SailPoint IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Exam Practice Test

This is a valid step. To create a custom audit event in IdentityIQ, the event/action must be registered so the audit framework recognizes it. Adding an AuditAction entry in the AuditConfig object XML is the correct type of configuration because it defines the audit action name, display name, and enabled state. The name value is the internal audit action identifier that code, rules, workflows, or tasks can use when writing audit records. The displayName provides the readable label, and enabled= " true " allows the event to be captured. This step alone is not the entire solution because the engineer must also write logic to create the audit record and configure a report to query and display it. However, the question asks whether this is one of the required steps, and it is. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction XML, custom audit actions, audit event enablement, audit report setup.

In SailPoint IdentityIQ, the concept of a " role " is fundamental to the identity governance framework. The platform supports several default role types that are pre-configured to help organizations manage access effectively. The default role types include:

Business Role: Represents a collection of entitlements necessary for a specific job function within the organization.

IT Role: Aggregates technical entitlements that are typically assigned together, often linked to specific applications or systems.

Application Role: Tied to a specific application, representing roles within that application ' s context.

Composite Role: A combination of other roles, either business or IT, to form a higher-level role.

The term " Entitlement Role " is not recognized as a default role type in SailPoint IdentityIQ. While entitlements can be components of roles, " Entitlement Role " itself is not a predefined role type in the platform. Therefore, the correct answer is B. No.

Owner is a required and important application configuration element in IdentityIQ. Application ownership establishes accountability for the connected system and is used across governance operations such as access reviews, application owner certifications, approval routing, policy handling, and administrative responsibility. IdentityIQ’s governance model depends heavily on ownership metadata because applications are not merely technical connector records; they are governed objects. Assigning an owner allows IdentityIQ to determine who is responsible for application access, certification decisions, and operational oversight. While some low-level object imports may technically create incomplete objects, from the application setup perspective an engineer should treat Owner as required. Without an owner, downstream governance functions become weak or ambiguous because IdentityIQ cannot reliably route application-specific reviews or approvals to the responsible business or technical authority. The proposed option is therefore valid as a required setup item. References/topics: IdentityIQ Engineer — application definition, application owner, governance accountability, certification ownership, access approval routing.

Yes, " Business Role " is a default role type available in SailPoint IdentityIQ that a manager can request during the access request process. Business Roles typically represent a collection of entitlements or access rights that align with specific job functions or responsibilities within an organization. Managers can use this role type to extend or modify the access granted to an employee.

SailPoint IdentityIQ Role Management Guide

SailPoint IdentityIQ Administration Guide (Sections on Role Types and Access Request)

When upgrading SailPoint IdentityIQ between releases, it is not necessary to install every version in sequential order between the current version and the target version. SailPoint provides upgrade paths that often allow skipping several major versions by directly upgrading to the desired target version from a supported previous version. However, it is crucial to follow the specific upgrade paths and procedures documented by SailPoint, which may involve intermediate steps or specific considerations depending on the versions involved.

Therefore, the correct answer is B. No.

A Role Composition Certification is specifically designed to ensure that roles are composed correctly by reviewing the entitlements and other roles they aggregate. This certification allows reviewers to verify whether the roles include the appropriate entitlements based on business needs and compliance requirements.

Given that the bank ' s objective is to ensure that all roles include the correct entitlements, a Role Composition Certification is the most appropriate tool to achieve this goal. It allows for the comprehensive review and validation of roles and their associated entitlements, ensuring alignment with the overall access governance strategy.

Therefore, the correct answer is A. Yes.

Yes. When a new IdentityIQ object is created and persisted correctly through the application layer, IdentityIQ can generate the internal object ID upon save. The object ID is the persistent identifier used by the platform and database, while the object name is a separate logical or display identifier. This distinction is important when engineers create or import objects through Debug. A new object should not reuse the ID of an existing object, because that would update or conflict with the existing object rather than create a clean new record. Automatic ID generation is one reason object XML is often edited before import or creation: copied XML must have old IDs removed so IdentityIQ can assign a fresh identifier. The statement is therefore valid, but engineers must still ensure required fields, class type, name uniqueness, and object references are correct before saving. References/topics: IdentityIQ Engineer — Debug-Object page, object persistence, automatic ID generation, object name versus ID, XML import safety.

The primary and secondary colors in the IdentityIQ user interface are not set through the IdentityIQ Configuration > Miscellaneous page. Instead, these colors are typically configured through the style.css or other custom CSS files that are part of the IdentityIQ UI customization process. Administrators can define and modify the color scheme, fonts, and other style elements by editing the relevant CSS files or using the Branding feature within IdentityIQ.

Therefore, the correct answer is B. No.

Yes. The Run Rule capability in the IdentityIQ debug/admin tooling is useful for executing BeanShell rule logic and viewing the result, especially during development or troubleshooting. When an engineer writes a simple rule that returns a value, the Run Rule feature can be used to validate the logic and observe the returned output. This is useful for quick testing of rules that evaluate identity attributes, build strings, test object lookups, or verify small pieces of BeanShell logic before embedding the rule into a workflow, lifecycle event, policy, certification configuration, or application configuration. However, this feature must be used carefully because rule execution can interact with real IdentityIQ objects depending on the code. The benefit described in the proposed solution is narrow and valid: displaying the return value of simple code is a legitimate use case. It is not the same as saying the feature should be used for unrestricted database manipulation. References/topics: IdentityIQ Engineer — Debug pages, Run Rule, BeanShell rules, rule testing, troubleshooting.

Yes. Rapid Setup explicitly supports configuration of Manager Correlation by mapping an application/account attribute containing manager information to an IdentityIQ identity attribute that uniquely identifies the corresponding manager. Within Rapid Setup, account correlation and manager correlation are handled as separate correlation configurations. For manager correlation, the engineer selects the application attribute containing the manager reference, selects the comparison operator—typically Equals—and then selects the IdentityIQ identity attribute used to resolve that manager.

This is an attribute-based correlation method and is appropriate when the manager identifier supplied by the connected system can be matched directly to an attribute stored on Identity Cubes. For example, an account ' s managerEmail could be mapped to the IdentityIQ email identity attribute. More complicated transformations or normalization requirements may require a Manager Correlation Rule, but a direct attribute mapping is supported directly through Rapid Setup.

Therefore, the proposed action is valid.

References/topics: IdentityIQ Engineer — Rapid Setup, Manager Correlation, application attributes, identity attributes, aggregation and correlation.

=======

The scenario described involves disabling an account and removing all its entitlements on a particular application during Mover events. The Rapid Setup user interface in SailPoint IdentityIQ primarily handles common configurations like enabling or disabling accounts, assigning or unassigning roles, and triggering certifications during lifecycle events.

However, the combination of disabling an account and removing all its entitlements for a Mover event typically involves more detailed configuration that goes beyond the capabilities of the Rapid Setup interface. Achieving this would generally require creating a custom workflow or a specific rule that handles both disabling the account and removing entitlements based on the Mover event triggers.

Thus, the Rapid Setup UI cannot achieve this level of detailed configuration, making the correct answer B. No.

In SailPoint IdentityIQ, every Link object, which represents an account on an application for an identity, must be associated with an Identity object. The Link object is inherently tied to an identity, as it is a representation of that identity’s account on a target system. Without this association, the Link would not have context within IdentityIQ. This is a fundamental aspect of IdentityIQ ' s data model. Refer to the SailPoint IdentityIQ Data Model documentation for detailed information on the relationships between Link objects and Identity objects.

Running the command iiq extendedSchema in the IIQ_Home/WEB-INF/bin directory is correct and one of the standard procedures for generating database scripts to extend Application attributes in the IdentityIQ database. This command processes the schema definitions (including any new attributes) and generates the appropriate SQL scripts to update the database schema. These scripts can then be executed against the database to apply the changes.

SailPoint IdentityIQ Administration Guide (Schema Extension and Database Management Sections)

SailPoint IdentityIQ Configuration Guide (Extended Schema Management)

Yes, the Provisioning tab under the " Administrator Console " in IdentityIQ can be used to view the specific operations on each attribute being provisioned. This tab provides detailed visibility into the provisioning operations, including which attributes are being modified, created, or removed as part of the provisioning process. This is essential for administrators to monitor and troubleshoot provisioning tasks.

SailPoint IdentityIQ Administration Guide (Provisioning Tab Overview)

SailPoint IdentityIQ Provisioning Guide

Yes. Every configured IdentityIQ application requires a Name because the Application object must have a unique logical identifier within IdentityIQ. The Name is not an Active Directory-specific connector parameter such as a domain controller, service account, or forest; it is a fundamental property of the IdentityIQ Application object itself.

IdentityIQ uses the application name throughout the platform when referencing the configured source or target. Application definitions, aggregation tasks, provisioning plans, rules, certifications, policies, reports, ManagedAttributes, Link objects, and workflow logic can all rely on the application identity. Without a usable application name, IdentityIQ could not reliably distinguish one configured Application object from another.

SailPoint ' s application configuration procedure therefore begins with the Details page and requires the engineer to enter the application Name before configuring connector-specific settings. The application type then determines the additional Active Directory configuration fields that become available.

Thus, regardless of the fact that this application uses the Active Directory connector, Name remains a required configuration option.

References/topics: IdentityIQ Engineer — Application object, Application Definition, Name, connector configuration, Active Directory application onboarding.

=======

No. The challenge period is not designed to let the reviewer ' s manager challenge the reviewer ' s certification decisions. Its purpose is to give the affected user whose access is being removed an opportunity to respond to the revocation.

When a certification enters the optional challenge phase, IdentityIQ generates a work item and notification for users affected by revocation decisions. The affected identity can accept the loss of the role, entitlement, or account-group access, or challenge the revocation. Any challenged items must subsequently be handled as part of the certification lifecycle.

A reviewer ' s manager can be relevant to certification processing, but through different mechanisms. For example, escalation can transfer an unfinished access review to another identity, commonly the certifier ' s manager, and multi-level sign-off can introduce another approver after the original certifier. Those mechanisms must not be confused with the challenge phase.

Therefore, the proposition assigns challenge rights to the wrong actor. The person whose access is subject to revocation—not the original reviewer ' s manager—is the participant for whom the challenge period exists.

References/topics: IdentityIQ Engineer — certification challenge phase, revocation decisions, affected identity, escalation, multi-level sign-off.

=======

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

Allow is a valid action when acting on a policy violation, assuming the policy violation owner has the required permissions. In IdentityIQ compliance workflows, not every violation is immediately remediated. Some violations are business-approved exceptions, temporary exceptions, or accepted risks. The Allow action is used to acknowledge that the violation may remain in place, often with justification, comments, expiration, or compensating-control context depending on configuration. This is different from remediation, where access is changed or removed, and different from mitigation, where a mitigating control is attached. In the Account Policy context, the violation may indicate that a user exceeds a permitted account condition. If the business determines the condition is acceptable, the owner may allow it rather than immediately remove or alter an account. This is a legitimate compliance decision, provided the user has permission to take that action. References/topics: IdentityIQ Engineer — policy violation lifecycle, Account Policy, allow/exception handling, mitigation, remediation, Compliance Manager.

The statement that the Debug-Logging page does not have to be reloaded when the log4j file is altered while the application server is running is incorrect. In SailPoint IdentityIQ, if you modify the log4j configuration file while the application is running, you generally need to reload the Debug-Logging page to reflect those changes. Without reloading, the page will not display the updated logging configurations, and the changes will not take effect until the application server or the logging system within the server acknowledges those changes.

Therefore, the correct answer is B. No.

The statement is false. In SailPoint IdentityIQ, the language displayed in the user interface is not always based on the default language selected in the global settings. The language displayed in the user interface is typically determined by the user ' s language preference, which can be set individually for each user. If a user ' s preferred language is not available, then the system may fall back to the default language specified in the global settings. Thus, while the global default language serves as a fallback, the actual language displayed is often based on user-specific settings.

SailPoint IdentityIQ Administration Guide (Localization and Language Settings Sections)

SailPoint IdentityIQ User Guide (User Preferences and Language Selection)

Yes. Reusing appropriate standard Lifecycle Manager subprocesses is a sound IdentityIQ workflow-design practice because those subprocesses encapsulate established processing for common lifecycle and provisioning operations. Building every custom provisioning workflow entirely from scratch duplicates tested logic and makes future maintenance substantially harder.

SailPoint describes subprocess workflows as a way to divide complex workflows into smaller components that are easier to manage and can be reused by multiple master workflows. Standard LCM workflows make extensive use of this pattern for initialization, approval processing, provisioning, policy checking, identity-request handling, notifications, and related activities. A custom workflow can call an existing subprocess and provide the input/control variables required by that subprocess.

However, “as much as possible” does not mean blindly invoking every standard LCM subprocess. The engineer must understand the subprocess contract, including expected inputs, returned values, workflow variables, provisioning-plan assumptions, and release-specific behavior. Custom logic should only replace or extend standard processing when business requirements genuinely require it.

Therefore, leveraging standard LCM subprocesses where their behavior fits the requirement is a valid best-practice approach.

References/topics: IdentityIQ Engineer — LCM workflows, subprocess reuse, reusable business processes, workflow variables, provisioning customization.

=======

No. ManagedAttribute objects represent managed entitlement or account-group values from applications. They are not generally viewed on the Policy tab of the View Identity QuickLink. The Policy tab is used for policy-related information such as policy violations or compliance policy context, not for listing all entitlements associated with the identity. A user’s entitlements and accounts are normally viewed through identity access/account-related tabs or identity cube access views, depending on UI configuration. This proposed statement confuses ManagedAttribute entitlement data with policy-violation data. A ManagedAttribute may be involved in a policy violation, certification item, access request, or entitlement display, but that does not mean all ManagedAttribute objects associated with an Identity are visible from the Policy tab. The correct engineering distinction is: ManagedAttribute equals governed entitlement metadata; Policy tab equals policy/compliance information. References/topics: IdentityIQ Engineer — ManagedAttribute, Identity Cube, View Identity QuickLink, entitlement display, policy violations.

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.

The statement is incorrect. When writing and executing source mapping rules to populate identity attributes, the rule itself does not need to persist the identity attribute to the database. In SailPoint IdentityIQ, once the value for an identity attribute has been calculated by a source mapping rule, IdentityIQ automatically handles the persistence of this attribute to the database as part of the aggregation or provisioning process. The developer does not need to explicitly persist the attribute; this is managed by the system.

SailPoint IdentityIQ Source Mapping Guide

SailPoint IdentityIQ Administration Guide (Aggregation and Attribute Mapping Sections)

An Application Owner Certification is primarily used to certify entitlements and roles associated with specific applications. It involves application owners reviewing access within their applications, which is useful for ensuring that access aligns with the intended security policies for that application.

However, in the context of ensuring that roles include the correct entitlements across the entire role model, a more suitable certification type would be a Role Composition Certification. This type specifically focuses on validating the composition of roles, including the entitlements they aggregate.

Therefore, an Application Owner Certification will not fully achieve the goal of ensuring all roles include the correct entitlements. The correct answer is B. No.

Yes, the statement is true. In SailPoint IdentityIQ, the built-in auditing options are indeed immutable, meaning they are always recorded and cannot be disabled or altered. This ensures that critical actions and changes are always logged for compliance and security purposes. However, custom audit configurations, such as additional custom audit fields or logs, can be turned on or off based on specific organizational requirements.

SailPoint IdentityIQ Audit Guide

SailPoint IdentityIQ Administration Guide (Sections on Auditing and Compliance)

Yes, setting the " Source Mappings: Application Rule " configuration on the account attribute is necessary to meet the requirements described. The use case involves flagging privileged accounts based on attributes read from different applications and using these flags in various IdentityIQ features like Advanced Analytics, rule writing, and policy enforcement. By configuring the attribute with a source mapping that uses an Application Rule, you can implement complex logic to derive the attribute ' s value from multiple sources, such as a financial application and a keystore application, according to the specific requirements.

Therefore, the correct answer is A. Yes.

The statement that " All certifications include generation, the active period, sign-off, and the end period " is true. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization ' s policies.

SailPoint IdentityIQ Certification Administrator ' s Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)

The statement that " the staging period is required " for certifications is not true. In SailPoint IdentityIQ, the staging period is an optional phase during the certification campaign configuration. The staging period is used to pre-generate certifications and allow for any preparatory actions or adjustments before the certifications are officially launched and sent to reviewers. However, it is not a mandatory component for all certification campaigns.

Administrators may choose to bypass the staging period entirely depending on the specific requirements of the certification process or the urgency of the certification campaign. Therefore, while the staging period can be beneficial for managing large or complex certifications, it is not a required step.

SailPoint IdentityIQ Certification Overview Guide

SailPoint IdentityIQ Administration Guide (Sections on Certification Configuration and Staging Period)

A Role Membership Certification is appropriate for this requirement because the hospital is trying to confirm that users assigned to a role are correct. The test is not about whether the role contains the right entitlements; that would point to Role Composition Certification. It is also not primarily about application ownership or account group membership. The wording says the business analysts want to verify the role assignment rules by certifying the users who have been assigned the role. That maps directly to a membership review: who is in the role, whether each membership is valid, and whether the assignment rule is producing the expected population. The security team can be configured as the certifier, final reviewer, or sign-off participant depending on certification ownership and sign-off configuration. Therefore, the proposed certification type achieves the stated goal. References/topics: IdentityIQ Engineer — Role Membership Certification, role assignment rules, certification ownership, sign-off, access review routing.

This statement is incorrect. IdentityIQ supports extended identity attributes, but searchable extended attributes are not unlimited. Searchable identity attributes require database-backed indexed placeholder properties defined in the extended Hibernate mapping and exposed through Identity Attribute configuration. The Word bank already states the correct limitation: when defining identity mappings under Global Settings > Identity Attributes, only 12 additional searchable attributes can be defined; additional identity attributes and mappings may exist, but they cannot all be searchable. The proposed solution says an unlimited number of additional searchable placeholder extended attributes can be added beyond the 10 shown, which contradicts the searchable-attribute limitation. Engineers must plan identity schema extensions carefully because searchable attributes affect database schema, indexing, performance, and UI search behavior. Adding unlimited searchable placeholders would create maintainability and performance problems and is not supported as a general installation design. References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended identity attributes, searchable attributes, identity mappings, schema planning.

This is not a clean joiner lifecycle event. A joiner event normally represents a person newly entering the organization or being newly onboarded into managed access, usually requiring new identity setup, new accounts, baseline access, roles, approvals, and provisioning. The proposed scenario describes a contractor whose previous relationship ended, whose accounts were disabled, and who now has a new contract requiring previous accounts to be enabled. That is closer to a rehire/reactivation or account-enable lifecycle event than a first-time joiner. The distinction matters in IdentityIQ because a true joiner process may create accounts and assign initial access, while a rehire/reactivation process may restore, enable, or reassess previously existing accounts and access. Treating this as a joiner could create duplicate accounts or duplicate access instead of properly reactivating existing Links/accounts. References/topics: IdentityIQ Engineer — Lifecycle Manager, joiner event, rehire/reactivation, account enablement, identity lifecycle workflow design.

The solution provided is incomplete. To create a custom audit event and set up an associated report, the process involves several steps, including defining the custom audit event in the Audit Configuration object, updating or creating relevant audit triggers in the system, and defining the custom report using XML or the IdentityIQ report editor. The steps mentioned in the solution do not cover the necessary configuration and implementation details required for this task. For a complete process, consult the SailPoint IdentityIQ Reporting Guide and the Audit Framework documentation.

Setting the configuration option " Edit Mode: Read Only " on the account attribute would not meet the requirements as specified. The requirement to " Calculate from: Keystore application, responsibility-code attribute " implies that the attribute needs to be dynamically calculated or updated based on another attribute. If the attribute is set to " Read Only, " it cannot be modified, which would prevent it from being calculated or updated as needed. Therefore, " Edit Mode: Read Only " should not be used in this scenario.

SailPoint IdentityIQ Administration Guide (Sections on Account Attributes and Attribute Calculation)

SailPoint IdentityIQ Configuration Guide (Field Properties and Edit Modes)

Yes, an Escalation Rule can be used to handle the scenario of automatically reassigning parts of an access review to a different certifier. In SailPoint IdentityIQ, Escalation Rules are often employed within certification campaigns to manage situations where a primary certifier has not completed their review within a specified timeframe. The rule can trigger actions such as reassigning the review items to a different certifier, thus ensuring that the certification process continues smoothly without delays.

Therefore, the correct answer is A. Yes.

Not all Application objects in SailPoint IdentityIQ must have an Identity object as the owner. While it is common practice to assign an owner to an Application object for governance and administration purposes, it is not a strict requirement. Applications can exist without a direct association to an Identity object. The ownership concept in IdentityIQ is more of a best practice for accountability rather than a mandatory attribute. Refer to the SailPoint IdentityIQ Application Definition Guide for more information on the configuration and management of Application objects.

Yes. IdentityIQ ' s authorization model uses granular SPRights and higher-level Capabilities to control access to product functions. SPRights govern access to menus, tools, tabs, pages, and individual operations. Capabilities group one or more of those rights into logical sets that can be assigned according to job responsibilities.

A capability can be assigned directly to an Identity through the identity ' s User Rights configuration. Capabilities may also be inherited indirectly through workgroup membership. Therefore, the capabilities available to a logged-in identity are one of the mechanisms IdentityIQ uses to determine which product features that user can see and what administrative or operational actions the user can perform.

Capabilities should not be confused with Scopes . Scopes constrain the objects or portions of the environment to which a user has visibility or control, whereas capabilities determine the functions/features the user is authorized to use. The two mechanisms can operate together.

SailPoint documentation explicitly states that identities can have capabilities assigned directly and that capabilities determine which IdentityIQ features users can access.

References/topics: IdentityIQ Engineer — SPRights, Capabilities, User Rights, authorization, workgroup-inherited rights, scopes.

=======

Yes. This implementation follows the essential IdentityIQ transaction-locking pattern for modifying a persistent SailPoint object. ObjectUtil.transactionLock() retrieves the named Policy object while obtaining a transaction-level database lock. A transaction lock is appropriate when processing needs exclusive access to an object for the duration of a short transaction and must prevent another transaction from updating the same object simultaneously.

After obtaining the locked Policy object, the engineer performs the required changes and then calls context.saveObject(object). saveObject() persists changes to an object derived from SailPointObject; however, persistence is not complete until the transaction is committed. The subsequent context.commitTransaction() therefore completes the modification and releases the transaction-level database lock as the transaction finishes.

SailPoint ' s documented transaction-lock example follows essentially the same sequence: obtain the object using ObjectUtil.transactionLock, modify it, invoke context.saveObject, and commit. Calling context.decache(object) afterward may be useful to remove the object from the context cache, particularly in longer-running processing, but its omission does not invalidate this basic implementation.

References/topics: IdentityIQ Engineer — ObjectUtil, transaction locking, Policy objects, SailPointContext persistence, object save/commit lifecycle.

=======

This implementation is not correct. The requirement is to return all account names for an identity on the application MagicBox, but the code retrieves only a single Link by calling service.getLink(identity, " MagicBox " ). Even worse, the while (link != null) loop never changes the link variable, so if a link is found, the loop becomes infinite and repeatedly adds the same native identity. A correct implementation must retrieve the application object, obtain all matching Link objects for the identity and application, iterate over that list, and add each link’s native identity once. There is also no visible import for ArrayList or List, although BeanShell environments may sometimes tolerate imports differently. The fatal issue remains the flawed loop and single-link retrieval. IdentityIQ account data is represented by Link objects, and multiple accounts may exist for the same identity on the same application depending on connector and policy design. References/topics: IdentityIQ Engineer — IdentityService, Link objects, native identity, BeanShell API usage, account lookup logic.

No. Rapid Setup provides a simplified attribute-based manager correlation mechanism, but it does not provide the Rapid Setup user with a custom Manager Correlation Rule configuration option.

For manager correlation in Rapid Setup, the engineer selects an application attribute containing the manager reference, chooses the comparison operator, and maps that value to an IdentityIQ identity attribute. For example, an application ' s managerEmail attribute could be mapped to the IdentityIQ email attribute. Rapid Setup permits one manager-correlation method for each application.

IdentityIQ itself does support a Manager Correlation Rule , but that is a different configuration path. SailPoint documents Manager Correlation Rule as an application rule used when a simple manager-attribute mapping is insufficient. Such rule-based logic is configured through the application ' s normal Rules configuration rather than through Rapid Setup.

This distinction is important because the existing bank already asks whether account correlation using a rule can be performed through Rapid Setup and correctly answers No. The video proposition specifically changes the subject to manager correlation , making it a separate DOMC question.

References/topics: IdentityIQ Engineer — Rapid Setup, Manager Correlation, attribute-based correlation, Manager Correlation Rule, application Rules tab.

=======

No. To permit users to unlock accounts through the Manage Accounts interface, the relevant Lifecycle Manager configuration is the Unlock Manage Account Action. Selecting a Rehire action does not configure the account-unlock operation described in the requirement.

IdentityIQ ' s Lifecycle Manager Configuration includes explicit Manage Account Actions for Delete, Disable, Enable, and Unlock . Administrators choose which of these operations users can request for themselves and, where authorization permits, for subordinates. If Unlock is deselected, that type of Manage Accounts request is unavailable.

Rehire is a lifecycle concept associated with restoring access for an identity returning to the organization; it is not the configuration switch that enables an account-unlock request. Unlock specifically addresses a target account that is locked while otherwise remaining an existing account.

This question is easy to mistake for the existing Word-bank question because the proposition is identical. However, the existing item asks about enabling an account, not unlocking one. Under the required DOMC comparison, that change in the stem makes this a distinct question.

Therefore, the proposed Rehire configuration does not meet the unlock requirement.

References/topics: IdentityIQ Engineer — Lifecycle Manager Configuration, Manage Accounts, Unlock Account, Enable Account, account actions, subordinate account management.

Yes. IdentityIQ provides several core identity properties that are directly available as standard search criteria without requiring them to be implemented as customer-defined extended searchable attributes. These include First Name, Last Name, Display Name, Email, and Manager . Identity Search exposes these properties separately from the configurable section called Searchable Attributes , which contains additional identity attributes created and designated as searchable during deployment.

This distinction is important when interpreting IdentityExtended.hbm.xml. The extended Hibernate mapping is primarily concerned with additional database-backed attributes that a customer wants to search efficiently. It does not mean that every searchable identity property must consume one of the numbered extended1, extended2, and similar columns.

Current IdentityIQ documentation lists Last Name, First Name, Display Name, Email, and Manager directly among Identity Search criteria, with separately configured searchable attributes presented in their own category. Therefore, the proposed solution correctly identifies standard searchable identity information supplied by IdentityIQ.

References/topics: IdentityIQ Engineer — Identity Search, Identity Mapping, standard identity attributes, searchable extended attributes, IdentityExtended.hbm.xml.

=======

Yes. The IdentityIQ version is essential information when setting up a new sandbox environment. Version affects installation steps, supported Java versions, supported application servers, database compatibility, connector behavior, patch requirements, schema scripts, upgrade paths, and available product features. A sandbox is usually intended to mirror or safely test changes for another environment, so the engineer must know which IdentityIQ version the sandbox should run. Without the version, the engineer could deploy the wrong WAR file, apply incompatible patches, use the wrong schema scripts, or test behavior that does not match production. Version also matters for customizations such as rules, workflows, Quicklinks, UI branding, extended attributes, and connector configuration because APIs and supported patterns can differ between releases. Therefore, IdentityIQ version is not optional background information; it is a core environment-planning input. References/topics: IdentityIQ Engineer — sandbox setup, installation planning, version compatibility, patching, environment parity.

The correct order for performing an initial installation of SailPoint IdentityIQ is:

Ensure all of the application servers are stopped.

Stopping all application servers is crucial to prevent any conflicts or transactional interference during the installation process.

Un-jar the IdentityIQ WAR file in the desired directory of each application server.

Extract the IdentityIQ WAR file in the appropriate location for the application server. This step deploys the IdentityIQ application code.

Configure iiq.properties file with database credentials and datasource.

The iiq.properties file must be updated with correct database credentials and datasource configurations to establish a connection to the IdentityIQ database.

Create the IdentityIQ database.

A new IdentityIQ database must be created for the system. This is the foundation where all IdentityIQ data will be stored.

Generate database schema to include custom attributes by executing ' iiq schema ' .

Use the iiq schema command to generate the necessary database schema. This includes tables, constraints, and other structural components for IdentityIQ.

Initialize default IdentityIQ system objects from ' iiq console ' using the ' import ' command.

Import default system objects like roles, policies, and configuration settings using the IdentityIQ console’s import feature. This sets up the base configuration.

Start all of the application servers.

Once everything is configured, start the application servers to make the IdentityIQ application available.

Apply the latest patch.

Finally, apply any patches to ensure the system is up to date with the latest security and feature enhancements.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Stopping all application servers is necessary to avoid file locks and ensure the WAR deployment and database setup processes can proceed smoothly.

Un-jarring the WAR file deploys IdentityIQ into the server directory structure, making its code accessible for execution.

Configuring the iiq.properties file connects IdentityIQ to the database, establishing where it will read and write data.

Creating the database is fundamental, as the IdentityIQ system relies on a structured data environment.

Generating the database schema via iiq schema builds out the tables and structures necessary for storing identity, access, and policy data.

Initializing system objects sets up core elements of IdentityIQ (like roles, capabilities, and system configurations) required for its operation.

Starting the application servers activates the IdentityIQ environment, allowing the system to begin processing requests.

Applying the latest patch ensures that the installation is up-to-date with all bug fixes, enhancements, and security updates from SailPoint.

SailPoint IdentityIQ Installation Guide (steps on fresh installation and post-installation configurations).

HR Role is not a default IdentityIQ role type. IdentityIQ role modeling uses standard role types such as Business Role, IT Role, Application Role, and Composite Role; the Word bank lists those default types and separately notes that a nonstandard label such as Entitlement Role is not a recognized default role type. “HR Role” could exist in a customer environment as a custom role name, a business-role naming convention, or a role representing human resources access, but it is not a default role type in IdentityIQ. The question is not asking whether a role named “HR Role” can be created. It asks whether HR Role is a default type available for manager request during access request. That distinction matters. Managers request role objects configured as requestable, but the role type must be one of the supported model types. Therefore, the proposed solution is invalid. References/topics: IdentityIQ Engineer — role model, default role types, Business Role, IT Role, Application Role, Composite Role, access request configuration.

This proposed implementation is not valid as written. The logic is conceptually understandable, but the XML structure is not the correct IdentityIQ workflow transition pattern. In IdentityIQ workflows, transitions are normally declared using < Transition > elements with a destination, such as to= " StepName " , and optional conditional logic through a when expression or scripted evaluation. A raw < Source > block directly inside < Transition > returning destination names is not the standard structure for expressing multiple workflow routing paths after a form step. The engineer’s requirement is to route to Stop when the reject/back action is used, route to Audit when approval occurs and the comment variable is populated, and route to Provision as the fallback. That should be implemented as separate transition definitions with explicit destination steps and conditions. The proposed XML does not properly bind the returned values to valid transition destinations in the expected workflow syntax. References/topics: IdentityIQ Engineer — workflow XML, transition elements, form step routing, BeanShell expressions, Business Process Editor.

The purpose of an IdentityIQ certification is not to attest to a user ' s integrity. Certifications in IdentityIQ are designed to review and verify user access rights to ensure they are appropriate based on roles, policies, and organizational rules. The focus is on access management rather than personal qualities like integrity.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

No. The statement is too broad and is incorrect specifically in the context of IdentityIQ Syslog events . IdentityIQ differentiates between normal Log4j logging and SyslogEvent records. Log4j can write ordinary application logging to configured log files, but IdentityIQ ' s higher-severity Syslog events are persisted in the IdentityIQ database so that they can be searched through Advanced Analytics and inspected through IdentityIQ administrative/debug functionality.

SailPoint documents that WARN, ERROR, and FATAL events can be stored in the IdentityIQ database. Lower-level events can instead be handled by Log4j when configured and are not necessarily persisted to the Syslog database table. SailPoint operational guidance further identifies spt_syslog_event as the database table containing persisted Syslog events.

Therefore, saying that IdentityIQ logging events are stored in a flat file instead of a database incorrectly collapses two separate logging mechanisms. Some Log4j output can certainly be file-based, but IdentityIQ SyslogEvent storage includes database persistence.

References/topics: IdentityIQ Engineer — SyslogEvent, Advanced Analytics Syslog Search, spt_syslog_event, Log4j, troubleshooting and logging architecture.

=======

Yes. The Environment area under the Administrator Console is intended for administrative visibility into the running IdentityIQ environment, including product/environment details and installed components or extensions where exposed by the platform. Viewing the status or presence of installed SailPoint modules/extensions is consistent with environment inspection. This is very different from controlling the application server itself. The engineer can use IdentityIQ administrative pages to understand what is installed, enabled, or available in the current deployment, which helps during troubleshooting, patch verification, upgrade planning, and support analysis. In multi-node deployments, this kind of environment visibility is useful because module or extension inconsistencies can cause unpredictable behavior. However, viewing status does not imply the Environment tab can install, uninstall, start, or stop all components. The proposed action is read/inspection-oriented, so it fits the purpose of the tab. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, installed modules, extensions, environment validation, upgrade/troubleshooting checks.

This scenario describes an employee quitting their job and needing all of their accounts disabled, which aligns with a leaver lifecycle event rather than a mover event. A leaver event typically involves the deactivation of accounts and removal of access for users who are leaving the organization entirely, whereas a mover event involves changes to roles or access as part of an internal transition (e.g., promotion, transfer).

Therefore, the correct answer is B. No.

Yes. A self-service registration workflow needs a Registration Identity Provisioning Policy because the policy defines what identity data must be collected, displayed, validated, or constrained during registration. LCM Registration is not merely a generic workflow button; it needs a controlled data-entry model for creating or initiating an identity record through self-service. The Registration Identity Provisioning Policy provides that model by defining registration fields, required inputs, allowed values, validation behavior, and potentially default or derived values. Without it, the workflow lacks the structured policy definition needed to support registration-specific identity creation. This is separate from ordinary Create Identity or Edit Identity policies because self-service registration usually has different security and usability requirements. Public or semi-public registration should expose only carefully selected fields and should validate values tightly. Therefore, the proposed configuration is required for the self-service registration use case. References/topics: IdentityIQ Engineer — LCM Registration, self-service registration workflow, Identity Provisioning Policies, registration fields, validation logic.

The statement is false. While it is true that logging and auditing require extra function calls and generate data, the suggestion that this data can be compressed to avoid storage issues and improve performance is misleading. In practice, while compression might save storage space, it does not inherently improve performance, particularly because the overhead of compression and decompression could negate the performance benefits. Effective performance management in IdentityIQ involves more nuanced approaches, such as optimizing the level of detail in logs, managing log rotation, and tuning the system for efficient I/O operations.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Performance Tuning Guide

No. This is not a correct procedure. IMAP is a protocol used to retrieve/read mail from a mailbox; it is not the normal protocol IdentityIQ uses to send generated notification emails. IdentityIQ email notification delivery is based on SMTP configuration, including SMTP host, port, authentication, and security settings where required. For non-production testing, engineers generally avoid sending test notifications to real user mailboxes. A safer approach is to configure email redirection, a test SMTP server, or a controlled mailbox so workflow, certification, approval, and lifecycle emails can be validated without accidentally notifying real users. The proposed solution is flawed in two ways: it uses IMAP as though it were a sending mechanism, and it suggests verifying delivery to mailboxes specified on Identity objects, which is risky in a non-production test. References/topics: IdentityIQ Engineer — SMTP mail settings, email notification testing, non-production safety, mail redirection, workflow/certification notifications.

No. The key technical problem is the term Create Rule . IdentityIQ does not use an application “Create Rule” as the standard mechanism for defining how new target-system accounts are provisioned. New-account provisioning is principally defined through an application ' s Create Account Provisioning Policy . That policy identifies the fields required for account creation and determines how their values are obtained. Field values can themselves come from literals, scripts, rules, dependencies, or requester-entered information.

IdentityIQ does have a Creation Rule , but that is an aggregation rule with a different purpose. SailPoint documents the Creation Rule as executing when a new Identity is created during aggregation, commonly from an authoritative application. It can manipulate the identity being created—for example, its name or attributes—but it is not the mechanism that specifies how a new account is provisioned to a target application.

Provisioning rules such as BeforeProvisioning and AfterProvisioning can customize a ProvisioningPlan around connector execution, but that still does not make “Create Rule” the account-creation definition. Therefore, as worded, the proposed solution is false.

References/topics: IdentityIQ Engineer — Application Provisioning Policies, Create Account policy, Creation Rule, BeforeProvisioning Rule, Application Definition.

=======

No. IdentityIQ BeanShell rules do not all have the same input and output contract. Rule arguments and expected return values depend on the rule type and the execution context in which IdentityIQ invokes the rule.

For example, a correlation rule requires information relevant to account/identity correlation, while provisioning-related rules operate with provisioning plans, applications, accounts, or provisioning results. Workflow rules receive variables associated with the workflow context. Other rule types may return a Boolean, String, Identity, Map, object collection, transformed value, or no meaningful value at all.

IdentityIQ ' s Rule Registry and Rule Editor exist partly to expose this distinction. The Word bank itself states that the typical input variables for a rule are presented according to the Rule Registry, meaning they are determined by rule type rather than being universally identical. It also contains separate propositions concerning Rule Registry descriptions and Rule Editor Arguments.

Therefore, standardizing every BeanShell rule around identical arguments and returns would contradict IdentityIQ ' s rule architecture.

References/topics: IdentityIQ Engineer — BeanShell rules, Rule Registry, Arguments, Returns, rule type, runtime context.

=======

Inserting the " Managers " QuickLink population as the dynamic scope in the QuickLink object is a valid step when creating a custom QuickLink that should only be accessible by managers. QuickLink populations are used to define which users have access to specific QuickLinks based on criteria like role, department, or other attributes. By assigning the " Managers " population, only users who are members of that population will see and be able to launch the QuickLink.

Therefore, the correct answer is A. Yes.

Yes. The numbered placeholder model used by IdentityExtended.hbm.xml provides ten extended attributes by default—extended1 through extended10—and that numbered set can be expanded through extended20. This requires adding the appropriate property definitions to the extended Hibernate mapping and subsequently applying the corresponding database-schema extension process.

The distinction between numbered placeholder attributes and named attributes using ExtendedPropertyAccessor is important. Twenty is the traditional limit of the numbered SailPointObject extended-property slots; it is not an absolute claim that IdentityIQ can never support additional custom attributes. SailPoint provides ExtendedPropertyAccessor for named extended properties beyond the numbered placeholder model.

The configuration comments associated with IdentityExtended.hbm.xml explicitly state that ten extended attributes are mapped by default and that this can be raised to twenty. They also caution that excessive searchable/indexed attributes can degrade Identity Cube update performance.

Therefore, the proposition is correct specifically for adding further placeholder numbered extended attributes beyond the ten shown, through extended20 .

References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended1–extended20, searchable identity attributes, ExtendedPropertyAccessor, extended schema.

=======

This is not a valid step for creating a custom audit event and associated report. A Custom Certification Event Schedule relates to certification scheduling or certification-event processing, not to defining a new audit action in the audit framework. A ruleRunner task can execute a rule, but simply creating a certification event schedule and ruleRunner task does not establish a custom audit event type, does not register the event in AuditConfig, and does not create a report capable of querying that audit data. For a custom audit event, the engineer must define the audit action/event, ensure the code path writes the audit event with the appropriate attributes, and then create or configure a report that can retrieve and display those audit records. The proposed solution is pointed at the wrong subsystem. It confuses certification scheduling automation with audit event definition and reporting. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction, custom audit events, audit reporting, ruleRunner task limitations.

The statement " The rule type must be IdentityAttribute " is correct. In SailPoint IdentityIQ, when writing a rule that is intended to map or manipulate identity attributes during the aggregation process, the rule type should be set to " IdentityAttribute " . This ensures that the rule is recognized and executed in the appropriate context for managing identity attributes.

Therefore, the correct answer is A. Yes.

time → show how much time a command takes to run

source → execute a file of commands

run → launch a background task

import → import objects from a file

Yes, the statement is true. When editing a step in the Business Process Editor in SailPoint IdentityIQ, the available step actions are Script, Rule, Subprocess, and Call Method. These actions allow for various types of logic and processing to be embedded within workflows. Each of these actions serves different purposes:

Script: Executes a Beanshell script.

Rule: Calls an existing IdentityIQ rule.

Subprocess: Invokes another workflow as a subprocess.

Call Method: Invokes a method on a specified object.

SailPoint IdentityIQ Business Process Editor Guide

SailPoint IdentityIQ Administration Guide (Section on Workflow Management)

No. QuickLink population membership is not an exclusive one-population relationship. IdentityIQ can evaluate an identity against multiple QuickLink population definitions, and the same identity can satisfy the membership criteria for multiple populations.

QuickLink populations are used to govern which QuickLinks users can access and, for “For Others” use cases, which target identities they may act upon. Populations can be based on identity attributes, capabilities, workgroups, individual identities, or other configured membership logic. Because those criteria can overlap, there is no general requirement that an identity belong to only one population.

For example, the same employee could satisfy a Managers population, a particular geographic population, and another population associated with access-request functionality. IdentityIQ evaluates the applicable configuration rather than forcing those groups to be mutually exclusive.

The Word bank itself contains examples where QuickLink population configuration controls access to manager-only QuickLinks, reinforcing that populations represent authorization groupings rather than a single-valued classification.

Therefore, “at most one QuickLink population” is false.

References/topics: IdentityIQ Engineer — QuickLink populations, authentication and authorization, population membership, capabilities, workgroups, QuickLink visibility.

=======

The configuration option " Comment Character " is not required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Comment Character " option is generally used for handling comment lines in flat files or CSV file-based connectors. Since SCIM 2.0 is a RESTful API-based protocol designed for managing identities in a standardized way, this option does not apply to SCIM 2.0 integrations. Therefore, it is not a necessary configuration when working with SCIM 2.0 applications.

SailPoint IdentityIQ SCIM 2.0 Integration Guide

SailPoint IdentityIQ Application Configuration Guide (SCIM and REST API sections)

Yes. Identity Provisioning Policies provide the field definitions and associated behavior used for identity-management operations such as Create Identity and Edit Identity . They can control which identity attributes are presented, which are required, what defaults or calculations are performed, and what validation or allowed-values logic applies.

For identity creation, the Create Identity Provisioning Policy defines the information collected when an authorized user creates an identity through IdentityIQ. Update/Edit behavior can similarly be governed through the appropriate identity provisioning policy. This allows implementations to expose controlled identity-management functionality without relying on arbitrary direct editing of Identity objects.

This proposition is different from two related items already in the Word bank. The bank contains a proposition stating that a Create Identity policy is applied during authoritative-source aggregation, and another covering allowed-values/validation logic when using Create Identity. Neither is the same DOMC proposition as defining policies for create/edit operations through the IdentityIQ UI.

Therefore, this is a separate unique question and the answer is Yes.

References/topics: IdentityIQ Engineer — Identity Provisioning Policies, Create Identity, Edit Identity, form fields, validation, identity lifecycle management.

=======

Yes. This is a valid Identity search use case because the relationship between an employee and their manager is normally represented on Identity objects through attributes such as manager, manager ID, supervisor, or reporting relationship. If the identity cube contains the manager relationship, Identity search or Advanced Analytics can be used to filter identities whose manager equals a specific person and then count the returned identities. This is completely different from using Syslog for the same purpose. The Word bank rejects Syslog for this scenario because Syslog is a logging facility, not an organizational data query mechanism. But the video asks about the Identity search type, and Identity search is the correct object domain for employee reporting relationships. The engineer must ensure that the manager attribute is populated and searchable or otherwise available to the search interface. References/topics: IdentityIQ Engineer — Identity search, manager attribute, identity cube, reporting relationships, Advanced Analytics filters.

Yes, specifying which access items may be requested can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In IdentityIQ, control variables within LCM workflows allow administrators to define the scope and criteria for access requests, including restricting or specifying which entitlements, roles, or applications can be requested by users. This is part of the request configuration process, where the access items that users can see and request are defined.

Therefore, the correct answer is A. Yes.

Yes. The requirement concerns performing an operation against an existing account through the Manage Accounts functionality. The QuickLink population therefore needs to permit users in that population to manage existing accounts. Selecting “Allow managing existing accounts” establishes that population-level eligibility for operations involving accounts that already exist.

This configuration should be distinguished from the specific account operation itself. Lifecycle Manager ' s Manage Accounts configuration controls which account actions—such as enable, disable, unlock, or other supported operations—are available. The QuickLink-population setting determines whether the user is allowed to manage existing accounts through that interface. Both layers must align with the requested functionality.

This question is also genuinely different from the ODT ' s existing question. The bank asks about a user wanting to enable an account and proposes selecting the Rehire action. Here, the video specifically asks about unlocking an existing account and proposes a QuickLink-population setting.

Therefore, for the configuration proposed in this DOMC item, the answer is Yes.

References/topics: IdentityIQ Engineer — Lifecycle Manager, Manage Accounts QuickLink, QuickLink populations, existing-account management, account unlock, Manage Account Actions.

=======

No, this is not a valid action. When setting up or using the Services Standard Build (SSB) for a SailPoint IdentityIQ instance, the client ' s identityiq.war file should not be placed in the home directory of the build. The WAR file should be deployed to the appropriate application server ' s deployment directory, not in the home directory of the build itself. The SSB process typically involves more structured deployment processes that adhere to best practices for application deployment.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Deployment Best Practices

No. IdentityIQ report results are not simply stored as files on the application servers as a universal rule. IdentityIQ is a database-backed governance platform, and generated report metadata/results are associated with task/report result objects and persisted through the platform’s data model. While report exports or generated files may be downloaded or temporarily handled by the application server at runtime, the statement “all report results are stored on IdentityIQ application servers” is technically inaccurate. In clustered deployments, relying on local application-server storage for all report results would also be problematic because multiple application servers may serve the same IdentityIQ environment. IdentityIQ centralizes configuration, task history, report metadata, identities, applications, and governance objects through its database-backed object model. Therefore, the correct understanding is that reports are run by the IdentityIQ task/reporting framework and report result information is managed by IdentityIQ, not universally stored as local application-server files. References/topics: IdentityIQ Engineer — reporting architecture, task results, report instances, application server versus database persistence.

No. A ManagedAttribute in IdentityIQ represents a managed value of an application attribute, most commonly an entitlement or account-group value that IdentityIQ can govern, certify, request, or provision. It is not the object used to define the “type” of an account, such as service account or privileged account. Account information aggregated from an application is represented through Link objects associated with an Identity. The Application object defines the connected system, schema, connector configuration, and aggregation/provisioning behavior. A Bundle represents a role. ManagedAttribute objects are typically used when an application schema attribute is marked as managed, such as group membership, permission, role, or entitlement values. Account type classifications may be represented as attributes on a Link or through identity/account metadata, but calling that a ManagedAttribute definition is technically wrong. This question tests whether the engineer understands the IdentityIQ object model and does not confuse entitlements with account records. References/topics: IdentityIQ Engineer — Application object, Identity object, Link object, Bundle/role object, ManagedAttribute entitlement model.

No. Launching certification campaigns is not default Lifecycle Manager functionality. Lifecycle Manager focuses on identity lifecycle and access-request operations such as joiner, mover, leaver processing, access requests, account management, approvals, and provisioning workflows. Certification campaigns belong to IdentityIQ’s access review and compliance/certification capabilities, not LCM’s default functional scope. Certifications are used to review access, roles, entitlements, policy violations, or account/group membership and then require reviewers to approve, revoke, or otherwise act on access. LCM may interact with certification results indirectly because remediation from a certification can trigger provisioning or access changes, but launching the campaign itself is a certification/compliance function. This question tests whether the engineer separates lifecycle-request processing from access-review governance. Mixing them up leads to poor module design and incorrect implementation expectations. References/topics: IdentityIQ Engineer — Lifecycle Manager, access request, provisioning workflows, certification campaigns, Compliance Manager.

No. Upgrading the IdentityIQ web application does not automatically upgrade an independently installed IQService instance. IQService is a native Windows service installed on Windows hosts to support functionality requiring Windows APIs, including certain Active Directory provisioning operations and other Windows-specific connector capabilities.

SailPoint ' s IdentityIQ documentation states that the IQService version must match the IdentityIQ server version, including patch versions, and explicitly says that when one is upgraded, the other must also be upgraded. This is an operational requirement—not evidence of an automatic upgrade mechanism. The implementation engineer must deploy the appropriate IQService binaries and follow the required service upgrade or replacement procedure on each relevant Windows host.

Failing to align the versions can cause compatibility issues between IdentityIQ and IQService, particularly for connector requests, authentication/encryption behavior, provisioning, or Windows-native operations. The service configuration, port, TLS/certificate configuration, and service account should also be validated after upgrading.

Therefore, IQService must be deliberately upgraded alongside IdentityIQ; it is not automatically replaced merely because IdentityIQ itself was upgraded.

References/topics: IdentityIQ Engineer — IQService installation, version compatibility, IdentityIQ upgrades, Windows connector services, patch alignment.

=======

The Rapid Setup user interface configuration options in IdentityIQ can be used to disable an account and remove all its entitlements on a particular application during Leaver events. Rapid Setup is designed to simplify the configuration of common identity lifecycle processes, including handling leaver (termination) events. When configuring these events, you can specify actions such as disabling accounts and removing entitlements from specific applications as part of the termination process.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Lifecycle Manager Guide (Sections on Lifecycle Event Configuration)

No, the code snippet provided in the image is incorrect for including a rule library named " Common Rules Library " in a Rule. The correct syntax should reference the sailpoint.object.RuleLibrary class if the intent is to include a Rule Library, as seen in the second image. The first image incorrectly references the sailpoint.object.Rule class, which is not suitable for a rule library inclusion.

Correct Syntax (as shown in the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

The statement is false. The " Run Rule " feature on the Debug-Object page is not intended for creating, modifying, or deleting SailPoint database objects. Instead, it is used to execute specific rules for testing and debugging purposes. While it allows you to test the logic of a rule by running it in isolation, it does not directly manipulate database objects. For creating, modifying, or deleting database objects, administrators would typically use the appropriate IdentityIQ APIs or database scripts.

SailPoint IdentityIQ Administration Guide (Debugging and Rule Management Sections)

SailPoint IdentityIQ Developer Guide (Working with Rules and Debugging Tools)

Yes, the code provided in the second image is correct for including a rule library named " Common Rules Library " in a Rule. The correct syntax is to use class= " sailpoint.object.RuleLibrary " and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the " Common Rules Library. "

Correct Syntax (from the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

Adding a new object attribute to the Application ObjectConfig in IdentityIQ is not sufficient on its own to generate the database script needed to extend Application attributes. This action updates the configuration within IdentityIQ for how the application object is managed, but it does not produce the necessary SQL scripts to modify the underlying database schema. The actual database schema must be extended using specific IdentityIQ tools and commands like iiq extendedSchema.

SailPoint IdentityIQ Configuration Guide (ObjectConfig and Schema Management)

SailPoint IdentityIQ Administration Guide (Database Schema Extension)

No, the " Email Protocol " is not a setting that an engineer must set up to ensure successful communication with the SMTP server. Instead, the essential settings include the mail server address, port, authentication details (like username and password if required), and possibly the security settings (such as SSL/TLS). While the email protocol (e.g., SMTP) is implicitly involved, it is not a specific setting that needs to be configured separately within IdentityIQ. The critical setup revolves around configuring the mail server connection parameters.

SailPoint IdentityIQ Configuration Guide (Email and Notification Settings)

SailPoint IdentityIQ Administration Guide (SMTP Configuration for Email Notifications)

Yes. In IdentityIQ, a ManagedAttribute represents managed entitlement metadata associated with an application attribute/value, and it can have an Identity object assigned as its owner . Ownership is an important governance property because the entitlement owner can participate in approval routing, certifications, access-request decisions, remediation, and general accountability for the managed access.

This does not mean every ManagedAttribute is automatically owned by an Identity, nor does it mean its owner must be the same identity that owns the associated Application. Application ownership and entitlement ownership are independent governance relationships. For example, an Active Directory application may have one application owner while individual AD groups represented as ManagedAttributes have different business owners.

The wording “can have” is therefore important. IdentityIQ supports an Identity as the owner of the ManagedAttribute. Depending on configuration, ownership can be populated manually, through aggregation/customization, or through entitlement-management processes.

Do not confuse this relationship with the ManagedAttribute ' s required application context: the ManagedAttribute identifies governed access originating from an Application, while its owner identifies responsibility for that access.

References/topics: IdentityIQ Engineer — ManagedAttribute object, Entitlement Catalog, entitlement ownership, Application ownership, approval routing, entitlement certifications.

=======

No. A Bundle represents a role in IdentityIQ, and a Bundle profile is part of role definition logic, not something that must be associated directly to an Identity object. Profiles are used to describe conditions, constraints, or entitlement/application criteria associated with a role. Identities may be assigned roles, detected as matching roles, or evaluated against role profiles, but the Bundle profile itself is not required to be associated to a specific Identity object. This distinction is important because IdentityIQ’s role model is object-based: roles exist independently from the identities that hold them. A profile defines what the role means or how it is detected; identity role membership is a separate relationship. Saying that a Bundle profile must be associated with an Identity object incorrectly collapses role definition and identity assignment into one concept. References/topics: IdentityIQ Engineer — Bundle object, role profiles, role detection, role assignment, Identity object relationships.