SailPoint IdentityIQ-Engineer Dumps

The statement is false. While it is true that logging and auditing require extra function calls and generate data, the suggestion that this data can be compressed to avoid storage issues and improve performance is misleading. In practice, while compression might save storage space, it does not inherently improve performance, particularly because the overhead of compression and decompression could negate the performance benefits. Effective performance management in IdentityIQ involves more nuanced approaches, such as optimizing the level of detail in logs, managing log rotation, and tuning the system for efficient I/O operations.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Performance Tuning Guide

Yes. The Environment area under the Administrator Console is intended for administrative visibility into the running IdentityIQ environment, including product/environment details and installed components or extensions where exposed by the platform. Viewing the status or presence of installed SailPoint modules/extensions is consistent with environment inspection. This is very different from controlling the application server itself. The engineer can use IdentityIQ administrative pages to understand what is installed, enabled, or available in the current deployment, which helps during troubleshooting, patch verification, upgrade planning, and support analysis. In multi-node deployments, this kind of environment visibility is useful because module or extension inconsistencies can cause unpredictable behavior. However, viewing status does not imply the Environment tab can install, uninstall, start, or stop all components. The proposed action is read/inspection-oriented, so it fits the purpose of the tab. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, installed modules, extensions, environment validation, upgrade/troubleshooting checks.

This is not a clean joiner lifecycle event. A joiner event normally represents a person newly entering the organization or being newly onboarded into managed access, usually requiring new identity setup, new accounts, baseline access, roles, approvals, and provisioning. The proposed scenario describes a contractor whose previous relationship ended, whose accounts were disabled, and who now has a new contract requiring previous accounts to be enabled. That is closer to a rehire/reactivation or account-enable lifecycle event than a first-time joiner. The distinction matters in IdentityIQ because a true joiner process may create accounts and assign initial access, while a rehire/reactivation process may restore, enable, or reassess previously existing accounts and access. Treating this as a joiner could create duplicate accounts or duplicate access instead of properly reactivating existing Links/accounts. References/topics: IdentityIQ Engineer — Lifecycle Manager, joiner event, rehire/reactivation, account enablement, identity lifecycle workflow design.

Yes. IdentityIQ Identity Provisioning Policies define the fields and validation behavior used when identities are created or updated through supported identity-management flows. When an explicit Update Identity Provisioning Policy is not configured, IdentityIQ can fall back to the Create Identity Provisioning Policy for Edit Identity operations. This fallback allows environments to avoid duplicating identity-field configuration when the create and update forms require the same data model or validation logic. The engineer still needs to design this carefully: create and update operations are not always identical. Create flows may require fields that should not be editable later, while update flows may expose fields that are irrelevant at creation. If the organization needs separate behavior for editing identities, an Update Identity Provisioning Policy should be defined. But the proposed statement is true as a product behavior: the Create Identity policy can be used when no Update Identity policy exists. References/topics: IdentityIQ Engineer — Identity Provisioning Policies, Create Identity, Edit Identity, Update Identity policy, field validation and allowed values.

The statement " All Identity Mappings must use a rule to set the identity attribute " is incorrect. While source mapping rules can be used to populate identity attributes dynamically, it is not mandatory for all identity mappings to rely on a rule. Identity mappings can also be configured using direct mappings, where attributes from a source are directly mapped to IdentityIQ attributes without any rule-based logic.

Therefore, the correct answer is B. No.

No. Identity search should not be used to diagnose system errors presented in the UI. A UI error is normally investigated through syslog, application logs, stack traces, incident codes, debug logging, or server-side log files. Identity search returns identity records and identity-related data; it does not expose detailed exception traces, system error messages, connector failures, workflow stack traces, or servlet/application errors. The Word bank’s Syslog version confirms the correct direction: Syslog can be used to identify details of a system error presented in the UI because IdentityIQ logs detailed errors and stack traces there. Since this video item changes the search type to Identity, the answer changes. Identity search may help locate the user affected by a failed operation, but it is not the tool for retrieving the error details themselves. References/topics: IdentityIQ Engineer — Identity search, Syslog search, incident code, UI error troubleshooting, logging and diagnostics.

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

A Role Composition Certification is specifically designed to ensure that roles are composed correctly by reviewing the entitlements and other roles they aggregate. This certification allows reviewers to verify whether the roles include the appropriate entitlements based on business needs and compliance requirements.

Given that the bank ' s objective is to ensure that all roles include the correct entitlements, a Role Composition Certification is the most appropriate tool to achieve this goal. It allows for the comprehensive review and validation of roles and their associated entitlements, ensuring alignment with the overall access governance strategy.

Therefore, the correct answer is A. Yes.

Running the command iiq extendedSchema in the IIQ_Home/WEB-INF/bin directory is correct and one of the standard procedures for generating database scripts to extend Application attributes in the IdentityIQ database. This command processes the schema definitions (including any new attributes) and generates the appropriate SQL scripts to update the database schema. These scripts can then be executed against the database to apply the changes.

SailPoint IdentityIQ Administration Guide (Schema Extension and Database Management Sections)

SailPoint IdentityIQ Configuration Guide (Extended Schema Management)

The provided BeanShell code snippet attempts to filter and print the names of GroupDefinition objects owned by " Randy.Knight. " However, the code contains a few issues that prevent it from functioning correctly as written:

Class Import: The GroupDefinition class should be imported explicitly at the beginning of the script, which is missing here.

Query Execution: The use of context.getObjectsByNumber(GroupDefinition.class, i) is incorrect. This method does not exist in this context. The correct approach would be to use context.getObjects() to retrieve the list of objects and iterate over them.

Looping Logic: The loop logic also contains a flaw. Instead of using a counter-based loop with context.getObjectsByNumber(), the recommended approach is to use context.search() to retrieve a list of filtered objects and then iterate through the results.

A corrected version of this code would look something like this:

import sailpoint.object.GroupDefinition;

import sailpoint.object.Filter;

import sailpoint.object.QueryOptions;

Filter filter = Filter.eq( " owner.name " , " Randy.Knight " );

QueryOptions qo = new QueryOptions();

qo.addFilter(filter);

List < GroupDefinition > groupDefinitions = context.getObjects(GroupDefinition.class, qo);

for (GroupDefinition group : groupDefinitions) {

System.out.println(group.getName());

}

In this corrected version:

We explicitly import GroupDefinition.

We retrieve the filtered objects with context.getObjects(GroupDefinition.class, qo) instead of getObjectsByNumber.

Thus, the original code is not correct as written. The correct answer is B. No.

This implementation is correct in structure. The code first resolves the Application object named MagicBox, then creates an IdentityService, then calls service.getLinks(identity, application) to retrieve the account links for that identity on the application. Because the requirement is to return all account names, using getLinks and iterating over the returned List < Link > is the right pattern. Each Link represents an account on an application, and getNativeIdentity() returns the account’s native identifier, which is the account name or unique account key from the target application. The null check prevents a null-pointer issue if no links are returned. In a production-quality version, an engineer might also handle a missing application object and ensure Java collection imports are available, but those do not invalidate the core implementation pattern shown. Compared with the flawed single-link version, this solution correctly handles multiple accounts. References/topics: IdentityIQ Engineer — IdentityService API, Application object lookup, Link collection retrieval, nativeIdentity, BeanShell utility methods.

This proposed solution is not valid as written. The stem says the engineer needs to create a custom audit event and set up an associated report. The proposed XML fragment is an ObjectAttribute definition for an attribute named userType; it is not an AuditAction definition. An ObjectAttribute entry is used in object configuration contexts to describe an attribute’s display, edit behavior, extended number, name, and type. That does not define a new audit action/event in the AuditConfig object. A proper audit event definition would use an AuditAction element or equivalent AuditConfig configuration identifying the audit action name, display name, and enabled state. Because the XML fragment shown does not create a custom audit action, it cannot satisfy the required step. This is exactly the kind of syntax-level distinction an IdentityIQ engineer must catch: correct object type and correct XML element matter. References/topics: IdentityIQ Engineer — AuditConfig XML, AuditAction definition, ObjectAttribute configuration, custom audit event setup.

The statement suggests moving the XML file into IIQ_HOME/WEB-INF/database as part of the process to import SailPoint XML file objects into IdentityIQ. However, this is not a valid step for importing XML objects.

The correct procedure to import SailPoint XML objects typically involves the following steps:

Use the iiq console command-line tool provided by SailPoint to import the XML file.

The command typically looks like: iiq console import < filename > .xml.

The XML file does not need to be moved to any specific directory like WEB-INF/database for the import process.

Moving the XML file into the WEB-INF/database directory does not align with the documented process and does not facilitate the import. The correct answer is B. No.

Yes. If a user already has an account on an application and needs the ability to request an additional/new account through Manage User Access, the relevant LCM/QuickLink configuration must permit requesting new accounts. The proposed setting, “Allow requesting new accounts,” is specifically aligned with that requirement. Manage User Access and Manage Accounts behavior is controlled through Lifecycle Manager quicklink and population configuration, which determines what actions are visible and available to eligible users. Without enabling new-account requests for the appropriate QuickLink population, the user may only be able to manage existing account access or request entitlements for current accounts, not initiate a new account request on that application. This setting must also align with the application’s provisioning support and account creation policy. The configuration grants the UI/request capability; successful fulfillment still depends on application schema, create policy, approvals, and provisioning workflow. References/topics: IdentityIQ Engineer — LCM, Manage User Access, Manage Accounts QuickLink, QuickLink population, new account request, provisioning policy.

Placing a QuickLink object directly on a workflow is not a valid step in the development of a custom QuickLink. QuickLinks are used to provide users with easy access to specific tasks or workflows through the IdentityIQ interface, but the QuickLink itself is not embedded within the workflow. Instead, the QuickLink is created as a separate object and associated with the desired workflow or task that it is meant to launch.

The correct approach would involve creating a QuickLink that points to the workflow and then controlling access to the QuickLink by restricting it to a specific QuickLink population (e.g., " Managers " ). Therefore, the correct answer is B. No.

This is not a valid step for creating a custom audit event and associated report. A Custom Certification Event Schedule relates to certification scheduling or certification-event processing, not to defining a new audit action in the audit framework. A ruleRunner task can execute a rule, but simply creating a certification event schedule and ruleRunner task does not establish a custom audit event type, does not register the event in AuditConfig, and does not create a report capable of querying that audit data. For a custom audit event, the engineer must define the audit action/event, ensure the code path writes the audit event with the appropriate attributes, and then create or configure a report that can retrieve and display those audit records. The proposed solution is pointed at the wrong subsystem. It confuses certification scheduling automation with audit event definition and reporting. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction, custom audit events, audit reporting, ruleRunner task limitations.

No. Whether an application supports password change requests through the IdentityIQ UI is not controlled by generic LCM workflow control variables. Password-change support depends on the application connector’s capabilities, password-management configuration, application settings, schema/support for password operations, policies, and QuickLink/user-interface configuration. The workflow may process or route a password-change request once launched, but it does not define which target applications support that operation. That capability must be configured at the application/connector and password-management layer. Mixing these layers would create a brittle design: workflow variables should govern execution behavior, while application configuration defines available account operations. Therefore, the proposed solution is not achievable merely by configuring out-of-the-box LCM workflow control variables. References/topics: IdentityIQ Engineer — password management, application connector capabilities, LCM workflows, QuickLink password change, account operation support.

Specifying account correlation using a rule cannot be performed using the Rapid Setup application onboarding process. Rapid Setup is designed for straightforward and simplified onboarding processes with a focus on quick configuration, typically using predefined templates and options. However, advanced configurations like custom account correlation rules require more detailed setup, typically done outside of the Rapid Setup UI, involving scripting or detailed configuration within the application definition.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Application Onboarding Sections)

Yes, the Provisioning tab under the " Administrator Console " in IdentityIQ can be used to view the specific operations on each attribute being provisioned. This tab provides detailed visibility into the provisioning operations, including which attributes are being modified, created, or removed as part of the provisioning process. This is essential for administrators to monitor and troubleshoot provisioning tasks.

SailPoint IdentityIQ Administration Guide (Provisioning Tab Overview)

SailPoint IdentityIQ Provisioning Guide

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

Syslog is primarily used for logging system events and not for performing complex searches or queries on hierarchical or organizational data like identifying the number of employees that report to a specific person. Such a query would typically require access to the organizational hierarchy or identity data, which is better achieved through IdentityIQ’s reporting or search capabilities within the application rather than using Syslog. Syslog captures log events related to system operations, errors, and other activity logs but isn ' t designed for the type of structured query described in the question.

SailPoint IdentityIQ Logging and Monitoring Guide

SailPoint IdentityIQ Administration Guide (Sections on Reporting and Search)

This proposed solution is incorrect because it confuses generating a schema script with applying a generated schema script. To generate the database script for extended attributes, the engineer must update the relevant Hibernate mapping files and then run the appropriate IdentityIQ schema-generation command, commonly from the IIQ_HOME/WEB-INF/bin area, so IdentityIQ can produce the database-specific SQL needed for the extension. Running the extendedSchema script on the database is an execution/apply step, not the generation step. In other words, the generated SQL script is run after it has already been produced. For ManagedAttribute or other object extensions, the sequence matters: define the extension in the mapping/configuration layer, generate the script, stop application services as needed, apply the script to the database, then ensure IdentityIQ object configuration reflects the new attribute. The proposed solution skips the generation step entirely. References/topics: IdentityIQ Engineer — Hibernate extension files, extended schema generation, ManagedAttribute extension, database schema update process.

Yes. A self-service registration workflow needs a Registration Identity Provisioning Policy because the policy defines what identity data must be collected, displayed, validated, or constrained during registration. LCM Registration is not merely a generic workflow button; it needs a controlled data-entry model for creating or initiating an identity record through self-service. The Registration Identity Provisioning Policy provides that model by defining registration fields, required inputs, allowed values, validation behavior, and potentially default or derived values. Without it, the workflow lacks the structured policy definition needed to support registration-specific identity creation. This is separate from ordinary Create Identity or Edit Identity policies because self-service registration usually has different security and usability requirements. Public or semi-public registration should expose only carefully selected fields and should validate values tightly. Therefore, the proposed configuration is required for the self-service registration use case. References/topics: IdentityIQ Engineer — LCM Registration, self-service registration workflow, Identity Provisioning Policies, registration fields, validation logic.

This statement is not correct. IdentityIQ syslog event searching is not limited only to Incident Code lookups. Incident Code is useful when a user-facing error displays a code that can be traced back to a logged system event, but syslog analysis is broader than that. Administrators and engineers use syslog data to investigate operational errors, workflow failures, connector issues, provisioning errors, aggregation failures, authentication problems, and application exceptions. Advanced Analytics and log-search capabilities are intended to help filter and locate system events using more than a single incident-code value. Treating Incident Code as the only searchable attribute would make syslog analysis nearly useless for routine troubleshooting where no user-facing incident code is available. The correct engineering view is that Incident Code is one important search key, not the exclusive search mechanism. References/topics: IdentityIQ Engineer — syslog search, Advanced Analytics, incident code troubleshooting, system-error diagnosis, operational logging.

No, this is not a valid action. When setting up or using the Services Standard Build (SSB) for a SailPoint IdentityIQ instance, the client ' s identityiq.war file should not be placed in the home directory of the build. The WAR file should be deployed to the appropriate application server ' s deployment directory, not in the home directory of the build itself. The SSB process typically involves more structured deployment processes that adhere to best practices for application deployment.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Deployment Best Practices

An Account Group Membership Certification is designed to certify group memberships within accounts, typically focusing on the validation of access within specific account groups (e.g., Active Directory groups).

This type of certification does not directly address the accuracy of role composition or the correctness of entitlements assigned within roles. Since the bank ' s goal is to ensure that all roles include the correct entitlements, an Account Group Membership Certification is not suitable for this purpose.

Thus, the correct answer is B. No.

No. IdentityIQ report execution is based on task/report scheduling behavior, and the platform is not limited to running reports only once per day. Reports can be executed manually or scheduled according to supported scheduling options, depending on task configuration and administrative requirements. A daily schedule is only one possible cadence. IdentityIQ reporting is built on task infrastructure, and report templates can generate report instances based on selected parameters, filters, and schedules. In real deployments, organizations may schedule reports daily, weekly, monthly, or at other configured intervals depending on governance, compliance, and operational needs. The proposed solution is too restrictive because it says “at most once per day,” which incorrectly imposes a limitation that is not inherent to IdentityIQ reporting. The accurate concept is that reports can be scheduled, but the frequency depends on the task scheduler configuration and the report’s business purpose. References/topics: IdentityIQ Engineer — reporting, report templates, scheduled reports, task execution, report instances.

Yes, this statement is true. The default language of IdentityIQ can be changed from English by replacing the appropriate message files. Administrators can modify or replace the default English message files with those for another language, which will then become the system’s default language. This allows IdentityIQ to be localized according to the organization ' s language preferences.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Administration Guide (Language Settings and Message File Management Sections)

Yes, this is a valid step to take when importing SailPoint XML file objects into IdentityIQ. The IdentityIQ console (iiq console) is a command-line tool used for various administrative tasks, including importing and exporting XML objects.

To import an XML object through the IdentityIQ console, the general procedure involves:

Navigating to the IdentityIQ installation directory.

Running the console with the import command:

iiq console import < filename > .xml

The console will process the XML file, importing the defined objects (roles, policies, identity mappings, etc.) into the IdentityIQ database.

This method is officially documented and is a common practice for importing configuration and objects into SailPoint IdentityIQ. Therefore, the answer is A. Yes.

The statement is false. While it is true that logging and auditing require extra function calls and generate data, the suggestion that this data can be compressed to avoid storage issues and improve performance is misleading. In practice, while compression might save storage space, it does not inherently improve performance, particularly because the overhead of compression and decompression could negate the performance benefits. Effective performance management in IdentityIQ involves more nuanced approaches, such as optimizing the level of detail in logs, managing log rotation, and tuning the system for efficient I/O operations.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Performance Tuning Guide

Allow is a valid action when acting on a policy violation, assuming the policy violation owner has the required permissions. In IdentityIQ compliance workflows, not every violation is immediately remediated. Some violations are business-approved exceptions, temporary exceptions, or accepted risks. The Allow action is used to acknowledge that the violation may remain in place, often with justification, comments, expiration, or compensating-control context depending on configuration. This is different from remediation, where access is changed or removed, and different from mitigation, where a mitigating control is attached. In the Account Policy context, the violation may indicate that a user exceeds a permitted account condition. If the business determines the condition is acceptable, the owner may allow it rather than immediately remove or alter an account. This is a legitimate compliance decision, provided the user has permission to take that action. References/topics: IdentityIQ Engineer — policy violation lifecycle, Account Policy, allow/exception handling, mitigation, remediation, Compliance Manager.

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in the provisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.

The purpose of an IdentityIQ certification is not to attest to a user ' s integrity. Certifications in IdentityIQ are designed to review and verify user access rights to ensure they are appropriate based on roles, policies, and organizational rules. The focus is on access management rather than personal qualities like integrity.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

Yes. The Run Rule capability in the IdentityIQ debug/admin tooling is useful for executing BeanShell rule logic and viewing the result, especially during development or troubleshooting. When an engineer writes a simple rule that returns a value, the Run Rule feature can be used to validate the logic and observe the returned output. This is useful for quick testing of rules that evaluate identity attributes, build strings, test object lookups, or verify small pieces of BeanShell logic before embedding the rule into a workflow, lifecycle event, policy, certification configuration, or application configuration. However, this feature must be used carefully because rule execution can interact with real IdentityIQ objects depending on the code. The benefit described in the proposed solution is narrow and valid: displaying the return value of simple code is a legitimate use case. It is not the same as saying the feature should be used for unrestricted database manipulation. References/topics: IdentityIQ Engineer — Debug pages, Run Rule, BeanShell rules, rule testing, troubleshooting.

This is a valid step, with the typo corrected as “create the audit event.” Registering an AuditAction in AuditConfig only defines the custom event type; IdentityIQ still needs executable logic to actually write the audit event when the relevant condition occurs. That logic can be placed in a BeanShell rule, task, workflow step, or other appropriate execution point depending on the business process being audited. The code must create/populate the audit record with the configured action name and the relevant data values, such as target identity, actor, source object, application, attribute values, or other fields needed by the later report. Without this implementation logic, the custom audit action would exist but no audit records would be generated. Therefore, writing the logic to create the audit event is a legitimate step in the end-to-end process. References/topics: IdentityIQ Engineer — BeanShell audit logic, workflow audit events, custom AuditAction usage, audit data population, custom audit reporting.

This is a valid implementation pattern. The workflow requirement has three routing outcomes, and the proposed solution expresses them as three explicit transition elements. The first transition routes to Stop when the approval flag is false, which corresponds to the Reject or back action. The second transition routes to Audit when the comment variable is not null or empty, using sailpoint.tools.Util.isNotNullOrEmpty(comment). That satisfies the condition that the Approve action was used and the returned form field has a value. The final transition to Provision has no condition, making it the default fallback when the prior transition conditions are not satisfied. This is the correct style for workflow routing because the destination steps are explicitly declared through the to attribute, and the conditional routing is attached to each transition rather than relying on an invalid free-form return block. References/topics: IdentityIQ Engineer — workflow transitions, when conditions, script expressions, form approval routing, default workflow transition behavior.

Creating a custom audit event and setting up an associated report involves steps such as defining the audit event, modifying the audit configuration, and creating a custom report using the SailPoint IdentityIQ reporting framework. Simply creating a Data Export task does not fulfill these requirements. A Data Export task is used for exporting data from IdentityIQ and is unrelated to the creation of custom audit events or custom reports. Refer to the SailPoint IdentityIQ Reporting Guide and the IdentityIQ Audit Framework documentation for more information on correctly creating and configuring custom audit events and reports.

This statement is false. BeanShell rules in IdentityIQ do not universally have to produce a meaningful output. A rule’s expected return behavior depends on the rule type and the context in which the rule is executed. Some rules are designed to return a Boolean, String, Map, ProvisioningPlan, Identity, or another object. Other rules perform side effects, such as modifying a plan, transforming values, logging, altering an object, or executing validation logic, and may return null or no useful result. The Word bank contains a related but different rule-output concept: a BeanShell rule does not always need to return an object derived from sailpoint.object.SailPointObject; it may return several other object types or null. The proposed statement is even broader and still incorrect because IdentityIQ rule output is rule-type dependent, not mandatory in a generic sense. References/topics: IdentityIQ Engineer — BeanShell rules, rule registry, return values, rule execution context, input/output contracts.

No. The proposed XML is not correct because the reference class is wrong. In IdentityIQ, rule libraries are represented through rule objects used as reusable BeanShell libraries. When a rule references a common library, the referenced object should be a Rule object, not a nonstandard sailpoint.object.RuleLibrary class. The correct pattern is to reference the library as a rule by name under the rule’s referenced-rules section. Rule libraries allow shared methods and reusable code to be included across multiple rules, which is important for reducing duplication and maintaining consistent logic. However, XML object references must use the correct IdentityIQ object class. If the class does not correspond to the persisted object type, the import or runtime resolution can fail. The concept of referencing a common rules library is valid, but this specific code is not. References/topics: IdentityIQ Engineer — Rule libraries, ReferencedRules XML, Rule object references, BeanShell code reuse, XML object configuration.

Yes, " Terminate Identity " is a default functionality of the Lifecycle Manager (LCM) module. This functionality is associated with the " Leaver " event, which manages the offboarding process for identities that are leaving the organization. The LCM module includes workflows that handle identity termination by deactivating accounts, removing access, and potentially triggering other actions needed to finalize the termination process.

Therefore, the correct answer is A. Yes.

The " Total Memory " value displayed on the JVM Memory page indicates the amount of memory currently allocated to the JVM heap. In the image provided, the " Total Memory " is shown as 725.617 MB. This is the amount of memory that the JVM heap is currently using, meaning it has been allocated and is available for the JVM to use.

SailPoint IdentityIQ Performance Tuning and Monitoring Guide

SailPoint IdentityIQ Administration Guide (JVM and Memory Management Sections)

Rapid Setup application onboarding is designed to simplify the initial configuration and does not typically provide advanced configuration options like specifying an account attribute and value filter to identify secondary accounts. Such detailed configurations often require custom scripting or detailed adjustments within the standard application setup, outside of the Rapid Setup interface.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Sections on Application Onboarding and Advanced Account Mapping)

The statement is incorrect. Email templates in SailPoint IdentityIQ are not restricted to just Identity object attributes or methods. They can access attributes and methods of any object passed to the template through its input arguments, including WorkItems, CertificationItems, and others. The template system allows the use of various objects’ properties as long as they are properly referenced within the script or template context.

This proposed solution is not correct. In IdentityIQ, features and functional access are controlled primarily through capabilities, not scopes. Capabilities determine whether a user can perform administrative or functional actions such as managing identities, accessing reports, configuring applications, launching tasks, or using privileged pages. Scopes, by contrast, are generally used to restrict which objects or data a user can see or act upon. For example, a scoped administrator may only be able to view or administer identities, applications, or work items within an assigned organizational boundary. That is object/data visibility control, not feature enablement. Saying that scopes control “the features that are used” confuses two different authorization layers. The correct IdentityIQ distinction is: capabilities control functional permissions, while scopes constrain object access boundaries. References/topics: IdentityIQ Engineer — authentication, authorization, capabilities, scopes, delegated administration.

Yes, specifying which access items may be requested can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In IdentityIQ, control variables within LCM workflows allow administrators to define the scope and criteria for access requests, including restricting or specifying which entitlements, roles, or applications can be requested by users. This is part of the request configuration process, where the access items that users can see and request are defined.

Therefore, the correct answer is A. Yes.

The statement that " An Application object is not required to aggregate external user account information into IdentityIQ " is false. In SailPoint IdentityIQ, an Application object is essential for aggregating (importing) external user account information. The Application object defines the connection settings, schema, and mapping that enable IdentityIQ to connect to external systems and retrieve identity data. Without an Application object, IdentityIQ would not have the necessary configuration to establish a connection and aggregate user data from external sources.

SailPoint IdentityIQ Administration Guide (Section on Applications and Aggregation)

SailPoint IdentityIQ Integration and Configuration Guide

Yes. Hierarchy is a valid relationship concept for IdentityIQ roles when a role model has a multiple-level structure. IdentityIQ roles are not limited to flat entitlement collections. Role models can be built with layered relationships, where higher-level roles represent broader business access and lower-level roles represent more technical or application-specific access. This is common in mature role-based access control designs: a business role may include IT roles, which in turn may include entitlements or application roles. A hierarchical structure allows organizations to express access in business terms while still mapping that access down to technical resources. The important engineering point is that the role model must be carefully designed to avoid circular dependencies, overbroad inheritance, and difficult certification outcomes. Hierarchical role relationships support maintainable access modeling when used properly, especially in enterprises that are actively using role-based provisioning and role reviews. References/topics: IdentityIQ Engineer — role hierarchy, role relationships, Bundle object, business roles, IT roles, role-based access model.

Yes, the code provided in the second image is correct for including a rule library named " Common Rules Library " in a Rule. The correct syntax is to use class= " sailpoint.object.RuleLibrary " and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the " Common Rules Library. "

Correct Syntax (from the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

Yes, the sets of columns displayed in most tables in the IdentityIQ user interface are controlled by entries in the ColumnConfig elements of the UIConfig object. The UIConfig object in IdentityIQ is responsible for defining various aspects of the user interface, including the configuration of columns that are displayed in tables throughout the application. By modifying the ColumnConfig elements within this object, administrators can customize which columns appear in specific tables, including their order, visibility, and labels.

Therefore, the correct answer is A. Yes.

The statement is true. In the SailPoint IdentityIQ Reporting user interface, report templates are located on the " Reports " tab. These templates define the structure and parameters of reports but do not contain actual report data. Instances of reports, which are the actual generated reports containing data based on the templates, are located on the " My Reports " tab. The " My Reports " tab is used for viewing and managing reports that have been generated for a specific user.

SailPoint IdentityIQ Reporting Guide

SailPoint IdentityIQ Administration Guide (Section on Reporting Interface)

In SailPoint IdentityIQ, the concept of a " role " is fundamental to the identity governance framework. The platform supports several default role types that are pre-configured to help organizations manage access effectively. The default role types include:

Business Role: Represents a collection of entitlements necessary for a specific job function within the organization.

IT Role: Aggregates technical entitlements that are typically assigned together, often linked to specific applications or systems.

Application Role: Tied to a specific application, representing roles within that application ' s context.

Composite Role: A combination of other roles, either business or IT, to form a higher-level role.

The term " Entitlement Role " is not recognized as a default role type in SailPoint IdentityIQ. While entitlements can be components of roles, " Entitlement Role " itself is not a predefined role type in the platform. Therefore, the correct answer is B. No.

The statement that the application server must be restarted after reloading the logging file through the Debug-Logging page is incorrect. SailPoint IdentityIQ allows you to reload the logging configuration from the Debug-Logging page without restarting the application server. The Debug-Logging page provides a way to dynamically reload the logging settings, including those in the log4j file, so that changes can take effect immediately without the need for a server restart.

Therefore, the correct answer is B. No.

The statement that a user ' s access to the Identity Warehouse is controlled by the QuickLink Populations they are a member of is incorrect. QuickLink Populations in IdentityIQ are used primarily for grouping identities for specific operations, such as access reviews, certifications, or specific application provisioning, rather than directly controlling access to the Identity Warehouse.

Access to the Identity Warehouse is governed by role-based access controls (RBAC), scopes, and the user ' s entitlements within IdentityIQ. These determine what data and functionality a user can access, including the information in the Identity Warehouse.

Thus, the correct answer is B. No.

The statement that " All certifications include generation, the active period, sign-off, and the end period " is true. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization ' s policies.

SailPoint IdentityIQ Certification Administrator ' s Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)

No, the Provisioning tab under the " Administrator Console " is not used to map the associated WorkflowCase to a particular Provisioning Transaction. The Provisioning tab is primarily for monitoring and managing provisioning operations, not for mapping workflow cases to transactions. Such mappings are typically handled within the workflow configuration itself, not through the Provisioning tab.

SailPoint IdentityIQ Workflow Guide (Handling Workflow and Provisioning Transactions)

SailPoint IdentityIQ Administration Guide (Provisioning Tab Limitations)

Syslog cannot be used to launch a certification using the search results. Launching a certification in IdentityIQ is a process that involves interacting with the application’s certification module, where you define parameters, select users or roles, and initiate the certification campaign. This process requires using the IdentityIQ user interface or APIs, not the Syslog, which is purely for logging purposes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ API and UI Guide

This is not a valid development step. A Quicklink is configured as an IdentityIQ object that exposes an action to users through the UI and can be configured to launch a workflow. The workflow does not contain or “host” the Quicklink object. The relationship is the other way around: the Quicklink references the workflow it should launch. To restrict the Quicklink to managers only, the engineer should configure visibility, population, capability, or dynamic eligibility logic so only manager identities can see or execute it. Then the Quicklink configuration should identify the workflow to invoke and pass any required arguments into that workflow. Placing a Quicklink object “on” the workflow is not how IdentityIQ Quicklink architecture works. The proposed solution confuses the launching object with the launched process. References/topics: IdentityIQ Engineer — Quicklink object, workflow launch configuration, manager-only visibility, population rules, workflow arguments.

This is not a joiner lifecycle event. The person already existed in the organization and previously had accounts. The scenario says their access was disabled and now needs to be reinstated, which is a rehire or reactivation process. In IdentityIQ, that is fundamentally different from onboarding a brand-new employee. A joiner process generally provisions new access and new accounts for a person who is newly hired or newly introduced to the identity-governance system. A rehire or reinstatement process should evaluate prior access, reactivate appropriate accounts, restore or recalculate roles, and avoid re-enabling access that is no longer valid. The phrase “previous accounts enabled” is the key clue: existing accounts are being reactivated, not newly created. Therefore, this proposed scenario should not be classified as a joiner lifecycle event. References/topics: IdentityIQ Engineer — joiner/mover/leaver model, rehire processing, account reactivation, LCM workflow routing, disabled account enablement.