SailPoint IdentityIQ-Engineer Dumps

Yes, " Terminate Identity " is a default functionality of the Lifecycle Manager (LCM) module. This functionality is associated with the " Leaver " event, which manages the offboarding process for identities that are leaving the organization. The LCM module includes workflows that handle identity termination by deactivating accounts, removing access, and potentially triggering other actions needed to finalize the termination process.

Therefore, the correct answer is A. Yes.

Yes, the Provisioning tab under the " Administrator Console " can be used to manually retry provisioning attempts for pending transactions. This feature allows administrators to retry failed provisioning operations or manually trigger provisioning actions that are in a pending state, providing greater control over the provisioning process.

SailPoint IdentityIQ Administration Guide (Provisioning Management and Manual Retry)

SailPoint IdentityIQ Provisioning Guide

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

Yes. The Environment area under the Administrator Console is intended for administrative visibility into the running IdentityIQ environment, including product/environment details and installed components or extensions where exposed by the platform. Viewing the status or presence of installed SailPoint modules/extensions is consistent with environment inspection. This is very different from controlling the application server itself. The engineer can use IdentityIQ administrative pages to understand what is installed, enabled, or available in the current deployment, which helps during troubleshooting, patch verification, upgrade planning, and support analysis. In multi-node deployments, this kind of environment visibility is useful because module or extension inconsistencies can cause unpredictable behavior. However, viewing status does not imply the Environment tab can install, uninstall, start, or stop all components. The proposed action is read/inspection-oriented, so it fits the purpose of the tab. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, installed modules, extensions, environment validation, upgrade/troubleshooting checks.

This statement is correct. The IdentityIQ rule editor is designed to assist engineers when writing BeanShell rules by exposing rule-context information, including available arguments/input variables for the selected rule type. In the editor, variables shown in the arguments list are not decorative; they represent objects or values IdentityIQ makes available to the rule at runtime. Being able to insert an input variable by interacting with the argument list is consistent with the purpose of the rule editor: helping the developer use the correct variable names and avoid spelling or context mistakes. This is especially important because rule arguments differ by rule type. A correlation rule, provisioning rule, workflow rule, and certification rule may each expose different variables. The proposed solution is therefore valid because the Rule Editor can use the rule registry metadata to present available arguments and support insertion into the BeanShell source. References/topics: IdentityIQ Engineer — BeanShell Rule Editor, rule arguments, Rule Registry, input variables, rule development tooling.

Yes, this is an example of a mover lifecycle event. A mover lifecycle event typically occurs when an individual ' s role or employment status within the organization changes, requiring updates to their accounts and access rights. In this scenario, a contractor whose accounts were previously disabled due to contract expiration needs those accounts re-enabled upon securing a new contract. This reactivation and adjustment of access rights based on a change in employment status fits the definition of a mover event.

Therefore, the correct answer is A. Yes.

The statement " The Identity object is passed to the rule " is correct. When writing source mapping rules to populate identity attributes, the Identity object is indeed passed to the rule. This allows the rule to access and modify attributes on the Identity object based on the logic defined within the rule.

Therefore, the correct answer is A. Yes.

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

The correct sequence of steps to turn on Certifications logging at the severity log level of trace is as follows:

Edit the file: [IdentityIQ installation] > WEB-INF > classes > log4j.properties.

This step involves accessing the configuration file where logging parameters are managed. The log4j.properties file is crucial for adjusting logging settings such as the log level for specific modules in SailPoint IdentityIQ.

Uncomment the out-of-the-box logger #log4j.logger.sailpoint.api.Certification=info.

This step enables the logger for Certification by removing the comment from the respective line in the log4j.properties file. This makes the logger active for the certification process.

Change the log level to trace and save.

After uncommenting the logger, change the log level from info to trace. The trace level provides the most detailed logging, capturing comprehensive information about the certification process for troubleshooting.

Restart the application server.

Restarting the application server is necessary for the changes in the log4j.properties file to take effect. SailPoint IdentityIQ reads the updated configuration during the startup process.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Editing the log4j.properties file is a standard practice in SailPoint IdentityIQ for configuring logging. This file, located in the WEB-INF/classes directory, controls how and what IdentityIQ logs for different components.

Uncommenting the specific logger is needed to ensure that the system is logging the events related to certification. The commented line #log4j.logger.sailpoint.api.Certification=info can be found in the default configuration and needs to be activated for proper logging.

Setting the log level to trace is crucial because trace provides the most detailed logging, which is essential for deep debugging or tracking granular details about the certifications in IdentityIQ.

Restarting the server ensures that the changes to the logging configuration are applied, as the settings in log4j.properties are only read during the startup phase.

SailPoint IdentityIQ Log Management and Troubleshooting Guide (section on adjusting log levels and configurations).

Yes. IdentityIQ Debug pages provide administrative access to persisted objects and can support object deletion, including deletion of individual objects and, depending on the view and selection mechanism, bulk deletion of selected objects. This capability is powerful and risky. Engineers must not treat Debug deletion like ordinary UI cleanup because IdentityIQ objects often have dependencies. Deleting a rule, workflow, application, form, task definition, policy, identity, or certification-related object can break references and cause runtime failures. Bulk deletion is especially dangerous because it can remove many objects without the safeguards provided by normal functional pages. The statement is valid from a usability/control perspective, but it should be understood as an administrative capability, not a recommended routine practice. Proper change control, export backups, dependency analysis, and non-production validation are mandatory before deleting objects through Debug. References/topics: IdentityIQ Engineer — Debug-Object page, object deletion, bulk object actions, object dependencies, administrative safeguards.

Yes. This is a valid Identity search use case because the relationship between an employee and their manager is normally represented on Identity objects through attributes such as manager, manager ID, supervisor, or reporting relationship. If the identity cube contains the manager relationship, Identity search or Advanced Analytics can be used to filter identities whose manager equals a specific person and then count the returned identities. This is completely different from using Syslog for the same purpose. The Word bank rejects Syslog for this scenario because Syslog is a logging facility, not an organizational data query mechanism. But the video asks about the Identity search type, and Identity search is the correct object domain for employee reporting relationships. The engineer must ensure that the manager attribute is populated and searchable or otherwise available to the search interface. References/topics: IdentityIQ Engineer — Identity search, manager attribute, identity cube, reporting relationships, Advanced Analytics filters.

Yes, this is indeed one of the primary purposes of an IdentityIQ certification. Certifications are conducted to attest to a user ' s system access, ensuring that each user has appropriate and justified access rights to applications, data, and systems within the organization. This is central to IdentityIQ’s access governance and compliance processes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

Yes. IdentityIQ’s Lifecycle Manager workflows are built from reusable workflow components and subprocesses. Many standard LCM subprocesses can be called from custom workflows, provided the engineer understands the expected input variables, return variables, and control flags. This is a preferred engineering pattern because it avoids rewriting complex provisioning, approval, identity request, policy-checking, or notification logic from scratch. Input variables can alter behavior such as approval routing, provisioning mode, policy checking, notification behavior, target identity, requester, plan handling, and subprocess execution path. However, reuse requires discipline: the custom workflow must pass the correct variables, preserve expected types, and handle returned values correctly. Blindly calling an LCM subprocess without matching its contract can produce broken approvals or provisioning behavior. The proposed statement is therefore true because standard LCM subprocesses are intentionally reusable when controlled through documented workflow variables. References/topics: IdentityIQ Engineer — LCM workflows, subprocess reuse, workflow input variables, provisioning workflows, custom workflow development.

The scenario described involves disabling an account and removing all its entitlements on a particular application during Mover events. The Rapid Setup user interface in SailPoint IdentityIQ primarily handles common configurations like enabling or disabling accounts, assigning or unassigning roles, and triggering certifications during lifecycle events.

However, the combination of disabling an account and removing all its entitlements for a Mover event typically involves more detailed configuration that goes beyond the capabilities of the Rapid Setup interface. Achieving this would generally require creating a custom workflow or a specific rule that handles both disabling the account and removing entitlements based on the Mover event triggers.

Thus, the Rapid Setup UI cannot achieve this level of detailed configuration, making the correct answer B. No.

Yes. In IdentityIQ workflow XML, subprocess calls can exchange data with the calling workflow through configured input and output variable handling. The send attribute is used to pass variables into the subprocess, while the returns attribute identifies variables that should be returned from the subprocess to the parent workflow context. This is important when a reusable subprocess performs initialization, provisioning-plan generation, identity-request creation, approval preparation, or other common logic and the parent workflow needs the resulting values. In the example, identityName and plan are sent into the subprocess, while identityRequestId and project are expected back. This is a valid workflow pattern and is one reason standard LCM subprocesses can be reused in custom workflows. The engineer must still ensure that variable names match and the subprocess actually sets the returned variables. References/topics: IdentityIQ Engineer — workflow subprocesses, send attribute, returns attribute, workflow variables, reusable LCM workflows.

Yes. Out-of-the-box LCM workflows commonly support configurable notification behavior, and email templates can be selected or referenced through workflow variables, arguments, or workflow configuration. IdentityIQ workflows use email templates to generate notification content for approvals, requests, provisioning outcomes, policy violations, reminders, and other lifecycle events. The ability to control which template is used allows implementers to customize communications without rewriting the whole workflow. This is a valid use of workflow configuration because the workflow is responsible for sending or triggering notifications during lifecycle processing. The engineer still needs to ensure the referenced EmailTemplate object exists, contains the correct variables for the workflow context, and is suitable for the intended recipient. But conceptually, specifying the email template for notifications is exactly the type of behavior that can be controlled through LCM workflow configuration rather than through application schema or identity-attribute configuration. References/topics: IdentityIQ Engineer — LCM workflow variables, EmailTemplate objects, notification configuration, approval emails, workflow-controlled messaging.

The statement that " All certifications include generation, the active period, sign-off, and the end period " is true. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization ' s policies.

SailPoint IdentityIQ Certification Administrator ' s Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)

The statement that " the staging period is required " for certifications is not true. In SailPoint IdentityIQ, the staging period is an optional phase during the certification campaign configuration. The staging period is used to pre-generate certifications and allow for any preparatory actions or adjustments before the certifications are officially launched and sent to reviewers. However, it is not a mandatory component for all certification campaigns.

Administrators may choose to bypass the staging period entirely depending on the specific requirements of the certification process or the urgency of the certification campaign. Therefore, while the staging period can be beneficial for managing large or complex certifications, it is not a required step.

SailPoint IdentityIQ Certification Overview Guide

SailPoint IdentityIQ Administration Guide (Sections on Certification Configuration and Staging Period)

Creating and loading a Custom Audit Report TaskDefinition XML and corresponding Custom Audit Report Form XML is indeed part of the process for setting up a custom audit report in SailPoint IdentityIQ. The TaskDefinition XML defines the report task, and the Form XML defines the user interface for running the report. These steps are essential to creating a custom audit report, and the solution correctly outlines a valid approach. Refer to the SailPoint IdentityIQ Reporting Guide, particularly the section on creating custom reports and forms, for more detailed instructions.

No. Launching certification campaigns is not default Lifecycle Manager functionality. Lifecycle Manager focuses on identity lifecycle and access-request operations such as joiner, mover, leaver processing, access requests, account management, approvals, and provisioning workflows. Certification campaigns belong to IdentityIQ’s access review and compliance/certification capabilities, not LCM’s default functional scope. Certifications are used to review access, roles, entitlements, policy violations, or account/group membership and then require reviewers to approve, revoke, or otherwise act on access. LCM may interact with certification results indirectly because remediation from a certification can trigger provisioning or access changes, but launching the campaign itself is a certification/compliance function. This question tests whether the engineer separates lifecycle-request processing from access-review governance. Mixing them up leads to poor module design and incorrect implementation expectations. References/topics: IdentityIQ Engineer — Lifecycle Manager, access request, provisioning workflows, certification campaigns, Compliance Manager.

Mail Server Certificate is not a universally required IdentityIQ mail setting for successful SMTP communication. IdentityIQ needs the SMTP host/server information, the SMTP port, and, where required by the environment, authentication details such as username and password, plus TLS/SSL-related settings. A mail server certificate may be relevant in environments using encrypted SMTP where the certificate chain must be trusted by the JVM truststore, but that does not make “Mail Server Certificate” a required IdentityIQ configuration field in every SMTP setup. Many SMTP relay configurations work with host and port only, or with host, port, and credentials. The key engineering distinction is between mandatory connection parameters and optional security/trust configuration. If TLS validation fails, certificate trust may need to be configured at the Java/application-server layer, but it is not the baseline required IdentityIQ mail-server setting. References/topics: IdentityIQ Engineer — email notifications, SMTP configuration, mail host, SMTP port, authentication, TLS/SSL trust configuration.

The statement is incorrect. When writing and executing source mapping rules to populate identity attributes, the rule itself does not need to persist the identity attribute to the database. In SailPoint IdentityIQ, once the value for an identity attribute has been calculated by a source mapping rule, IdentityIQ automatically handles the persistence of this attribute to the database as part of the aggregation or provisioning process. The developer does not need to explicitly persist the attribute; this is managed by the system.

SailPoint IdentityIQ Source Mapping Guide

SailPoint IdentityIQ Administration Guide (Aggregation and Attribute Mapping Sections)

This proposed solution is incorrect. A create-type lifecycle event trigger is used when a new identity is created or first detected in IdentityIQ. The requirement is not about a new identity; it is about an existing identity whose Division attribute changes from IT to Senior IT. That is an update or attribute-change scenario. A create event would not reliably fire when an existing user’s Division attribute is modified during aggregation or identity refresh. It also does not address the second required condition: the user must be a manager. The correct approach must detect the specific attribute transition and then evaluate the manager condition. Using a create trigger would either never launch the workflow for the intended case or launch it only at identity creation time, which is outside the stated requirement. This is a basic but important lifecycle-event design distinction: joiner/create events are not substitutes for mover or attribute-change events. References/topics: IdentityIQ Engineer — lifecycle events, create triggers, attribute-change triggers, mover events, identity refresh processing.

Certifying user expense reports is not a purpose of IdentityIQ certification. IdentityIQ certifications are focused on access and identity governance, specifically reviewing and validating user access rights within systems. Expense report certification would be a different process, typically managed by financial or expense management systems, not by IdentityIQ.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

Defining an application is not a default functionality of the Lifecycle Manager (LCM) module. Application definitions are typically part of the core IdentityIQ platform and are managed through the IdentityIQ Administration module, not Lifecycle Manager. LCM is primarily focused on managing identity lifecycle events, such as onboarding (Joiner), role changes (Mover), and offboarding (Leaver).

Therefore, the correct answer is B. No.

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

Yes, the statement is true. Both logging and auditing in SailPoint IdentityIQ can have a negative influence on performance because they involve additional function calls within the application. These processes generate data that needs to be stored, which can impact performance if not managed properly. Extensive logging and auditing, particularly at high levels of detail, can lead to increased I/O and storage usage, potentially slowing down system operations.

SailPoint IdentityIQ Performance Tuning Guide

SailPoint IdentityIQ Logging and Auditing Guide (Impact on Performance)

Yes, the sets of columns displayed in most tables in the IdentityIQ user interface are controlled by entries in the ColumnConfig elements of the UIConfig object. The UIConfig object in IdentityIQ is responsible for defining various aspects of the user interface, including the configuration of columns that are displayed in tables throughout the application. By modifying the ColumnConfig elements within this object, administrators can customize which columns appear in specific tables, including their order, visibility, and labels.

Therefore, the correct answer is A. Yes.

Yes, defining account correlation via a rule is an action that can be performed as part of configuring an application definition in SailPoint IdentityIQ. Account correlation rules are often used to determine how accounts from different sources are linked to identities within IdentityIQ. These rules allow for complex logic to be applied when matching accounts to identities, beyond simple attribute matching.

SailPoint IdentityIQ Administration Guide (Section on Account Correlation)

SailPoint IdentityIQ Application Configuration Guide (Using Rules for Account Correlation)

The statement that supported platforms of an older version of IdentityIQ will always be supported in newer versions of IdentityIQ is incorrect. As SailPoint releases new versions of IdentityIQ, the list of supported platforms (such as specific versions of Java, databases, application servers, etc.) may change. Newer versions of IdentityIQ might deprecate support for older platforms or require newer versions of software components. It is essential to consult the Release Notes or the Supported Platforms documentation for the specific IdentityIQ version to ensure compatibility.

Thus, the correct answer is B. No.

Yes, this statement is true. The default language of IdentityIQ can be changed from English by replacing the appropriate message files. Administrators can modify or replace the default English message files with those for another language, which will then become the system’s default language. This allows IdentityIQ to be localized according to the organization ' s language preferences.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Administration Guide (Language Settings and Message File Management Sections)

Specifying account correlation using a rule cannot be performed using the Rapid Setup application onboarding process. Rapid Setup is designed for straightforward and simplified onboarding processes with a focus on quick configuration, typically using predefined templates and options. However, advanced configurations like custom account correlation rules require more detailed setup, typically done outside of the Rapid Setup UI, involving scripting or detailed configuration within the application definition.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Application Onboarding Sections)

The primary and secondary colors in the IdentityIQ user interface are not set through the IdentityIQ Configuration > Miscellaneous page. Instead, these colors are typically configured through the style.css or other custom CSS files that are part of the IdentityIQ UI customization process. Administrators can define and modify the color scheme, fonts, and other style elements by editing the relevant CSS files or using the Branding feature within IdentityIQ.

Therefore, the correct answer is B. No.

Yes. A self-service registration workflow needs a Registration Identity Provisioning Policy because the policy defines what identity data must be collected, displayed, validated, or constrained during registration. LCM Registration is not merely a generic workflow button; it needs a controlled data-entry model for creating or initiating an identity record through self-service. The Registration Identity Provisioning Policy provides that model by defining registration fields, required inputs, allowed values, validation behavior, and potentially default or derived values. Without it, the workflow lacks the structured policy definition needed to support registration-specific identity creation. This is separate from ordinary Create Identity or Edit Identity policies because self-service registration usually has different security and usability requirements. Public or semi-public registration should expose only carefully selected fields and should validate values tightly. Therefore, the proposed configuration is required for the self-service registration use case. References/topics: IdentityIQ Engineer — LCM Registration, self-service registration workflow, Identity Provisioning Policies, registration fields, validation logic.

No. Identity search is designed to search Identity objects and identity-related attributes, not to count certification campaigns or certification items in a specific lifecycle phase. “Revocation phase” belongs to the certification/remediation process, not the Identity object itself. To identify the number of certifications currently in revocation, an engineer should use certification search, certification reports, task/report output, or direct certification-related reporting depending on implementation permissions. Using Identity search would return identities, not certification phase counts. Even if an identity is involved in a revocation action, the certification’s phase/status is not the primary searchable object in Identity search. This is similar to the Word bank’s distinction that Syslog search is for log events and not for unrelated governance object queries. The proposed use case is therefore outside the Identity search type’s purpose. References/topics: IdentityIQ Engineer — Identity search, certification lifecycle, revocation phase, certification reporting, Advanced Analytics.

The statement is incorrect. Email templates in SailPoint IdentityIQ are not restricted to just Identity object attributes or methods. They can access attributes and methods of any object passed to the template through its input arguments, including WorkItems, CertificationItems, and others. The template system allows the use of various objects’ properties as long as they are properly referenced within the script or template context.

The statement that a BeanShell rule in IdentityIQ must always return an object derived from the abstract class sailpoint.object.SailPointObject is incorrect. While many rules in IdentityIQ may return objects that derive from SailPointObject, it is not a strict requirement. Rules can return various types of objects depending on their purpose and context. For example, a rule might return a String, Boolean, Map, or even null, depending on what the rule is designed to accomplish.

Therefore, the correct answer is B. No.

Yes, the Provisioning tab under the " Administrator Console " in IdentityIQ can be used to view the specific operations on each attribute being provisioned. This tab provides detailed visibility into the provisioning operations, including which attributes are being modified, created, or removed as part of the provisioning process. This is essential for administrators to monitor and troubleshoot provisioning tasks.

SailPoint IdentityIQ Administration Guide (Provisioning Tab Overview)

SailPoint IdentityIQ Provisioning Guide

No, the Provisioning tab under the " Administrator Console " is not used to map the associated WorkflowCase to a particular Provisioning Transaction. The Provisioning tab is primarily for monitoring and managing provisioning operations, not for mapping workflow cases to transactions. Such mappings are typically handled within the workflow configuration itself, not through the Provisioning tab.

SailPoint IdentityIQ Workflow Guide (Handling Workflow and Provisioning Transactions)

SailPoint IdentityIQ Administration Guide (Provisioning Tab Limitations)

Yes. IdentityIQ provides audit configuration capabilities through the user interface so administrators can manage much of the platform’s audit behavior without directly editing XML for every standard case. Audit configuration is used to control which events or actions are captured, allowing organizations to record relevant administrative, governance, provisioning, workflow, and compliance activity. This is important because excessive auditing can create unnecessary database volume and noise, while insufficient auditing can leave gaps in troubleshooting and compliance evidence. For standard audit controls, the Audit Configuration page is the normal administrative place to manage audit behavior. However, this does not mean every custom audit requirement can be completed only through the UI. Custom audit actions, custom reports, or custom rule/workflow audit writes may still require XML or BeanShell work. The statement says the majority of auditing is managed through the UI page, which is valid for standard IdentityIQ auditing operations. References/topics: IdentityIQ Engineer — Audit Configuration, audit events, audit actions, compliance evidence, custom audit extension.

The statement " All Identity Mappings must use a rule to set the identity attribute " is incorrect. While source mapping rules can be used to populate identity attributes dynamically, it is not mandatory for all identity mappings to rely on a rule. Identity mappings can also be configured using direct mappings, where attributes from a source are directly mapped to IdentityIQ attributes without any rule-based logic.

Therefore, the correct answer is B. No.

Rapid Setup application onboarding is designed to simplify the initial configuration and does not typically provide advanced configuration options like specifying an account attribute and value filter to identify secondary accounts. Such detailed configurations often require custom scripting or detailed adjustments within the standard application setup, outside of the Rapid Setup interface.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Sections on Application Onboarding and Advanced Account Mapping)

Yes. Attesting assignment of roles to users is a valid purpose of an IdentityIQ certification. Role-based governance depends not only on whether roles contain the correct entitlements, but also on whether the correct users hold those roles. A certification can ask reviewers to validate role membership, confirm that role assignments are appropriate for job function, and revoke or remediate role assignments that are no longer justified. This is especially important in environments where role assignment rules, business roles, or automated provisioning logic are used. If the rule assigns a role to the wrong population, users may inherit incorrect access even if the role composition itself is technically correct. Certification provides a formal review and sign-off process, creating accountability and audit evidence. Therefore, attesting role assignment to users is squarely within IdentityIQ certification functionality. References/topics: IdentityIQ Engineer — role membership certification, access review, role assignment attestation, certification sign-off, remediation decisions.

The Create Identity Provisioning Policy in SailPoint IdentityIQ is designed to apply specific provisioning rules and actions during the creation of identities, especially when aggregating data from authoritative sources. These policies ensure that newly created identities have valid and authorized attribute values based on organizational rules and compliance requirements.

During identity aggregation from an authoritative source, the provisioning policy can enforce rules such as role assignments, attribute validation, and other actions necessary to ensure that the identity is created correctly and securely.

Therefore, the correct answer is A. Yes.

This is a valid step, with the typo corrected as “create the audit event.” Registering an AuditAction in AuditConfig only defines the custom event type; IdentityIQ still needs executable logic to actually write the audit event when the relevant condition occurs. That logic can be placed in a BeanShell rule, task, workflow step, or other appropriate execution point depending on the business process being audited. The code must create/populate the audit record with the configured action name and the relevant data values, such as target identity, actor, source object, application, attribute values, or other fields needed by the later report. Without this implementation logic, the custom audit action would exist but no audit records would be generated. Therefore, writing the logic to create the audit event is a legitimate step in the end-to-end process. References/topics: IdentityIQ Engineer — BeanShell audit logic, workflow audit events, custom AuditAction usage, audit data population, custom audit reporting.

Yes, specifying which access items may be requested can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In IdentityIQ, control variables within LCM workflows allow administrators to define the scope and criteria for access requests, including restricting or specifying which entitlements, roles, or applications can be requested by users. This is part of the request configuration process, where the access items that users can see and request are defined.

Therefore, the correct answer is A. Yes.

Yes. This is the classic joiner lifecycle event. The person has not previously been with the company, has now been hired, and needs new access and new accounts. In IdentityIQ Lifecycle Manager terms, a joiner process usually starts from an authoritative-source change such as a new HR record. The process may create or activate the Identity Cube, assign birthright roles, request or automatically provision accounts, calculate policies, trigger approvals, and send notifications. Unlike rehire or reinstatement scenarios, there are no existing disabled accounts to restore. The access model should be built from onboarding rules, role assignment logic, provisioning policies, application create policies, and approval workflows. This is exactly why joiner workflows exist: to standardize new-person onboarding and ensure access is created consistently, securely, and audibly. References/topics: IdentityIQ Engineer — joiner lifecycle event, LCM onboarding, birthright access, account creation, provisioning policy, role assignment.

In SailPoint IdentityIQ, what users can see and do is indeed partly controlled by their authorized scope. Authorized scopes define the range of objects (such as identities, roles, applications) that a user has access to. Scopes can be applied to limit access based on specific criteria, ensuring that users only interact with the data and functionalities relevant to their role or responsibility within the organization.

For example, a user with access to a specific scope may only view or manage identities within a certain department or geographical location, depending on how the scope is configured.

Therefore, the correct answer is A. Yes.

A Role Membership Certification is appropriate for this requirement because the hospital is trying to confirm that users assigned to a role are correct. The test is not about whether the role contains the right entitlements; that would point to Role Composition Certification. It is also not primarily about application ownership or account group membership. The wording says the business analysts want to verify the role assignment rules by certifying the users who have been assigned the role. That maps directly to a membership review: who is in the role, whether each membership is valid, and whether the assignment rule is producing the expected population. The security team can be configured as the certifier, final reviewer, or sign-off participant depending on certification ownership and sign-off configuration. Therefore, the proposed certification type achieves the stated goal. References/topics: IdentityIQ Engineer — Role Membership Certification, role assignment rules, certification ownership, sign-off, access review routing.

This is not a valid step for creating a custom audit event and associated report. A Custom Certification Event Schedule relates to certification scheduling or certification-event processing, not to defining a new audit action in the audit framework. A ruleRunner task can execute a rule, but simply creating a certification event schedule and ruleRunner task does not establish a custom audit event type, does not register the event in AuditConfig, and does not create a report capable of querying that audit data. For a custom audit event, the engineer must define the audit action/event, ensure the code path writes the audit event with the appropriate attributes, and then create or configure a report that can retrieve and display those audit records. The proposed solution is pointed at the wrong subsystem. It confuses certification scheduling automation with audit event definition and reporting. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction, custom audit events, audit reporting, ruleRunner task limitations.

Yes, the statement is true. In SailPoint IdentityIQ, the built-in auditing options are indeed immutable, meaning they are always recorded and cannot be disabled or altered. This ensures that critical actions and changes are always logged for compliance and security purposes. However, custom audit configurations, such as additional custom audit fields or logs, can be turned on or off based on specific organizational requirements.

SailPoint IdentityIQ Audit Guide

SailPoint IdentityIQ Administration Guide (Sections on Auditing and Compliance)

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)

Yes. Policy checking behavior is one of the areas commonly controlled in LCM request workflows through workflow variables or configuration controlling policy evaluation mode. IdentityIQ can evaluate whether a requested access change would violate configured policies before the request is finalized or provisioned. Depending on configuration, the system can present policy violations to the requester, block submission, continue with warnings, or require additional approval/mitigation. The proposed behavior — checking whether an access request would violate policies and letting the requester review before submitting — aligns with interactive policy-checking behavior in LCM. This is an execution behavior of the request workflow, not an application schema setting. The engineer must still ensure policies are configured and enabled, but the workflow/control-variable layer can determine how those checks are applied during request submission. References/topics: IdentityIQ Engineer — LCM workflow control variables, policy checking, request policy violations, interactive policy review, access request governance.

Yes. IdentityIQ supports certain UI branding customizations, but product attribution requirements still matter. If a customer removes SailPoint branding from a prominent UI location such as the header bar, the product attribution should still be preserved elsewhere, such as in the copyright footer with wording like “Powered by SailPoint IdentityIQ.” This reflects the distinction between cosmetic branding changes and removal of required product identification. From an engineering standpoint, UI customization should be implemented carefully so it survives upgrades as much as possible and does not violate branding, licensing, or support expectations. Teams should also document all branding changes because customized UI files are commonly impacted during upgrades and patching. The proposed statement is valid because it preserves SailPoint product attribution while allowing the customer to modify the visible header branding. References/topics: IdentityIQ Engineer — UI customization, branding requirements, copyright footer, upgrade-safe customization, customer-specific UI changes.

The purpose of an IdentityIQ certification is not to attest to a user ' s integrity. Certifications in IdentityIQ are designed to review and verify user access rights to ensure they are appropriate based on roles, policies, and organizational rules. The focus is on access management rather than personal qualities like integrity.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

An Account Group Membership Certification is designed to certify group memberships within accounts, typically focusing on the validation of access within specific account groups (e.g., Active Directory groups).

This type of certification does not directly address the accuracy of role composition or the correctness of entitlements assigned within roles. Since the bank ' s goal is to ensure that all roles include the correct entitlements, an Account Group Membership Certification is not suitable for this purpose.

Thus, the correct answer is B. No.

No, the " Email Protocol " is not a setting that an engineer must set up to ensure successful communication with the SMTP server. Instead, the essential settings include the mail server address, port, authentication details (like username and password if required), and possibly the security settings (such as SSL/TLS). While the email protocol (e.g., SMTP) is implicitly involved, it is not a specific setting that needs to be configured separately within IdentityIQ. The critical setup revolves around configuring the mail server connection parameters.

SailPoint IdentityIQ Configuration Guide (Email and Notification Settings)

SailPoint IdentityIQ Administration Guide (SMTP Configuration for Email Notifications)

In SailPoint IdentityIQ, the concept of a " role " is fundamental to the identity governance framework. The platform supports several default role types that are pre-configured to help organizations manage access effectively. The default role types include:

Business Role: Represents a collection of entitlements necessary for a specific job function within the organization.

IT Role: Aggregates technical entitlements that are typically assigned together, often linked to specific applications or systems.

Application Role: Tied to a specific application, representing roles within that application ' s context.

Composite Role: A combination of other roles, either business or IT, to form a higher-level role.

The term " Entitlement Role " is not recognized as a default role type in SailPoint IdentityIQ. While entitlements can be components of roles, " Entitlement Role " itself is not a predefined role type in the platform. Therefore, the correct answer is B. No.

This proposed solution is not correct. In IdentityIQ, features and functional access are controlled primarily through capabilities, not scopes. Capabilities determine whether a user can perform administrative or functional actions such as managing identities, accessing reports, configuring applications, launching tasks, or using privileged pages. Scopes, by contrast, are generally used to restrict which objects or data a user can see or act upon. For example, a scoped administrator may only be able to view or administer identities, applications, or work items within an assigned organizational boundary. That is object/data visibility control, not feature enablement. Saying that scopes control “the features that are used” confuses two different authorization layers. The correct IdentityIQ distinction is: capabilities control functional permissions, while scopes constrain object access boundaries. References/topics: IdentityIQ Engineer — authentication, authorization, capabilities, scopes, delegated administration.