports Attribute Permissions in addition to attribute rules. Permissions define rights against targets on an application. An engineer can select rights such as create, read, update, delete, or execute and associate those rights with the appropriate target. These permission definitions become part of the role profile and therefore form part of the access granted through the role.

This should not be confused with IdentityIQ administrative SPRight objects. Application-level permissions contained in a role profile are governed access on target systems, whereas SPRights control functionality inside IdentityIQ itself. IdentityIQ roles can also grant capabilities and scopes when that feature is enabled.

Therefore, configuring a role to contain a set of permissions is a valid role configuration.

References/topics: IdentityIQ Engineer — Role Modeling, role profiles, attribute permissions, entitlements, targets and rights.

=======

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in the provisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.

In SailPoint IdentityIQ, certain objects are designed to be extended by updating their corresponding Hibernate Mapping (.HBM) files. However, the WorkItem object is not one of these extendable objects. The WorkItem is a system object that primarily represents tasks or actions that need to be processed within the workflow. It is not intended to store client-specific data through direct modification of its .HBM file. Instead, client-specific data should be handled using other mechanisms, such as custom attributes or the extension of Identity or Account objects. Attempting to modify the WorkItem object ' s HBM file could lead to unexpected behavior and is not supported by SailPoint ' s best practices.

No. ManagedAttribute objects represent managed entitlement or account-group values from applications. They are not generally viewed on the Policy tab of the View Identity QuickLink. The Policy tab is used for policy-related information such as policy violations or compliance policy context, not for listing all entitlements associated with the identity. A user’s entitlements and accounts are normally viewed through identity access/account-related tabs or identity cube access views, depending on UI configuration. This proposed statement confuses ManagedAttribute entitlement data with policy-violation data. A ManagedAttribute may be involved in a policy violation, certification item, access request, or entitlement display, but that does not mean all ManagedAttribute objects associated with an Identity are visible from the Policy tab. The correct engineering distinction is: ManagedAttribute equals governed entitlement metadata; Policy tab equals policy/compliance information. References/topics: IdentityIQ Engineer — ManagedAttribute, Identity Cube, View Identity QuickLink, entitlement display, policy violations.

The statement " The Identity object is passed to the rule " is correct. When writing source mapping rules to populate identity attributes, the Identity object is indeed passed to the rule. This allows the rule to access and modify attributes on the Identity object based on the logic defined within the rule.

Therefore, the correct answer is A. Yes.

Yes. IdentityIQ provides several core identity properties that are directly available as standard search criteria without requiring them to be implemented as customer-defined extended searchable attributes. These include First Name, Last Name, Display Name, Email, and Manager . Identity Search exposes these properties separately from the configurable section called Searchable Attributes , which contains additional identity attributes created and designated as searchable during deployment.

This distinction is important when interpreting IdentityExtended.hbm.xml. The extended Hibernate mapping is primarily concerned with additional database-backed attributes that a customer wants to search efficiently. It does not mean that every searchable identity property must consume one of the numbered extended1, extended2, and similar columns.

Current IdentityIQ documentation lists Last Name, First Name, Display Name, Email, and Manager directly among Identity Search criteria, with separately configured searchable attributes presented in their own category. Therefore, the proposed solution correctly identifies standard searchable identity information supplied by IdentityIQ.

References/topics: IdentityIQ Engineer — Identity Search, Identity Mapping, standard identity attributes, searchable extended attributes, IdentityExtended.hbm.xml.

=======

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)

No, this is not a valid action. When setting up or using the Services Standard Build (SSB) for a SailPoint IdentityIQ instance, the client ' s identityiq.war file should not be placed in the home directory of the build. The WAR file should be deployed to the appropriate application server ' s deployment directory, not in the home directory of the build itself. The SSB process typically involves more structured deployment processes that adhere to best practices for application deployment.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Deployment Best Practices

Yes. IdentityIQ Debug pages provide administrative access to persisted objects and can support object deletion, including deletion of individual objects and, depending on the view and selection mechanism, bulk deletion of selected objects. This capability is powerful and risky. Engineers must not treat Debug deletion like ordinary UI cleanup because IdentityIQ objects often have dependencies. Deleting a rule, workflow, application, form, task definition, policy, identity, or certification-related object can break references and cause runtime failures. Bulk deletion is especially dangerous because it can remove many objects without the safeguards provided by normal functional pages. The statement is valid from a usability/control perspective, but it should be understood as an administrative capability, not a recommended routine practice. Proper change control, export backups, dependency analysis, and non-production validation are mandatory before deleting objects through Debug. References/topics: IdentityIQ Engineer — Debug-Object page, object deletion, bulk object actions, object dependencies, administrative safeguards.

The statement is false. The " Run Rule " feature on the Debug-Object page is not intended for creating, modifying, or deleting SailPoint database objects. Instead, it is used to execute specific rules for testing and debugging purposes. While it allows you to test the logic of a rule by running it in isolation, it does not directly manipulate database objects. For creating, modifying, or deleting database objects, administrators would typically use the appropriate IdentityIQ APIs or database scripts.

SailPoint IdentityIQ Administration Guide (Debugging and Rule Management Sections)

SailPoint IdentityIQ Developer Guide (Working with Rules and Debugging Tools)

Yes. For a Risk Policy violation, Certify is a valid action when the user handling the violation has the necessary permissions. IdentityIQ policy types can expose different response options, and the available disposition is not identical for every policy category.

Certify allows the responsible governance user to initiate certification-related review rather than simply accepting the violation or immediately remediating access. This is useful when a risk violation identifies access or identity conditions that warrant a formal review by an appropriate certifier before a final access decision is made.

This question must also be kept separate from the Account Policy propositions in the Word bank. The bank contains Account Policy propositions such as Schedule Policy Composition Certification—which it marks invalid—and Allow, which it marks valid. The policy type in the video is specifically Risk Policy , and DOMC evaluates the proposed action in that policy-type context.

Therefore, Certify is a valid option for the stated Risk Policy violation.

References/topics: IdentityIQ Engineer — Risk Policy, policy violations, Certify action, Compliance Manager, certification launch, violation disposition.

=======

Yes. IdentityIQ’s Lifecycle Manager workflows are built from reusable workflow components and subprocesses. Many standard LCM subprocesses can be called from custom workflows, provided the engineer understands the expected input variables, return variables, and control flags. This is a preferred engineering pattern because it avoids rewriting complex provisioning, approval, identity request, policy-checking, or notification logic from scratch. Input variables can alter behavior such as approval routing, provisioning mode, policy checking, notification behavior, target identity, requester, plan handling, and subprocess execution path. However, reuse requires discipline: the custom workflow must pass the correct variables, preserve expected types, and handle returned values correctly. Blindly calling an LCM subprocess without matching its contract can produce broken approvals or provisioning behavior. The proposed statement is therefore true because standard LCM subprocesses are intentionally reusable when controlled through documented workflow variables. References/topics: IdentityIQ Engineer — LCM workflows, subprocess reuse, workflow input variables, provisioning workflows, custom workflow development.

Defining an application is not a default functionality of the Lifecycle Manager (LCM) module. Application definitions are typically part of the core IdentityIQ platform and are managed through the IdentityIQ Administration module, not Lifecycle Manager. LCM is primarily focused on managing identity lifecycle events, such as onboarding (Joiner), role changes (Mover), and offboarding (Leaver).

Therefore, the correct answer is B. No.

Yes. IdentityIQ workflow steps support several action types, and both Script and Rule actions execute logic implemented with Java BeanShell.

A Script action contains BeanShell code directly within the workflow step. This is useful for workflow-specific logic that is short or tightly coupled to that business process. In workflow XML, the script may appear inline or inside a nested < Script > < Source > ... < /Source > < /Script > block.

A Rule action also executes BeanShell code, but the code is encapsulated in a reusable IdentityIQ Rule object rather than embedded directly in the workflow. This is preferable when logic needs to be reused, separately maintained, or invoked by multiple workflows or other IdentityIQ components.

IdentityIQ distinguishes these action types from Subprocess , which launches another Workflow object, and Call Method , which invokes a compiled Java method exposed through the IdentityIQ workflow library.

SailPoint ' s workflow documentation explicitly describes Script as executing Java BeanShell code and Rule as executing a reusable workflow Rule containing Java BeanShell code. Therefore, the proposed statement accurately characterizes both action types.

References/topics: IdentityIQ Engineer — Workflow Step actions, Script, Rule, BeanShell, Subprocess, Call Method, Business Process Editor.

A Post-Iterate Rule in SailPoint IdentityIQ is a type of connector rule that is executed after each account from the source system (e.g., SQL Loader application) has been read during the aggregation process. This rule allows for additional processing or customization of the data after the account has been iterated over. According to SailPoint IdentityIQ documentation, configuring a Post-Iterate Rule enables the execution of logic after each account ' s data has been processed, confirming that the given statement is valid. Refer to the SailPoint IdentityIQ Connector Development Guide for detailed information on rule execution during aggregation.

This statement is not correct. IdentityIQ syslog event searching is not limited only to Incident Code lookups. Incident Code is useful when a user-facing error displays a code that can be traced back to a logged system event, but syslog analysis is broader than that. Administrators and engineers use syslog data to investigate operational errors, workflow failures, connector issues, provisioning errors, aggregation failures, authentication problems, and application exceptions. Advanced Analytics and log-search capabilities are intended to help filter and locate system events using more than a single incident-code value. Treating Incident Code as the only searchable attribute would make syslog analysis nearly useless for routine troubleshooting where no user-facing incident code is available. The correct engineering view is that Incident Code is one important search key, not the exclusive search mechanism. References/topics: IdentityIQ Engineer — syslog search, Advanced Analytics, incident code troubleshooting, system-error diagnosis, operational logging.

Yes. Rapid Setup explicitly supports configuration of Manager Correlation by mapping an application/account attribute containing manager information to an IdentityIQ identity attribute that uniquely identifies the corresponding manager. Within Rapid Setup, account correlation and manager correlation are handled as separate correlation configurations. For manager correlation, the engineer selects the application attribute containing the manager reference, selects the comparison operator—typically Equals—and then selects the IdentityIQ identity attribute used to resolve that manager.

This is an attribute-based correlation method and is appropriate when the manager identifier supplied by the connected system can be matched directly to an attribute stored on Identity Cubes. For example, an account ' s managerEmail could be mapped to the IdentityIQ email identity attribute. More complicated transformations or normalization requirements may require a Manager Correlation Rule, but a direct attribute mapping is supported directly through Rapid Setup.

Therefore, the proposed action is valid.

References/topics: IdentityIQ Engineer — Rapid Setup, Manager Correlation, application attributes, identity attributes, aggregation and correlation.

=======

Yes. Sub-workflows are an established IdentityIQ workflow-design mechanism for decomposing a large business process into smaller, reusable units. Instead of placing provisioning, approval, initialization, policy-checking, notification, and other logic into one oversized master workflow, an engineer can move logically independent functions into workflows designated as Subprocess workflows. The parent workflow then invokes those subprocesses at the appropriate processing steps.

SailPoint specifically identifies simplification of the master workflow as one of the benefits of subprocess workflows. The design also improves maintainability because individual subprocesses can be understood, tested, modified, and reused independently. Reusability is particularly important in Lifecycle Manager implementations because several business processes can require the same approval, provisioning, or initialization behavior. IdentityIQ workflow steps can use a Subprocess action to launch another defined workflow and wait until it completes. Variables and results can also be exchanged between parent and subprocess workflows.

The statement is therefore technically correct: subprocesses are not merely permitted; breaking complex workflows into manageable reusable components is a core reason for using them.

References/topics: IdentityIQ Engineer — Workflow Basics, subprocess workflows, master workflows, reusable business processes, Workflow Step action types.

=======

Yes. When a new IdentityIQ object is created and persisted correctly through the application layer, IdentityIQ can generate the internal object ID upon save. The object ID is the persistent identifier used by the platform and database, while the object name is a separate logical or display identifier. This distinction is important when engineers create or import objects through Debug. A new object should not reuse the ID of an existing object, because that would update or conflict with the existing object rather than create a clean new record. Automatic ID generation is one reason object XML is often edited before import or creation: copied XML must have old IDs removed so IdentityIQ can assign a fresh identifier. The statement is therefore valid, but engineers must still ensure required fields, class type, name uniqueness, and object references are correct before saving. References/topics: IdentityIQ Engineer — Debug-Object page, object persistence, automatic ID generation, object name versus ID, XML import safety.

In SailPoint IdentityIQ, every Link object, which represents an account on an application for an identity, must be associated with an Identity object. The Link object is inherently tied to an identity, as it is a representation of that identity’s account on a target system. Without this association, the Link would not have context within IdentityIQ. This is a fundamental aspect of IdentityIQ ' s data model. Refer to the SailPoint IdentityIQ Data Model documentation for detailed information on the relationships between Link objects and Identity objects.

Yes. This is a recognized IdentityIQ BeanShell debugging technique for inspecting the variables available in the current rule ' s BeanShell namespace. BeanShell exposes the namespace variable names through this.variables. The loop processes each name, evaluates it through eval(name), determines whether its value is void, null, or an actual Java object, and prints the variable together with its runtime type and value.

This is valuable because the effective variables available to a rule can depend on both the rule type and the context from which that rule is invoked. The Rule Editor documents normal Arguments and Returns, but runtime inspection can expose the actual namespace provided during a specific execution.

SailPoint ' s published debugging example uses essentially this same pattern and describes it as dumping all variables available in the BeanShell namespace. Newer versions of the example add a check to skip transient, because that name is a Java reserved word and can cause eval() problems in some workflow contexts. That refinement does not invalidate the basic diagnostic technique shown in the question.

References/topics: IdentityIQ Engineer — BeanShell namespace, Rule Editor Arguments/Returns, this.variables, eval(), rule debugging.

=======

No. This is not a correct locking and persistence pattern for safely modifying a Policy object. The most serious problem is that the object is retrieved and modified before an appropriate transaction lock is obtained . If concurrent processing can update the same persistent object, the object should be obtained under the intended transaction lock before the modification is performed.

The code also never explicitly calls context.saveObject(object). SailPoint ' s recommended object-modification pattern obtains a transaction lock using ObjectUtil.transactionLock() or the appropriate ObjectUtil.lockObject() mechanism, modifies the locked object, calls context.saveObject(), and commits the transaction. In addition, calling context.decache(object) before committing is contrary to the normal persistence pattern because decaching removes the object from the Hibernate/SailPoint object cache before the persistence sequence has been properly completed.

A documented SailPoint example obtains the transaction lock first, performs the modification, saves the object, commits, and then decaches it. The proposed code does not follow that sequence.

References/topics: IdentityIQ Engineer — SailPointContext, ObjectUtil locking, transaction locks, saveObject, commitTransaction, object cache management.

=======

Export CSV / Import CSV is not a valid action for a policy violation owner when acting on an individual Account Policy violation. In IdentityIQ, a policy violation owner is expected to resolve or manage the violation through violation-handling actions such as allowing, mitigating, remediating, forwarding, or otherwise taking governance action depending on configured permissions and workflow. Exporting or importing CSV files is an administrative or bulk-data activity, not a violation-disposition action. An Account Policy violation normally relates to a condition such as a user having more accounts than permitted on an application or system. The Word bank describes Account policies as policies that limit the number of accounts users may have on a given system. Acting on that violation requires a compliance decision or remediation path, not a CSV operation. Therefore, this proposed solution is not a valid policy-violation owner action. References/topics: IdentityIQ Engineer — Compliance Manager, policy violations, Account Policy, violation remediation, policy owner actions.

Specifying account correlation using a rule cannot be performed using the Rapid Setup application onboarding process. Rapid Setup is designed for straightforward and simplified onboarding processes with a focus on quick configuration, typically using predefined templates and options. However, advanced configurations like custom account correlation rules require more detailed setup, typically done outside of the Rapid Setup UI, involving scripting or detailed configuration within the application definition.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Application Onboarding Sections)

The provided BeanShell code snippet attempts to filter and print the names of GroupDefinition objects owned by " Randy.Knight. " However, the code contains a few issues that prevent it from functioning correctly as written:

Class Import: The GroupDefinition class should be imported explicitly at the beginning of the script, which is missing here.

Query Execution: The use of context.getObjectsByNumber(GroupDefinition.class, i) is incorrect. This method does not exist in this context. The correct approach would be to use context.getObjects() to retrieve the list of objects and iterate over them.

Looping Logic: The loop logic also contains a flaw. Instead of using a counter-based loop with context.getObjectsByNumber(), the recommended approach is to use context.search() to retrieve a list of filtered objects and then iterate through the results.

A corrected version of this code would look something like this:

import sailpoint.object.GroupDefinition;

import sailpoint.object.Filter;

import sailpoint.object.QueryOptions;

Filter filter = Filter.eq( " owner.name " , " Randy.Knight " );

QueryOptions qo = new QueryOptions();

qo.addFilter(filter);

List < GroupDefinition > groupDefinitions = context.getObjects(GroupDefinition.class, qo);

for (GroupDefinition group : groupDefinitions) {

System.out.println(group.getName());

}

In this corrected version:

We explicitly import GroupDefinition.

We retrieve the filtered objects with context.getObjects(GroupDefinition.class, qo) instead of getObjectsByNumber.

Thus, the original code is not correct as written. The correct answer is B. No.

No. IdentityIQ ' s standard audit-event configuration is managed primarily through the Audit Configuration page, not through the Administrator Console. SailPoint documents the navigation for audit configuration under Global Settings > Audit Configuration , where administrators choose which General Actions, Identity Attribute Changes, Link Attribute Changes, Class Actions, and other supported activities are collected in the audit log.

The Administrator Console serves a different operational purpose. It is used for areas such as task-result management, provisioning transaction monitoring, host/environment monitoring, application health, and status information for SailPoint modules and extensions. Although some activities viewed or performed there may themselves generate audit records when auditing is enabled, that does not make the Administrator Console the central audit-configuration interface.

This distinction is important for an IdentityIQ engineer. Audit Configuration controls what governance events are recorded; Advanced Analytics provides mechanisms to search the resulting audit events; Administrator Console focuses primarily on operational monitoring and administration. Therefore, replacing “Audit Configuration page” with “Administrators Console page” changes the statement from correct to incorrect.

References/topics: IdentityIQ Engineer — Audit Configuration, audit actions, Administrator Console, Environment Monitoring, Advanced Analytics.

=======

Yes. Importing SailPoint XML objects can be performed through supported IdentityIQ import mechanisms, and using the user interface path Global Settings > Import From File is a valid approach for importing XML object definitions. XML imports are commonly used to move IdentityIQ configuration objects such as rules, workflows, applications, roles, policies, email templates, task definitions, and other SailPoint objects between environments. Engineers may also use the IdentityIQ console for imports, especially for larger or automated deployments, but the existence of the console method does not make the UI method invalid. The proposed solution is specifically asking whether selecting a file through Global Settings > Import From File is a valid step, and it is. The important caution is that imported XML should be reviewed carefully because object names, IDs, references, and environment-specific values can affect behavior after import. References/topics: IdentityIQ Engineer — XML object import/export, Global Settings import, configuration migration, deployment management.

Yes. IdentityIQ Identity Provisioning Policies define the fields and validation behavior used when identities are created or updated through supported identity-management flows. When an explicit Update Identity Provisioning Policy is not configured, IdentityIQ can fall back to the Create Identity Provisioning Policy for Edit Identity operations. This fallback allows environments to avoid duplicating identity-field configuration when the create and update forms require the same data model or validation logic. The engineer still needs to design this carefully: create and update operations are not always identical. Create flows may require fields that should not be editable later, while update flows may expose fields that are irrelevant at creation. If the organization needs separate behavior for editing identities, an Update Identity Provisioning Policy should be defined. But the proposed statement is true as a product behavior: the Create Identity policy can be used when no Update Identity policy exists. References/topics: IdentityIQ Engineer — Identity Provisioning Policies, Create Identity, Edit Identity, Update Identity policy, field validation and allowed values.

Yes, this is an example of a mover lifecycle event. A mover lifecycle event typically occurs when an individual ' s role or employment status within the organization changes, requiring updates to their accounts and access rights. In this scenario, a contractor whose accounts were previously disabled due to contract expiration needs those accounts re-enabled upon securing a new contract. This reactivation and adjustment of access rights based on a change in employment status fits the definition of a mover event.

Therefore, the correct answer is A. Yes.

No. IdentityIQ report results are not simply stored as files on the application servers as a universal rule. IdentityIQ is a database-backed governance platform, and generated report metadata/results are associated with task/report result objects and persisted through the platform’s data model. While report exports or generated files may be downloaded or temporarily handled by the application server at runtime, the statement “all report results are stored on IdentityIQ application servers” is technically inaccurate. In clustered deployments, relying on local application-server storage for all report results would also be problematic because multiple application servers may serve the same IdentityIQ environment. IdentityIQ centralizes configuration, task history, report metadata, identities, applications, and governance objects through its database-backed object model. Therefore, the correct understanding is that reports are run by the IdentityIQ task/reporting framework and report result information is managed by IdentityIQ, not universally stored as local application-server files. References/topics: IdentityIQ Engineer — reporting architecture, task results, report instances, application server versus database persistence.

The statement suggests moving the XML file into IIQ_HOME/WEB-INF/database as part of the process to import SailPoint XML file objects into IdentityIQ. However, this is not a valid step for importing XML objects.

The correct procedure to import SailPoint XML objects typically involves the following steps:

Use the iiq console command-line tool provided by SailPoint to import the XML file.

The command typically looks like: iiq console import < filename > .xml.

The XML file does not need to be moved to any specific directory like WEB-INF/database for the import process.

Moving the XML file into the WEB-INF/database directory does not align with the documented process and does not facilitate the import. The correct answer is B. No.

SMTP Port is a required mail configuration value for successful SMTP communication. IdentityIQ must know not only the mail server host but also the network port used to connect to that SMTP service. Common SMTP ports include 25, 465, or 587 depending on whether the environment uses unauthenticated SMTP relay, SSL/TLS, or STARTTLS. Without the port, IdentityIQ cannot reliably establish the socket connection to the mail server, even if the hostname and credentials are correct. Email notification is used heavily across IdentityIQ processes, including workflow approvals, certification reminders, lifecycle events, policy violations, provisioning notifications, and work-item escalation. Therefore, SMTP connectivity settings must be complete and accurate. SMTP Port is not merely cosmetic; it is part of the transport configuration required for IdentityIQ to communicate with the mail infrastructure. References/topics: IdentityIQ Engineer — email notification setup, SMTP server configuration, mail host and port, workflow and certification notifications.

The statement that " All certifications include generation, the active period, sign-off, and the end period " is true. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization ' s policies.

SailPoint IdentityIQ Certification Administrator ' s Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)

This proposed solution is not valid as written. The stem says the engineer needs to create a custom audit event and set up an associated report. The proposed XML fragment is an ObjectAttribute definition for an attribute named userType; it is not an AuditAction definition. An ObjectAttribute entry is used in object configuration contexts to describe an attribute’s display, edit behavior, extended number, name, and type. That does not define a new audit action/event in the AuditConfig object. A proper audit event definition would use an AuditAction element or equivalent AuditConfig configuration identifying the audit action name, display name, and enabled state. Because the XML fragment shown does not create a custom audit action, it cannot satisfy the required step. This is exactly the kind of syntax-level distinction an IdentityIQ engineer must catch: correct object type and correct XML element matter. References/topics: IdentityIQ Engineer — AuditConfig XML, AuditAction definition, ObjectAttribute configuration, custom audit event setup.

No. The statement is too absolute. IdentityIQ does not always require the scheduled challenge-period duration to expire before sign-off can occur.

When a challenge period is enabled and revocation decisions exist, the related challenge processing must reach an appropriate completed state before the access review can be signed off. However, IdentityIQ documentation explicitly permits sign-off while the certification is in the challenge phase when all items are complete, all applicable revocation decisions have progressed through the challenge procedure, and no open decisions remain.

Expiration of the configured challenge period is another condition that permits the certification to proceed, but it is not the only possible path. In other words, there is an important difference between saying that challenge processing must be complete and saying that the reviewer must always wait until the full scheduled challenge period expires.

SailPoint ' s Access Review documentation lists both conditions independently: completed challenge processing can permit sign-off, or the challenge period can expire.

Therefore, the proposition “cannot be signed off until after the challenge period ends” is technically false.

References/topics: IdentityIQ Engineer — challenge phase, certification sign-off, completed challenges, revocation procedure, certification lifecycle.

=======

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

No. In the IdentityIQ object model, a Bundle represents a role. The owner of that role is not required to be associated with an Application object. Role ownership and application ownership are separate governance relationships.

The Role Editor defines the role Owner as a valid user or workgroup. The owner is responsible for governance activities associated with the role, including role changes, approvals, and potentially role-composition certification. The role may itself contain entitlement profiles that reference one or more applications, but those application relationships do not redefine or constrain who can own the Bundle. For example, a Business Role can aggregate IT Roles and access across several applications while still having a business owner who is represented as an Identity or Workgroup.

Application objects have their own separate owner configuration, typically representing the business owner responsible for the connected system and its application-specific certifications or approvals. IdentityIQ even differentiates between IIQRoleOwner and IIQApplicationOwner when resolving provisioning-policy ownership, demonstrating that these are separate ownership concepts.

Therefore, the statement that a Bundle owner must be associated with an Application object is false.

References/topics: IdentityIQ Engineer — Bundle/Role object, Role Owner, Application Owner, Role Editor, provisioning-policy ownership.

Yes, this is indeed one of the primary purposes of an IdentityIQ certification. Certifications are conducted to attest to a user ' s system access, ensuring that each user has appropriate and justified access rights to applications, data, and systems within the organization. This is central to IdentityIQ’s access governance and compliance processes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

The solution provided is incomplete. To create a custom audit event and set up an associated report, the process involves several steps, including defining the custom audit event in the Audit Configuration object, updating or creating relevant audit triggers in the system, and defining the custom report using XML or the IdentityIQ report editor. The steps mentioned in the solution do not cover the necessary configuration and implementation details required for this task. For a complete process, consult the SailPoint IdentityIQ Reporting Guide and the Audit Framework documentation.

No. A standard Correlation Rule and a Manager Correlation Rule perform different functions in IdentityIQ. The scenario specifically requires resolving a manager reference—an employee ' s manager employee number must be matched to the correct Identity despite several employee-number formats. That is manager correlation, not ordinary account-to-identity correlation.

A Correlation Rule is used when IdentityIQ needs custom logic to associate an application account with an Identity and simple attribute-based account correlation is insufficient. By contrast, SailPoint defines a Manager Correlation Rule specifically for establishing the Manager–Direct Report relationship between Identity objects when simple manager attribute mapping cannot accommodate the required matching logic.

Here, the presence of several employee-number formats is exactly the type of complexity that makes custom manager-correlation logic appropriate. The rule can normalize or otherwise interpret those formats and return the identity representing the correct manager.

This proposition is separate from the earlier video proposition using “Write a ManagerCorrelation rule,” which is the correct solution. Under DOMC rules, changing the proposed rule type creates a separate question.

Therefore, writing a generic Correlation Rule does not correctly target the required manager-resolution process.

References/topics: IdentityIQ Engineer — Manager Correlation Rule, Correlation Rule, manager relationships, application aggregation, account correlation, Identity Cube relationships.

=======

Based on the goals and scheduling parameters provided, the tasks should be scheduled in the following order to achieve efficient processing for a 24-hour period:

1st Check Expired Work Items (12:00 AM)

This task runs at midnight to check for expired work items. It’s important to run this first to clean up any pending tasks from the previous day.

1st Perform Identity Request Maintenance (2:00 AM)

This maintenance task is scheduled at 2:00 AM, a time when the system is least likely to be under load.

1st Aggregate Employee Authoritative Application (5:00 AM)

The aggregation for the Employee Authoritative application starts early in the day, at 5:00 AM.

1st Aggregate Contractor Authoritative Application (5:10 AM)

The Contractor Authoritative application aggregation is scheduled 10 minutes after the Employee aggregation, as per the goals.

1st Identity Refresh (5:20 AM)

Active Directory aggregation runs next at 5:20 AM.

2nd Aggregate Employee Authoritative Application (12:00 PM)

The second run for the Employee Authoritative application happens at noon.

2nd Aggregate Contractor Authoritative Application (12:10 PM)

At 12:10 PM, the Contractor Authoritative application runs again for its second aggregation.

2nd Identity Refresh (12:20 PM)

The second aggregation for Active Directory happens at 12:20 PM.

1st Aggregate Finance Authoritative Application (8:00 PM)

The Finance application aggregation is scheduled for 8:00 PM, which aligns with the goal of processing it in the evening.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Check Expired Work Items (12:00 AM)

This task is run first to ensure any expired or pending work items from the previous day are cleared out and do not interfere with the new day’s tasks. Running it at midnight ensures that any workflows or approvals with expirations are processed efficiently.

Identity Request Maintenance (2:00 AM)

This is a maintenance task that keeps the system running smoothly by managing identity requests. Scheduling it at 2:00 AM minimizes interference with other key business tasks since it ' s an off-peak hour.

Authoritative Application Aggregations (Employee/Contractor/Active Directory)

The authoritative applications (Employee, Contractor, Active Directory) need to be processed twice a day: once early in the morning and once at noon. Each aggregation must follow the specified order, as it ensures that the data flow is properly managed from the more critical Employee applications to the less frequent Contractor and Active Directory ones.

Finance Application (8:00 PM)

The Finance application is aggregated once a day, in the evening, after other high-priority applications have been processed. This ensures that financial data is up to date for reporting and compliance purposes, without overlapping with the core workday processes.

SailPoint IdentityIQ Scheduler Documentation (section on task scheduling and run-time configuration).

Rapid Setup application onboarding is designed to simplify the initial configuration and does not typically provide advanced configuration options like specifying an account attribute and value filter to identify secondary accounts. Such detailed configurations often require custom scripting or detailed adjustments within the standard application setup, outside of the Rapid Setup interface.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Sections on Application Onboarding and Advanced Account Mapping)

Yes. This is the classic joiner lifecycle event. The person has not previously been with the company, has now been hired, and needs new access and new accounts. In IdentityIQ Lifecycle Manager terms, a joiner process usually starts from an authoritative-source change such as a new HR record. The process may create or activate the Identity Cube, assign birthright roles, request or automatically provision accounts, calculate policies, trigger approvals, and send notifications. Unlike rehire or reinstatement scenarios, there are no existing disabled accounts to restore. The access model should be built from onboarding rules, role assignment logic, provisioning policies, application create policies, and approval workflows. This is exactly why joiner workflows exist: to standardize new-person onboarding and ensure access is created consistently, securely, and audibly. References/topics: IdentityIQ Engineer — joiner lifecycle event, LCM onboarding, birthright access, account creation, provisioning policy, role assignment.

No. Identity search should not be used to diagnose system errors presented in the UI. A UI error is normally investigated through syslog, application logs, stack traces, incident codes, debug logging, or server-side log files. Identity search returns identity records and identity-related data; it does not expose detailed exception traces, system error messages, connector failures, workflow stack traces, or servlet/application errors. The Word bank’s Syslog version confirms the correct direction: Syslog can be used to identify details of a system error presented in the UI because IdentityIQ logs detailed errors and stack traces there. Since this video item changes the search type to Identity, the answer changes. Identity search may help locate the user affected by a failed operation, but it is not the tool for retrieving the error details themselves. References/topics: IdentityIQ Engineer — Identity search, Syslog search, incident code, UI error troubleshooting, logging and diagnostics.

The " Total Memory " value displayed on the JVM Memory page indicates the amount of memory currently allocated to the JVM heap. In the image provided, the " Total Memory " is shown as 725.617 MB. This is the amount of memory that the JVM heap is currently using, meaning it has been allocated and is available for the JVM to use.

SailPoint IdentityIQ Performance Tuning and Monitoring Guide

SailPoint IdentityIQ Administration Guide (JVM and Memory Management Sections)

The correct sequence of steps to turn on Certifications logging at the severity log level of trace is as follows:

Edit the file: [IdentityIQ installation] > WEB-INF > classes > log4j.properties.

This step involves accessing the configuration file where logging parameters are managed. The log4j.properties file is crucial for adjusting logging settings such as the log level for specific modules in SailPoint IdentityIQ.

Uncomment the out-of-the-box logger #log4j.logger.sailpoint.api.Certification=info.

This step enables the logger for Certification by removing the comment from the respective line in the log4j.properties file. This makes the logger active for the certification process.

Change the log level to trace and save.

After uncommenting the logger, change the log level from info to trace. The trace level provides the most detailed logging, capturing comprehensive information about the certification process for troubleshooting.

Restart the application server.

Restarting the application server is necessary for the changes in the log4j.properties file to take effect. SailPoint IdentityIQ reads the updated configuration during the startup process.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Editing the log4j.properties file is a standard practice in SailPoint IdentityIQ for configuring logging. This file, located in the WEB-INF/classes directory, controls how and what IdentityIQ logs for different components.

Uncommenting the specific logger is needed to ensure that the system is logging the events related to certification. The commented line #log4j.logger.sailpoint.api.Certification=info can be found in the default configuration and needs to be activated for proper logging.

Setting the log level to trace is crucial because trace provides the most detailed logging, which is essential for deep debugging or tracking granular details about the certifications in IdentityIQ.

Restarting the server ensures that the changes to the logging configuration are applied, as the settings in log4j.properties are only read during the startup phase.

SailPoint IdentityIQ Log Management and Troubleshooting Guide (section on adjusting log levels and configurations).