IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Questions and Answers

Yes. IdentityIQ roles can be configured to include permissions as part of the access represented by the role. A role is fundamentally a logical collection of access that can include application entitlements and permission-based profile definitions. SailPoint describes roles as collections of permissions that group underlying system access into meaningful business or technical units.

Within a role profile, IdentityIQ supports Attribute Permissions in addition to attribute rules. Permissions define rights against targets on an application. An engineer can select rights such as create, read, update, delete, or execute and associate those rights with the appropriate target. These permission definitions become part of the role profile and therefore form part of the access granted through the role.

This should not be confused with IdentityIQ administrative SPRight objects. Application-level permissions contained in a role profile are governed access on target systems, whereas SPRights control functionality inside IdentityIQ itself. IdentityIQ roles can also grant capabilities and scopes when that feature is enabled.

Therefore, configuring a role to contain a set of permissions is a valid role configuration.

References/topics: IdentityIQ Engineer — Role Modeling, role profiles, attribute permissions, entitlements, targets and rights.

=======

Yes. Reusing appropriate standard Lifecycle Manager subprocesses is a sound IdentityIQ workflow-design practice because those subprocesses encapsulate established processing for common lifecycle and provisioning operations. Building every custom provisioning workflow entirely from scratch duplicates tested logic and makes future maintenance substantially harder.

SailPoint describes subprocess workflows as a way to divide complex workflows into smaller components that are easier to manage and can be reused by multiple master workflows. Standard LCM workflows make extensive use of this pattern for initialization, approval processing, provisioning, policy checking, identity-request handling, notifications, and related activities. A custom workflow can call an existing subprocess and provide the input/control variables required by that subprocess.

However, “as much as possible” does not mean blindly invoking every standard LCM subprocess. The engineer must understand the subprocess contract, including expected inputs, returned values, workflow variables, provisioning-plan assumptions, and release-specific behavior. Custom logic should only replace or extend standard processing when business requirements genuinely require it.

Therefore, leveraging standard LCM subprocesses where their behavior fits the requirement is a valid best-practice approach.

References/topics: IdentityIQ Engineer — LCM workflows, subprocess reuse, reusable business processes, workflow variables, provisioning customization.

=======

Yes. Policy checking behavior is one of the areas commonly controlled in LCM request workflows through workflow variables or configuration controlling policy evaluation mode. IdentityIQ can evaluate whether a requested access change would violate configured policies before the request is finalized or provisioned. Depending on configuration, the system can present policy violations to the requester, block submission, continue with warnings, or require additional approval/mitigation. The proposed behavior — checking whether an access request would violate policies and letting the requester review before submitting — aligns with interactive policy-checking behavior in LCM. This is an execution behavior of the request workflow, not an application schema setting. The engineer must still ensure policies are configured and enabled, but the workflow/control-variable layer can determine how those checks are applied during request submission. References/topics: IdentityIQ Engineer — LCM workflow control variables, policy checking, request policy violations, interactive policy review, access request governance.

Yes. The numbered placeholder model used by IdentityExtended.hbm.xml provides ten extended attributes by default—extended1 through extended10—and that numbered set can be expanded through extended20. This requires adding the appropriate property definitions to the extended Hibernate mapping and subsequently applying the corresponding database-schema extension process.

The distinction between numbered placeholder attributes and named attributes using ExtendedPropertyAccessor is important. Twenty is the traditional limit of the numbered SailPointObject extended-property slots; it is not an absolute claim that IdentityIQ can never support additional custom attributes. SailPoint provides ExtendedPropertyAccessor for named extended properties beyond the numbered placeholder model.

The configuration comments associated with IdentityExtended.hbm.xml explicitly state that ten extended attributes are mapped by default and that this can be raised to twenty. They also caution that excessive searchable/indexed attributes can degrade Identity Cube update performance.

Therefore, the proposition is correct specifically for adding further placeholder numbered extended attributes beyond the ten shown, through extended20 .

References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended1–extended20, searchable identity attributes, ExtendedPropertyAccessor, extended schema.

=======

An AfterProvisioning rule in SailPoint IdentityIQ is typically used to execute custom logic after the provisioning process has been completed successfully. However, if provisioning fails, this rule will not be triggered because it is specifically designed for post-successful provisioning activities. To log an error message in the audit record when provisioning fails, a better approach would be to use a provisioning error handler or configure a specific workflow that captures errors and logs them accordingly. The AfterProvisioning rule is not the correct solution for this use case. Refer to the SailPoint IdentityIQ Provisioning and Workflow documentation for appropriate methods of handling provisioning errors and audit logging.

Yes. A Boolean datatype is appropriate because the stated purpose is to flag privileged accounts . A flag normally represents a binary condition: the account either satisfies the privileged-account criteria or it does not. Consequently, true and false accurately represent the resulting classification.

The engineer can derive this Boolean from the Financial application ' s privileged attribute and/or calculate the result through logic involving the Keystore application ' s responsibility-code attribute. Once populated, the Boolean value can be referenced reliably from rules and policy conditions and can participate in searchable/analytics configuration when the associated attribute is configured appropriately.

This distinction also resolves the earlier Attribute Type: string proposition. A String could technically hold textual values, but the requirement here is specifically a Boolean privilege flag. Therefore, for this DOMC scenario, Boolean is the configuration that matches the requirement , while String should be answered No.

The bank already tests source mapping and edit mode for the same scenario but does not contain this Boolean proposition.

References/topics: IdentityIQ Engineer — account schema, Boolean attributes, privileged-account classification, source mapping, rules, policies.

=======

No. IdentityIQ certifications are used to review and attest access, roles, entitlements, account group memberships, policy violations, or other governance items. They are not designed to ensure “SailPoint” itself is compliant with ISO 9001, and ISO 9001 is not a government regulation in the way the proposed solution states. ISO 9001 is a quality management standard, not an access-governance regulation that IdentityIQ certifications directly enforce. An organization may use IdentityIQ certification evidence as part of broader compliance programs, but the certification’s direct purpose is access review: confirming that users have appropriate access and that inappropriate access is revoked, remediated, or justified. The wording is wrong both in target and scope. The certification process supports customer governance/compliance objectives, not SailPoint corporate ISO compliance. References/topics: IdentityIQ Engineer — certification purpose, access review, compliance evidence, entitlement review, role review, governance controls.

The four minimum steps necessary to extend attributes in an IdentityIQ database after it has been created, in the correct order, are:

Update the corresponding hibernate file with the new attributes.

The Hibernate mapping file needs to be updated with the new attributes so that the SailPoint IdentityIQ application is aware of the new columns or properties in the database. This step ensures that the object-relational mapping (ORM) reflects the updated data model.

Run the command to generate the script to update the IdentityIQ database.

After updating the Hibernate file, a schema update script is generated. This script contains the necessary SQL commands to modify the database schema based on the new attributes added in the Hibernate file.

Shut down the application server and then run the generated extendedSchema script on the IdentityIQ database.

Before applying schema changes, the application server must be stopped to avoid any transactional conflicts. Afterward, the extendedSchema script is run on the database to apply the new attributes.

Start the application server and update the corresponding ObjectConfig.

Once the database schema is updated, restart the IdentityIQ application server and modify the ObjectConfig in SailPoint to register the new attributes for use within the IdentityIQ platform.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Updating the Hibernate File: This step involves modifying the Hibernate XML or annotation-based mapping files to reflect the new attributes that are being added to the database. SailPoint IdentityIQ uses Hibernate as its ORM, and any new database fields must first be defined at this layer.

Generating the Schema Update Script: SailPoint provides a command (usually via iiq console or build tools) that reads the updated Hibernate mapping and generates a database-specific script to alter the schema. This ensures that the database is modified in a way that matches the application ' s expectations.

Running the Schema Update Script: With the application server stopped, the schema update script is executed on the database. This step adds the new columns, indexes, or constraints that are required for the extended attributes.

Updating the ObjectConfig: Once the database is updated and the application server is running again, the ObjectConfig (typically located in the IdentityIQ admin UI) must be updated to incorporate the new fields. This step ensures that these new attributes are accessible to workflows, forms, and identity data within the system.

SailPoint IdentityIQ Installation and Configuration Guide (sections on extending the data model and schema updates).

This proposed implementation is not valid as written. The logic is conceptually understandable, but the XML structure is not the correct IdentityIQ workflow transition pattern. In IdentityIQ workflows, transitions are normally declared using < Transition > elements with a destination, such as to= " StepName " , and optional conditional logic through a when expression or scripted evaluation. A raw < Source > block directly inside < Transition > returning destination names is not the standard structure for expressing multiple workflow routing paths after a form step. The engineer’s requirement is to route to Stop when the reject/back action is used, route to Audit when approval occurs and the comment variable is populated, and route to Provision as the fallback. That should be implemented as separate transition definitions with explicit destination steps and conditions. The proposed XML does not properly bind the returned values to valid transition destinations in the expected workflow syntax. References/topics: IdentityIQ Engineer — workflow XML, transition elements, form step routing, BeanShell expressions, Business Process Editor.

Changing the Email Notification Type to POP3 under Global Settings > Configure IdentityIQ Settings > Mail Settings is not a correct procedure for testing generated emails in a non-production system. POP3 is an email retrieval protocol, not a method for sending or redirecting email notifications from IdentityIQ. IdentityIQ requires an SMTP server to send emails, and POP3 is typically used by email clients to retrieve emails from a server, not by a server to send emails.

For testing purposes in a non-production environment, you would typically configure the SMTP server settings to either redirect emails to a specific testing mailbox or use a " Redirect to File " option, if available, to capture emails locally.

Thus, the correct answer is B. No.

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

This is a valid step, with the typo corrected as “create the audit event.” Registering an AuditAction in AuditConfig only defines the custom event type; IdentityIQ still needs executable logic to actually write the audit event when the relevant condition occurs. That logic can be placed in a BeanShell rule, task, workflow step, or other appropriate execution point depending on the business process being audited. The code must create/populate the audit record with the configured action name and the relevant data values, such as target identity, actor, source object, application, attribute values, or other fields needed by the later report. Without this implementation logic, the custom audit action would exist but no audit records would be generated. Therefore, writing the logic to create the audit event is a legitimate step in the end-to-end process. References/topics: IdentityIQ Engineer — BeanShell audit logic, workflow audit events, custom AuditAction usage, audit data population, custom audit reporting.

The correct sequence of steps to turn on Certifications logging at the severity log level of trace is as follows:

Edit the file: [IdentityIQ installation] > WEB-INF > classes > log4j.properties.

This step involves accessing the configuration file where logging parameters are managed. The log4j.properties file is crucial for adjusting logging settings such as the log level for specific modules in SailPoint IdentityIQ.

Uncomment the out-of-the-box logger #log4j.logger.sailpoint.api.Certification=info.

This step enables the logger for Certification by removing the comment from the respective line in the log4j.properties file. This makes the logger active for the certification process.

Change the log level to trace and save.

After uncommenting the logger, change the log level from info to trace. The trace level provides the most detailed logging, capturing comprehensive information about the certification process for troubleshooting.

Restart the application server.

Restarting the application server is necessary for the changes in the log4j.properties file to take effect. SailPoint IdentityIQ reads the updated configuration during the startup process.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Editing the log4j.properties file is a standard practice in SailPoint IdentityIQ for configuring logging. This file, located in the WEB-INF/classes directory, controls how and what IdentityIQ logs for different components.

Uncommenting the specific logger is needed to ensure that the system is logging the events related to certification. The commented line #log4j.logger.sailpoint.api.Certification=info can be found in the default configuration and needs to be activated for proper logging.

Setting the log level to trace is crucial because trace provides the most detailed logging, which is essential for deep debugging or tracking granular details about the certifications in IdentityIQ.

Restarting the server ensures that the changes to the logging configuration are applied, as the settings in log4j.properties are only read during the startup phase.

SailPoint IdentityIQ Log Management and Troubleshooting Guide (section on adjusting log levels and configurations).

This statement is correct. IdentityIQ uses rule types and rule metadata to guide engineers when creating or editing rules. The Rule Registry describes expected rule behavior, including contextual information such as the rule’s purpose, expected inputs, and often the intended output or return behavior. This is important because IdentityIQ rules are not generic scripts running in isolation; they execute in specific product contexts such as aggregation, correlation, provisioning, workflow, certification, policy evaluation, or lifecycle processing. The rule editor can expose information derived from the rule registry so that an engineer understands which variables are available and what the rule is expected to return. This reduces implementation errors, especially in DOMC-style topics where a wrong return type or missing context variable can cause runtime failures. The Word bank separately confirms that the BeanShell rule editor lists typical input variables based on the rule registry. References/topics: IdentityIQ Engineer — Rule Registry, BeanShell rule editor, rule metadata, expected inputs, expected outputs.

No. Whether an application supports password change requests through the IdentityIQ UI is not controlled by generic LCM workflow control variables. Password-change support depends on the application connector’s capabilities, password-management configuration, application settings, schema/support for password operations, policies, and QuickLink/user-interface configuration. The workflow may process or route a password-change request once launched, but it does not define which target applications support that operation. That capability must be configured at the application/connector and password-management layer. Mixing these layers would create a brittle design: workflow variables should govern execution behavior, while application configuration defines available account operations. Therefore, the proposed solution is not achievable merely by configuring out-of-the-box LCM workflow control variables. References/topics: IdentityIQ Engineer — password management, application connector capabilities, LCM workflows, QuickLink password change, account operation support.

Yes, the statement is true. Both logging and auditing in SailPoint IdentityIQ can have a negative influence on performance because they involve additional function calls within the application. These processes generate data that needs to be stored, which can impact performance if not managed properly. Extensive logging and auditing, particularly at high levels of detail, can lead to increased I/O and storage usage, potentially slowing down system operations.

SailPoint IdentityIQ Performance Tuning Guide

SailPoint IdentityIQ Logging and Auditing Guide (Impact on Performance)

No. The proposition incorrectly equates account ownership with the accounts personally held by the reviewer. Those are different relationships.

In ownership-based governance, the relevant question is which accounts or governed objects the reviewer is responsible for, not which target-system accounts belong to the reviewer ' s own identity. IdentityIQ explicitly supports ownership relationships independently from account possession. For example, account ownership can be assigned to another Identity, and targeted certifications can use an Owner filter to select accounts owned by specified identities.

Likewise, IdentityIQ ' s certification architecture generally routes reviews according to governance responsibility: an Application Owner reviews access to applications for which that person is responsible, an Entitlement Owner reviews identities holding entitlements the reviewer owns, and account-group reviews are driven by ownership of the corresponding governed objects. The reviewer need not personally possess that access.

Therefore, an ownership-based account certification is not limited to accounts that the certifier personally “holds.” Its purpose is to review accounts for which that identity has ownership/responsibility according to IdentityIQ ' s governance model.

References/topics: IdentityIQ Engineer — account ownership, certification ownership, targeted certification Owner filter, Application Owner certification, governance responsibility.

=======

The provided solution does not fulfill the client ' s requirement. Setting " Who can members request for? " to " report to the requester " only limits the request scope to users who directly report to the requester, which does not account for the location attribute. The goal is to restrict requests based on the location attribute, and this specific configuration does not consider that attribute. To achieve the desired behavior, the configuration should include logic that filters users based on the same location as the requester.

This scenario describes an employee quitting their job and needing all of their accounts disabled, which aligns with a leaver lifecycle event rather than a mover event. A leaver event typically involves the deactivation of accounts and removal of access for users who are leaving the organization entirely, whereas a mover event involves changes to roles or access as part of an internal transition (e.g., promotion, transfer).

Therefore, the correct answer is B. No.

Placing a QuickLink object directly on a workflow is not a valid step in the development of a custom QuickLink. QuickLinks are used to provide users with easy access to specific tasks or workflows through the IdentityIQ interface, but the QuickLink itself is not embedded within the workflow. Instead, the QuickLink is created as a separate object and associated with the desired workflow or task that it is meant to launch.

The correct approach would involve creating a QuickLink that points to the workflow and then controlling access to the QuickLink by restricting it to a specific QuickLink population (e.g., " Managers " ). Therefore, the correct answer is B. No.

No. Setting the length of an IdentityIQ extended String attribute to 9000 is not a supported general mechanism for storing an identity image. The length value in IdentityExtended.hbm.xml influences how Hibernate maps the String property to a database column. It therefore has database-specific consequences and must not be treated as an arbitrary storage-capacity control.

The standard IdentityIQ extended-attribute configuration uses String properties with much smaller lengths—for example, length= " 450 " —specifically so the resulting columns remain suitable for searching and indexing. SailPoint ' s own configuration commentary warns that database platforms have different VARCHAR limitations and that sufficiently large String definitions may cause Hibernate to map the value to a LOB/blob-like type that cannot be used in the same way for searches.

An image is binary content and should not be modeled merely by making an extended searchable String column extremely large. Even an encoded image can exceed practical database/index limits and introduces unnecessary Identity Cube and persistence overhead.

Therefore, length= " 9000 " is not a prescribed IdentityIQ image-storage configuration.

References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended properties, Hibernate mappings, VARCHAR limits, searchable attributes, database schema design.

=======

Yes, disabling all notifications can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In SailPoint IdentityIQ, most workflows, including those in LCM, use control variables to manage various settings, such as whether notifications should be sent. By setting the appropriate control variable (e.g., disabling email notifications) within the workflow configuration, you can effectively suppress all notifications related to that workflow.

Therefore, the correct answer is A. Yes.

The statement is false. The " Run Rule " feature on the Debug-Object page is not intended for creating, modifying, or deleting SailPoint database objects. Instead, it is used to execute specific rules for testing and debugging purposes. While it allows you to test the logic of a rule by running it in isolation, it does not directly manipulate database objects. For creating, modifying, or deleting database objects, administrators would typically use the appropriate IdentityIQ APIs or database scripts.

SailPoint IdentityIQ Administration Guide (Debugging and Rule Management Sections)

SailPoint IdentityIQ Developer Guide (Working with Rules and Debugging Tools)

A Role Membership Certification is appropriate for this requirement because the hospital is trying to confirm that users assigned to a role are correct. The test is not about whether the role contains the right entitlements; that would point to Role Composition Certification. It is also not primarily about application ownership or account group membership. The wording says the business analysts want to verify the role assignment rules by certifying the users who have been assigned the role. That maps directly to a membership review: who is in the role, whether each membership is valid, and whether the assignment rule is producing the expected population. The security team can be configured as the certifier, final reviewer, or sign-off participant depending on certification ownership and sign-off configuration. Therefore, the proposed certification type achieves the stated goal. References/topics: IdentityIQ Engineer — Role Membership Certification, role assignment rules, certification ownership, sign-off, access review routing.

When upgrading SailPoint IdentityIQ between releases, it is not necessary to install every version in sequential order between the current version and the target version. SailPoint provides upgrade paths that often allow skipping several major versions by directly upgrading to the desired target version from a supported previous version. However, it is crucial to follow the specific upgrade paths and procedures documented by SailPoint, which may involve intermediate steps or specific considerations depending on the versions involved.

Therefore, the correct answer is B. No.

Yes, this is indeed one of the primary purposes of an IdentityIQ certification. Certifications are conducted to attest to a user ' s system access, ensuring that each user has appropriate and justified access rights to applications, data, and systems within the organization. This is central to IdentityIQ’s access governance and compliance processes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

Yes. Attesting assignment of roles to users is a valid purpose of an IdentityIQ certification. Role-based governance depends not only on whether roles contain the correct entitlements, but also on whether the correct users hold those roles. A certification can ask reviewers to validate role membership, confirm that role assignments are appropriate for job function, and revoke or remediate role assignments that are no longer justified. This is especially important in environments where role assignment rules, business roles, or automated provisioning logic are used. If the rule assigns a role to the wrong population, users may inherit incorrect access even if the role composition itself is technically correct. Certification provides a formal review and sign-off process, creating accountability and audit evidence. Therefore, attesting role assignment to users is squarely within IdentityIQ certification functionality. References/topics: IdentityIQ Engineer — role membership certification, access review, role assignment attestation, certification sign-off, remediation decisions.

The statement " The rule type must be IdentityAttribute " is correct. In SailPoint IdentityIQ, when writing a rule that is intended to map or manipulate identity attributes during the aggregation process, the rule type should be set to " IdentityAttribute " . This ensures that the rule is recognized and executed in the appropriate context for managing identity attributes.

Therefore, the correct answer is A. Yes.

No. To permit users to unlock accounts through the Manage Accounts interface, the relevant Lifecycle Manager configuration is the Unlock Manage Account Action. Selecting a Rehire action does not configure the account-unlock operation described in the requirement.

IdentityIQ ' s Lifecycle Manager Configuration includes explicit Manage Account Actions for Delete, Disable, Enable, and Unlock . Administrators choose which of these operations users can request for themselves and, where authorization permits, for subordinates. If Unlock is deselected, that type of Manage Accounts request is unavailable.

Rehire is a lifecycle concept associated with restoring access for an identity returning to the organization; it is not the configuration switch that enables an account-unlock request. Unlock specifically addresses a target account that is locked while otherwise remaining an existing account.

This question is easy to mistake for the existing Word-bank question because the proposition is identical. However, the existing item asks about enabling an account, not unlocking one. Under the required DOMC comparison, that change in the stem makes this a distinct question.

Therefore, the proposed Rehire configuration does not meet the unlock requirement.

References/topics: IdentityIQ Engineer — Lifecycle Manager Configuration, Manage Accounts, Unlock Account, Enable Account, account actions, subordinate account management.

This proposed solution is incorrect. A create-type lifecycle event trigger is used when a new identity is created or first detected in IdentityIQ. The requirement is not about a new identity; it is about an existing identity whose Division attribute changes from IT to Senior IT. That is an update or attribute-change scenario. A create event would not reliably fire when an existing user’s Division attribute is modified during aggregation or identity refresh. It also does not address the second required condition: the user must be a manager. The correct approach must detect the specific attribute transition and then evaluate the manager condition. Using a create trigger would either never launch the workflow for the intended case or launch it only at identity creation time, which is outside the stated requirement. This is a basic but important lifecycle-event design distinction: joiner/create events are not substitutes for mover or attribute-change events. References/topics: IdentityIQ Engineer — lifecycle events, create triggers, attribute-change triggers, mover events, identity refresh processing.

No. A standard Correlation Rule and a Manager Correlation Rule perform different functions in IdentityIQ. The scenario specifically requires resolving a manager reference—an employee ' s manager employee number must be matched to the correct Identity despite several employee-number formats. That is manager correlation, not ordinary account-to-identity correlation.

A Correlation Rule is used when IdentityIQ needs custom logic to associate an application account with an Identity and simple attribute-based account correlation is insufficient. By contrast, SailPoint defines a Manager Correlation Rule specifically for establishing the Manager–Direct Report relationship between Identity objects when simple manager attribute mapping cannot accommodate the required matching logic.

Here, the presence of several employee-number formats is exactly the type of complexity that makes custom manager-correlation logic appropriate. The rule can normalize or otherwise interpret those formats and return the identity representing the correct manager.

This proposition is separate from the earlier video proposition using “Write a ManagerCorrelation rule,” which is the correct solution. Under DOMC rules, changing the proposed rule type creates a separate question.

Therefore, writing a generic Correlation Rule does not correctly target the required manager-resolution process.

References/topics: IdentityIQ Engineer — Manager Correlation Rule, Correlation Rule, manager relationships, application aggregation, account correlation, Identity Cube relationships.

=======

Yes. Add Entitlement is an explicitly supported IdentityIQ batch request type and directly addresses the portion of this scenario where users are missing required access. Lifecycle Manager batch requests enable administrators to prepare a comma-delimited file containing multiple access operations and submit those operations for bulk processing instead of manually requesting access identity by identity.

SailPoint documents the operation name as AddEntitlement. The batch file identifies the application, entitlement attribute name, entitlement value, and either the target account ' s native identity or the IdentityIQ identity name. Multiple identities can therefore receive the required entitlement through a controlled batch process. This makes the operation particularly suitable for regional reorganizations, migrations, remediation projects, or other situations where the same access change must be applied across a defined population.

The scenario also states that some users possess excess entitlements. Those items require the complementary Remove Entitlement operation rather than Add Entitlement. A complete cleanup might therefore involve separate add and removal records—or separate files if processing order matters. Nevertheless, Add Entitlement is unquestionably one supported batch request type that helps meet the stated goal.

References/topics: IdentityIQ Engineer — Batch Requests, AddEntitlement, bulk access remediation, Lifecycle Manager, entitlement provisioning.

=======

The statement is false. While it is true that logging and auditing require extra function calls and generate data, the suggestion that this data can be compressed to avoid storage issues and improve performance is misleading. In practice, while compression might save storage space, it does not inherently improve performance, particularly because the overhead of compression and decompression could negate the performance benefits. Effective performance management in IdentityIQ involves more nuanced approaches, such as optimizing the level of detail in logs, managing log rotation, and tuning the system for efficient I/O operations.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Performance Tuning Guide

No. IdentityIQ ' s standard audit-event configuration is managed primarily through the Audit Configuration page, not through the Administrator Console. SailPoint documents the navigation for audit configuration under Global Settings > Audit Configuration , where administrators choose which General Actions, Identity Attribute Changes, Link Attribute Changes, Class Actions, and other supported activities are collected in the audit log.

The Administrator Console serves a different operational purpose. It is used for areas such as task-result management, provisioning transaction monitoring, host/environment monitoring, application health, and status information for SailPoint modules and extensions. Although some activities viewed or performed there may themselves generate audit records when auditing is enabled, that does not make the Administrator Console the central audit-configuration interface.

This distinction is important for an IdentityIQ engineer. Audit Configuration controls what governance events are recorded; Advanced Analytics provides mechanisms to search the resulting audit events; Administrator Console focuses primarily on operational monitoring and administration. Therefore, replacing “Audit Configuration page” with “Administrators Console page” changes the statement from correct to incorrect.

References/topics: IdentityIQ Engineer — Audit Configuration, audit actions, Administrator Console, Environment Monitoring, Advanced Analytics.

=======

Yes. IdentityIQ workflow steps support several action types, and both Script and Rule actions execute logic implemented with Java BeanShell.

A Script action contains BeanShell code directly within the workflow step. This is useful for workflow-specific logic that is short or tightly coupled to that business process. In workflow XML, the script may appear inline or inside a nested < Script > < Source > ... < /Source > < /Script > block.

A Rule action also executes BeanShell code, but the code is encapsulated in a reusable IdentityIQ Rule object rather than embedded directly in the workflow. This is preferable when logic needs to be reused, separately maintained, or invoked by multiple workflows or other IdentityIQ components.

IdentityIQ distinguishes these action types from Subprocess , which launches another Workflow object, and Call Method , which invokes a compiled Java method exposed through the IdentityIQ workflow library.

SailPoint ' s workflow documentation explicitly describes Script as executing Java BeanShell code and Rule as executing a reusable workflow Rule containing Java BeanShell code. Therefore, the proposed statement accurately characterizes both action types.

References/topics: IdentityIQ Engineer — Workflow Step actions, Script, Rule, BeanShell, Subprocess, Call Method, Business Process Editor.

Yes. Rapid Setup supports standard lifecycle-event actions for Leaver processing, including application-specific account actions and delayed account deletion. This enables an implementation to disable an account when the Leaver event occurs and configure account deletion for a later point, such as 30 days afterward.

This pattern is useful because many organizations do not immediately delete accounts when employment ends. Immediate disablement blocks interactive access while preserving the account temporarily for investigation, handover, retention, reconciliation, or recovery requirements. After the retention interval expires, deletion can remove the target-system account according to the configured lifecycle policy.

The important distinction is that this is a standard timing sequence for the same lifecycle population , rather than complex branching where different categories of users receive entirely different actions. The Word bank already contains a different Rapid Setup proposition involving disabling accounts for one group while deleting accounts for another group during termination, and marks that more complex population-dependent scenario invalid. It also separately tests disable-plus-entitlement-removal during Leaver.

Therefore, this delayed-delete Leaver proposition is unique and valid.

References/topics: IdentityIQ Engineer — Rapid Setup, Leaver events, Disable Account, Delete Account, delayed deletion, lifecycle configuration.

=======

Yes, this statement is true. The default language of IdentityIQ can be changed from English by replacing the appropriate message files. Administrators can modify or replace the default English message files with those for another language, which will then become the system’s default language. This allows IdentityIQ to be localized according to the organization ' s language preferences.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Administration Guide (Language Settings and Message File Management Sections)

This proposed solution is not valid as written. The stem says the engineer needs to create a custom audit event and set up an associated report. The proposed XML fragment is an ObjectAttribute definition for an attribute named userType; it is not an AuditAction definition. An ObjectAttribute entry is used in object configuration contexts to describe an attribute’s display, edit behavior, extended number, name, and type. That does not define a new audit action/event in the AuditConfig object. A proper audit event definition would use an AuditAction element or equivalent AuditConfig configuration identifying the audit action name, display name, and enabled state. Because the XML fragment shown does not create a custom audit action, it cannot satisfy the required step. This is exactly the kind of syntax-level distinction an IdentityIQ engineer must catch: correct object type and correct XML element matter. References/topics: IdentityIQ Engineer — AuditConfig XML, AuditAction definition, ObjectAttribute configuration, custom audit event setup.

Yes. This is a recognized IdentityIQ BeanShell debugging technique for inspecting the variables available in the current rule ' s BeanShell namespace. BeanShell exposes the namespace variable names through this.variables. The loop processes each name, evaluates it through eval(name), determines whether its value is void, null, or an actual Java object, and prints the variable together with its runtime type and value.

This is valuable because the effective variables available to a rule can depend on both the rule type and the context from which that rule is invoked. The Rule Editor documents normal Arguments and Returns, but runtime inspection can expose the actual namespace provided during a specific execution.

SailPoint ' s published debugging example uses essentially this same pattern and describes it as dumping all variables available in the BeanShell namespace. Newer versions of the example add a check to skip transient, because that name is a Java reserved word and can cause eval() problems in some workflow contexts. That refinement does not invalidate the basic diagnostic technique shown in the question.

References/topics: IdentityIQ Engineer — BeanShell namespace, Rule Editor Arguments/Returns, this.variables, eval(), rule debugging.

=======

Yes. When a new IdentityIQ object is created and persisted correctly through the application layer, IdentityIQ can generate the internal object ID upon save. The object ID is the persistent identifier used by the platform and database, while the object name is a separate logical or display identifier. This distinction is important when engineers create or import objects through Debug. A new object should not reuse the ID of an existing object, because that would update or conflict with the existing object rather than create a clean new record. Automatic ID generation is one reason object XML is often edited before import or creation: copied XML must have old IDs removed so IdentityIQ can assign a fresh identifier. The statement is therefore valid, but engineers must still ensure required fields, class type, name uniqueness, and object references are correct before saving. References/topics: IdentityIQ Engineer — Debug-Object page, object persistence, automatic ID generation, object name versus ID, XML import safety.

Yes. LCM provisioning workflows contain control behavior for handling provisioning operations that are not completed synchronously. A queued result is materially different from a failed result: IdentityIQ has successfully submitted the request into a provisioning path, but the downstream operation has not necessarily completed yet.

LCM processing can therefore be configured so that asynchronous/queued provisioning does not cause the overall request workflow to be treated as an immediate provisioning failure. This is important for connectors and integrations where target operations are queued, brokered, or fulfilled asynchronously. Otherwise, the workflow could incorrectly follow failure handling merely because the target-system change was not completed during the same execution thread.

The engineer must still distinguish this from claiming that the target access has definitely been provisioned. “Successful” at this workflow stage means the request was accepted into the expected provisioning process. Subsequent transaction processing, retries, aggregation, or request maintenance can establish the final state.

This is precisely why provisioning status management is a workflow concern, whereas whether an application supports a particular account operation is an application/connector concern.

References/topics: IdentityIQ Engineer — LCM provisioning workflows, asynchronous provisioning, queued provisioning status, ProvisioningProject, provisioning transaction status, request maintenance.

=======

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

When setting up a new IdentityIQ test environment, it is important to assess the needs of the customer, including whether they would benefit from using a deployment accelerator.

Deployment accelerators are pre-configured sets of rules, policies, and workflows that can significantly reduce the time and effort required to deploy IdentityIQ in a test or production environment. These accelerators are particularly useful for rapidly setting up environments that align with common industry practices or specific compliance requirements.

Asking the customer whether they need a deployment accelerator is a valid and important question during the initial setup phase, as it helps to determine the best approach to configuring the test environment efficiently. Therefore, the correct answer is A. Yes.

Yes. Domain information is a fundamental connection element when configuring IdentityIQ to interact with Active Directory. Active Directory is organized around forests and domains, and the connector must know the domain context in which user, group, membership, authentication, aggregation, and provisioning operations will occur.

In the IdentityIQ Active Directory connector ' s Domain Settings, the engineer configures the relevant forest and enters the Domain along with the required service-account information and authentication settings. The connector then uses this information to bind to the appropriate Active Directory domain controller environment and manage directory objects in the configured scope.

Specific connector releases also provide conveniences such as forest-level domain discovery or “Manage All Domains,” but these mechanisms do not eliminate the underlying Active Directory domain context. The connector still needs to know which domains it manages, whether they are explicitly configured or discovered under a forest configuration.

For the DOMC proposition as stated, Domain is therefore a required core Active Directory configuration concept, rather than an optional role-modeling or cosmetic application property.

References/topics: IdentityIQ Engineer — Active Directory connector, Domain Settings, forests and domains, service account configuration, connector authentication.

=======

The statement is false. In SailPoint IdentityIQ, the language displayed in the user interface is not always based on the default language selected in the global settings. The language displayed in the user interface is typically determined by the user ' s language preference, which can be set individually for each user. If a user ' s preferred language is not available, then the system may fall back to the default language specified in the global settings. Thus, while the global default language serves as a fallback, the actual language displayed is often based on user-specific settings.

SailPoint IdentityIQ Administration Guide (Localization and Language Settings Sections)

SailPoint IdentityIQ User Guide (User Preferences and Language Selection)

The statement that " the staging period is required " for certifications is not true. In SailPoint IdentityIQ, the staging period is an optional phase during the certification campaign configuration. The staging period is used to pre-generate certifications and allow for any preparatory actions or adjustments before the certifications are officially launched and sent to reviewers. However, it is not a mandatory component for all certification campaigns.

Administrators may choose to bypass the staging period entirely depending on the specific requirements of the certification process or the urgency of the certification campaign. Therefore, while the staging period can be beneficial for managing large or complex certifications, it is not a required step.

SailPoint IdentityIQ Certification Overview Guide

SailPoint IdentityIQ Administration Guide (Sections on Certification Configuration and Staging Period)

Filter String is not required when setting up every IdentityIQ application. A filter string is a connector-specific or configuration-specific option used in some application definitions to limit which accounts, groups, or objects are included during aggregation or connector operations. For example, LDAP-style connectors may use filters to restrict returned accounts, and other connector types may expose filter-like options depending on the source system. That does not make Filter String a universal mandatory field. IdentityIQ applications require core configuration such as application name, connector/type selection, schema information, and account identity handling, but not every application needs a filter. Some applications aggregate all accounts from the configured source, while others use connector-specific search, API, file, or database settings. Treating Filter String as universally required would be wrong because it depends on connector type and business filtering requirements. References/topics: IdentityIQ Engineer — application definition, connector configuration, aggregation filtering, required versus optional application settings.

A Post-Iterate Rule in SailPoint IdentityIQ is a type of connector rule that is executed after each account from the source system (e.g., SQL Loader application) has been read during the aggregation process. This rule allows for additional processing or customization of the data after the account has been iterated over. According to SailPoint IdentityIQ documentation, configuring a Post-Iterate Rule enables the execution of logic after each account ' s data has been processed, confirming that the given statement is valid. Refer to the SailPoint IdentityIQ Connector Development Guide for detailed information on rule execution during aggregation.

The statement that supported platforms of an older version of IdentityIQ will always be supported in newer versions of IdentityIQ is incorrect. As SailPoint releases new versions of IdentityIQ, the list of supported platforms (such as specific versions of Java, databases, application servers, etc.) may change. Newer versions of IdentityIQ might deprecate support for older platforms or require newer versions of software components. It is essential to consult the Release Notes or the Supported Platforms documentation for the specific IdentityIQ version to ensure compatibility.

Thus, the correct answer is B. No.

This is not a clean joiner lifecycle event. A joiner event normally represents a person newly entering the organization or being newly onboarded into managed access, usually requiring new identity setup, new accounts, baseline access, roles, approvals, and provisioning. The proposed scenario describes a contractor whose previous relationship ended, whose accounts were disabled, and who now has a new contract requiring previous accounts to be enabled. That is closer to a rehire/reactivation or account-enable lifecycle event than a first-time joiner. The distinction matters in IdentityIQ because a true joiner process may create accounts and assign initial access, while a rehire/reactivation process may restore, enable, or reassess previously existing accounts and access. Treating this as a joiner could create duplicate accounts or duplicate access instead of properly reactivating existing Links/accounts. References/topics: IdentityIQ Engineer — Lifecycle Manager, joiner event, rehire/reactivation, account enablement, identity lifecycle workflow design.

Yes, the typical input variables for a rule are listed in the BeanShell rule editor in IdentityIQ, based on the rule registry. When you create or edit a rule in IdentityIQ using the BeanShell editor, the available input variables that are relevant to the rule type are typically pre-defined and listed based on the rule registry. These input variables provide context and data that the rule can operate on, and their availability helps guide the rule development process.

Therefore, the correct answer is A. Yes.

Rapid Setup application onboarding is designed to simplify the initial configuration and does not typically provide advanced configuration options like specifying an account attribute and value filter to identify secondary accounts. Such detailed configurations often require custom scripting or detailed adjustments within the standard application setup, outside of the Rapid Setup interface.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Sections on Application Onboarding and Advanced Account Mapping)

Yes. IdentityIQ email templates use the Apache Velocity Template Language (VTL) , and these forms are valid Velocity reference syntaxes. $identityName is the normal shorthand reference. ${identityName} uses formal notation, which is particularly useful when the variable reference must be clearly separated from immediately adjacent characters. This permits the reference to be embedded or concatenated into surrounding text without Velocity interpreting the additional characters as part of the variable name.

The exclamation-mark form is a quiet reference . With $!identityName—or the formal quiet form $!{identityName}—Velocity suppresses the literal reference when the underlying value is null. This is useful in email templates because optional values should not produce visible strings such as $identityName when no value was supplied.

SailPoint ' s IdentityIQ documentation explicitly presents $identityName, ${identityName}, and $!identityName as VTL variable-reference forms and notes that the alternate forms are required in special situations. IdentityIQ email templates pass template arguments into the VelocityContext for this substitution.

References/topics: IdentityIQ Engineer — EmailTemplate objects, Apache Velocity, VTL references, formal references, quiet references.

=======

No. An individual SPRight is a granular IdentityIQ product right, but roles do not normally grant an arbitrary standalone SPRight directly as a role entitlement. IdentityIQ groups SPRights into Capabilities , which provide logical collections of rights associated with administrative or functional job responsibilities.

The Role Editor provides a Granted IdentityIQ User Rights section where an engineer can associate IdentityIQ capabilities and scopes with a role. When that role is assigned and role provisioning is processed through Identity Refresh, the corresponding capabilities and scopes can be granted to the identity. This is the supported role-level abstraction.

The distinction matters because an SPRight controls granular access to specific IdentityIQ UI functions, tools, pages, or operations, while a Capability groups one or more SPRights into a maintainable authorization construct. Directly treating a single SPRight as an ordinary role option bypasses the intended rights-to-capability model.

Therefore, although a role can grant IdentityIQ user rights indirectly through configured capabilities, the proposed statement that the role is configured to include a single SPRight object is not the valid role configuration model.

References/topics: IdentityIQ Engineer — SPRight, Capability, Granted IdentityIQ User Rights, Role Editor, authorization model.

=======

Adding a new object attribute to the Application ObjectConfig in IdentityIQ is not sufficient on its own to generate the database script needed to extend Application attributes. This action updates the configuration within IdentityIQ for how the application object is managed, but it does not produce the necessary SQL scripts to modify the underlying database schema. The actual database schema must be extended using specific IdentityIQ tools and commands like iiq extendedSchema.

SailPoint IdentityIQ Configuration Guide (ObjectConfig and Schema Management)

SailPoint IdentityIQ Administration Guide (Database Schema Extension)

Yes, the code provided in the second image is correct for including a rule library named " Common Rules Library " in a Rule. The correct syntax is to use class= " sailpoint.object.RuleLibrary " and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the " Common Rules Library. "

Correct Syntax (from the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

Export CSV / Import CSV is not a valid action for a policy violation owner when acting on an individual Account Policy violation. In IdentityIQ, a policy violation owner is expected to resolve or manage the violation through violation-handling actions such as allowing, mitigating, remediating, forwarding, or otherwise taking governance action depending on configured permissions and workflow. Exporting or importing CSV files is an administrative or bulk-data activity, not a violation-disposition action. An Account Policy violation normally relates to a condition such as a user having more accounts than permitted on an application or system. The Word bank describes Account policies as policies that limit the number of accounts users may have on a given system. Acting on that violation requires a compliance decision or remediation path, not a CSV operation. Therefore, this proposed solution is not a valid policy-violation owner action. References/topics: IdentityIQ Engineer — Compliance Manager, policy violations, Account Policy, violation remediation, policy owner actions.

The best policy types for defining each access policy are as follows:

Users cannot be members of the AccountsPayable group in AD and have the CreateVendor access right in the Vendor System application at the same time.Answer: Entitlement SOD

This policy deals with conflicting access rights at the entitlement level (i.e., group membership and specific access rights). " Entitlement Separation of Duties " (SOD) ensures that users don ' t have access to conflicting entitlements.

Users can have two accounts on a given system, but no more.Answer: Account

This policy pertains to the number of accounts a user can have on a system. The " Account " policy type manages restrictions on how many accounts users can possess.

Users who have either the VPN role or the Travel role cannot also be in the Contractor role.Answer: Role SOD

This policy involves conflicting roles. " Role Separation of Duties " (Role SOD) ensures that users cannot have conflicting roles, such as VPN and Contractor, or Travel and Contractor.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Entitlement SOD: This policy prevents users from having conflicting access rights. In this case, being in the AccountsPayable group while also having access to create vendors creates a potential conflict. IdentityIQ uses Entitlement SOD to handle these scenarios by preventing such combinations of entitlements.

Account: This type of policy limits the number of accounts users can have on a given system. By setting up an Account policy, IdentityIQ ensures that a user cannot exceed the set number of accounts (e.g., two accounts on a system).

Role SOD: When dealing with conflicting roles (such as VPN or Travel role conflicting with a Contractor role), Role SOD policies ensure that users do not end up in roles that violate governance or security policies. This type of policy ensures role-based access conflicts are mitigated in IdentityIQ.

SailPoint IdentityIQ Compliance Manager Guide (section on defining and managing Separation of Duties (SOD) policies).

Yes. CertificationItem is one of the IdentityIQ object areas that can be extended to store client-specific data through the supported extended-object/Hibernate mapping approach. The purpose of updating a corresponding .hbm file is to introduce persistent custom columns or mapped properties into the IdentityIQ database model. For certification use cases, client-specific data may need to be stored with review items, such as additional context, classification values, remediation metadata, or custom review attributes. The extension process must not stop at editing the mapping file. The Word bank’s schema-extension process describes the broader pattern: update the Hibernate mapping, generate the schema update script, apply the script to the IdentityIQ database while the application server is stopped, then start the application server and update the corresponding ObjectConfig. Therefore, CertificationItem is a valid object for this proposed extension approach, provided the engineer follows the full supported schema-extension process. References/topics: IdentityIQ Engineer — object extension, CertificationItem, Hibernate mapping, extended schema, ObjectConfig.

This statement is correct. The IdentityIQ rule editor is designed to assist engineers when writing BeanShell rules by exposing rule-context information, including available arguments/input variables for the selected rule type. In the editor, variables shown in the arguments list are not decorative; they represent objects or values IdentityIQ makes available to the rule at runtime. Being able to insert an input variable by interacting with the argument list is consistent with the purpose of the rule editor: helping the developer use the correct variable names and avoid spelling or context mistakes. This is especially important because rule arguments differ by rule type. A correlation rule, provisioning rule, workflow rule, and certification rule may each expose different variables. The proposed solution is therefore valid because the Rule Editor can use the rule registry metadata to present available arguments and support insertion into the BeanShell source. References/topics: IdentityIQ Engineer — BeanShell Rule Editor, rule arguments, Rule Registry, input variables, rule development tooling.

Yes, the statement is true. When editing a step in the Business Process Editor in SailPoint IdentityIQ, the available step actions are Script, Rule, Subprocess, and Call Method. These actions allow for various types of logic and processing to be embedded within workflows. Each of these actions serves different purposes:

Script: Executes a Beanshell script.

Rule: Calls an existing IdentityIQ rule.

Subprocess: Invokes another workflow as a subprocess.

Call Method: Invokes a method on a specified object.

SailPoint IdentityIQ Business Process Editor Guide

SailPoint IdentityIQ Administration Guide (Section on Workflow Management)

In SailPoint IdentityIQ, certain objects are designed to be extended by updating their corresponding Hibernate Mapping (.HBM) files. However, the WorkItem object is not one of these extendable objects. The WorkItem is a system object that primarily represents tasks or actions that need to be processed within the workflow. It is not intended to store client-specific data through direct modification of its .HBM file. Instead, client-specific data should be handled using other mechanisms, such as custom attributes or the extension of Identity or Account objects. Attempting to modify the WorkItem object ' s HBM file could lead to unexpected behavior and is not supported by SailPoint ' s best practices.

No. The Provisioning area of the Administrator Console is focused on provisioning transactions , not on providing the current connector/application connection-health status for the associated target application.

A provisioning transaction can provide information about the access request and its processing state—for example whether provisioning is pending, completed, failed, or otherwise awaiting processing. Engineers can use transaction information to investigate provisioning behavior and determine which application and operations are involved. That is not equivalent to displaying whether the underlying application connector is presently connected or healthy.

Application connectivity is investigated through application configuration/testing and the relevant application or connector diagnostic mechanisms. A transaction can fail because of connectivity, authentication, connector configuration, target-system errors, invalid data, workflow problems, or many other causes. Consequently, the transaction state cannot simply be interpreted as the application ' s connection status.

The distinction is tested directly by this DOMC proposition: provisioning transaction monitoring and application connectivity monitoring are separate administrative functions.

References/topics: IdentityIQ Engineer — Administrator Console, Provisioning Transactions, Application connectivity testing, connector troubleshooting, provisioning status.

=======

No. IdentityIQ does not require a dedicated Catch step to accompany every individual workflow step capable of throwing an exception. Such a requirement would make workflows unnecessarily verbose and would not reflect normal workflow exception-handling design.

Workflow steps can execute scripts, rules, subprocesses, methods, approvals, and other operations, many of which can theoretically throw runtime exceptions. Exception handling can be designed at an appropriate level depending on the workflow ' s requirements. BeanShell logic can explicitly use exception handling where necessary, subprocess behavior can be handled by the calling process, and workflow-level failure processing can deal with unhandled exceptions.

A Catch construct is useful when the workflow needs to intercept a particular failure and intentionally route execution into recovery, cleanup, notification, auditing, or another controlled path. It is therefore an exception-handling mechanism , not a mandatory companion to every potentially failing step.

The Word bank already tests other workflow-step semantics, including the available Script, Rule, Subprocess, and Call Method actions; those are separate concepts from mandatory exception handling. The universal wording “must accompany every step” makes this proposition false.

References/topics: IdentityIQ Engineer — workflow step types, exception handling, Catch processing, BeanShell exceptions, subprocess failure handling, workflow error paths.

The scenario describes triggering a workflow when a " Division " attribute changes from a specific value to " Senior IT, " but only when the user is a manager. The proposed solution suggests creating a trigger with an event type of " rule " that checks the previous and new values of the " Division " attribute.

However, this approach has a couple of issues:

Trigger Configuration: In SailPoint IdentityIQ, a lifecycle event trigger typically operates on changes in identity attributes, but it’s not standard to define this trigger using a rule that directly inspects the previous and new values. Instead, the lifecycle event would usually be configured in the context of the application or identity to directly listen to specific changes without needing to define the logic in a custom rule.

Condition Validation: The condition of checking if the user is a manager should ideally be integrated within the workflow itself or the lifecycle event configuration, not just as part of a rule in the trigger.

While a rule can be used to define complex conditions, the correct way to implement this in IdentityIQ would involve setting up the lifecycle event trigger specifically for the attribute change and managing any additional conditions (like checking if the user is a manager) within the workflow or using an appropriate script/rule in that context.

Therefore, while partially correct in approach, the described solution is not the best practice or a valid process in IdentityIQ, so the correct answer is B. No.

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.

Specifying account correlation using a rule cannot be performed using the Rapid Setup application onboarding process. Rapid Setup is designed for straightforward and simplified onboarding processes with a focus on quick configuration, typically using predefined templates and options. However, advanced configurations like custom account correlation rules require more detailed setup, typically done outside of the Rapid Setup UI, involving scripting or detailed configuration within the application definition.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Application Onboarding Sections)

Yes. In IdentityIQ workflow processing, a wait step is not simply a client-side pause or a frozen browser session. The workflow case is persisted and resumed after the wait condition has elapsed and the maintenance process revives eligible workflow cases. A wait= " 1 " attribute represents a minimum wait period, and the workflow does not necessarily resume at the exact instant the wait expires. It resumes when IdentityIQ’s background maintenance processing detects that the wait period is over and advances the workflow. That is why the wording says “at least one minute” and “on the next run of the Perform Maintenance Task.” This distinction matters operationally: workflow timing depends on both the configured wait value and the maintenance task schedule. Engineers should not use wait steps when exact real-time execution is required. References/topics: IdentityIQ Engineer — workflow wait attribute, persisted workflow cases, Perform Maintenance task, background workflow resumption, workflow step behavior.

This is a valid step. To create a custom audit event in IdentityIQ, the event/action must be registered so the audit framework recognizes it. Adding an AuditAction entry in the AuditConfig object XML is the correct type of configuration because it defines the audit action name, display name, and enabled state. The name value is the internal audit action identifier that code, rules, workflows, or tasks can use when writing audit records. The displayName provides the readable label, and enabled= " true " allows the event to be captured. This step alone is not the entire solution because the engineer must also write logic to create the audit record and configure a report to query and display it. However, the question asks whether this is one of the required steps, and it is. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction XML, custom audit actions, audit event enablement, audit report setup.

This statement is false. BeanShell rules in IdentityIQ do not universally have to produce a meaningful output. A rule’s expected return behavior depends on the rule type and the context in which the rule is executed. Some rules are designed to return a Boolean, String, Map, ProvisioningPlan, Identity, or another object. Other rules perform side effects, such as modifying a plan, transforming values, logging, altering an object, or executing validation logic, and may return null or no useful result. The Word bank contains a related but different rule-output concept: a BeanShell rule does not always need to return an object derived from sailpoint.object.SailPointObject; it may return several other object types or null. The proposed statement is even broader and still incorrect because IdentityIQ rule output is rule-type dependent, not mandatory in a generic sense. References/topics: IdentityIQ Engineer — BeanShell rules, rule registry, return values, rule execution context, input/output contracts.

The workflow transition condition shown in the image is Transition to= " Approve " when= " identityName != null " . This condition checks whether the identityName variable is not null. In the provided scenario, the identityName variable has a value of " Catherine.Simmons, " which is clearly not null. Therefore, the condition for transitioning to the " Approve " step will evaluate as true, meaning the workflow will indeed continue to the " Approve " step.

However, it seems like the question might be worded incorrectly as it asks if the workflow will continue to the " Approve " step when it actually will. If this was an error and the intention was to determine if it should not continue, the answer would have been " No. " But based on the logic, the workflow will continue to the " Approve " step.

SailPoint IdentityIQ Workflow Documentation

SailPoint IdentityIQ Scripting Guide (Conditions and Transitions in Workflows)

Yes, defining account correlation via a rule is an action that can be performed as part of configuring an application definition in SailPoint IdentityIQ. Account correlation rules are often used to determine how accounts from different sources are linked to identities within IdentityIQ. These rules allow for complex logic to be applied when matching accounts to identities, beyond simple attribute matching.

SailPoint IdentityIQ Administration Guide (Section on Account Correlation)

SailPoint IdentityIQ Application Configuration Guide (Using Rules for Account Correlation)

time → show how much time a command takes to run

source → execute a file of commands

run → launch a background task

import → import objects from a file

This solution correctly addresses the client ' s requirement. By setting the membership match list to " All " and configuring " Who can members request for? " as " share attributes with the requester, " with the attribute set to location, the system ensures that users in the " Management " workgroup can only request roles and entitlements for other users who share the same location. This setup effectively filters based on the location attribute, aligning with the client ' s needs.

No. The statement is too broad and is incorrect specifically in the context of IdentityIQ Syslog events . IdentityIQ differentiates between normal Log4j logging and SyslogEvent records. Log4j can write ordinary application logging to configured log files, but IdentityIQ ' s higher-severity Syslog events are persisted in the IdentityIQ database so that they can be searched through Advanced Analytics and inspected through IdentityIQ administrative/debug functionality.

SailPoint documents that WARN, ERROR, and FATAL events can be stored in the IdentityIQ database. Lower-level events can instead be handled by Log4j when configured and are not necessarily persisted to the Syslog database table. SailPoint operational guidance further identifies spt_syslog_event as the database table containing persisted Syslog events.

Therefore, saying that IdentityIQ logging events are stored in a flat file instead of a database incorrectly collapses two separate logging mechanisms. Some Log4j output can certainly be file-based, but IdentityIQ SyslogEvent storage includes database persistence.

References/topics: IdentityIQ Engineer — SyslogEvent, Advanced Analytics Syslog Search, spt_syslog_event, Log4j, troubleshooting and logging architecture.

=======

Owner is a required and important application configuration element in IdentityIQ. Application ownership establishes accountability for the connected system and is used across governance operations such as access reviews, application owner certifications, approval routing, policy handling, and administrative responsibility. IdentityIQ’s governance model depends heavily on ownership metadata because applications are not merely technical connector records; they are governed objects. Assigning an owner allows IdentityIQ to determine who is responsible for application access, certification decisions, and operational oversight. While some low-level object imports may technically create incomplete objects, from the application setup perspective an engineer should treat Owner as required. Without an owner, downstream governance functions become weak or ambiguous because IdentityIQ cannot reliably route application-specific reviews or approvals to the responsible business or technical authority. The proposed option is therefore valid as a required setup item. References/topics: IdentityIQ Engineer — application definition, application owner, governance accountability, certification ownership, access approval routing.

In SailPoint IdentityIQ, certain objects, such as the Link object, cannot be directly extended by updating the corresponding .HBM (Hibernate Mapping) file. Modifying or extending core IdentityIQ objects typically requires a deeper level of customization involving the extension of the application schema and possibly custom Java code. The .HBM files are part of IdentityIQ ' s internal persistence framework, and altering them is not a supported or recommended method for extending objects in a production environment. Customization should instead be done using SailPoint’s supported extension points, such as using ManagedAttributes or CustomAttributes within the IdentityIQ application framework. For guidelines on extending IdentityIQ objects, refer to the SailPoint IdentityIQ Customization Guide and best practices documentation.

Top of Form

Bottom of Form