SailPoint IdentityIQ-Associate SailPoint Certified IdentityIQ Associate Exam Exam Practice Test

Yes. Rapid Setup in SailPoint IdentityIQ is designed to accelerate application onboarding by creating and configuring the application definitions required for IdentityIQ to manage data from connected systems. An application definition is the IdentityIQ object that represents an external source or target system and stores the connector selection, connectivity settings, schema information, aggregation behavior, correlation configuration, and related governance options.

Rapid Setup reduces the amount of manual configuration normally required when defining applications. Instead of building every application definition entirely through the standard detailed configuration screens, Rapid Setup guides the administrator through a simplified setup path and creates the required IdentityIQ application objects from that configuration. Those application definitions can then be used for aggregation, correlation, entitlement discovery, access modeling, and downstream governance processes.

This does not mean Rapid Setup eliminates the need for validation. Administrators must still verify schemas, correlation rules, entitlement treatment, and provisioning behavior. However, the statement is accurate because creating application definitions is a core function of Rapid Setup.

Reference topics: Applications, Rapid Setup, application definitions, connector configuration, schema configuration, aggregation, correlation, and entitlement discovery.

The statement is false. In SailPoint IdentityIQ, connectivity settings are determined by the connector selected for the application definition. An application represents an authoritative source, target system, or managed resource, and the connector defines how IdentityIQ communicates with that system. Because different connectors use different communication models, their required configuration fields are not universal.

For example, an LDAP or Active Directory connector commonly requires server connection details such as host, port, credentials, and search base configuration. A JDBC-based connector may require a JDBC URL, driver class, database credentials, and SQL-related configuration. A delimited file connector does not require a hostname because it reads account and entitlement data from a file location rather than connecting to a network service. Similarly, cloud or API-based connectors may require endpoint URLs, tokens, client credentials, or tenant-specific settings instead of a simple hostname field.

Therefore, hostname cannot be considered a required connectivity setting for every connector type. Required settings are connector-dependent and appear according to the selected connector’s configuration model. Reference topics: Applications, connector selection, application definition, connector-dependent settings, schema configuration, and aggregation prerequisites.

Detecting and addressing inappropriate access is a core purpose of Identity Governance and Administration in SailPoint IdentityIQ. IdentityIQ is designed to provide visibility into who has access, what access they have, how that access was obtained, whether it is appropriate, and what corrective action should occur when access violates business or security policy. Inappropriate access may be identified through access certifications, policy violations, role analysis, entitlement review, account aggregation, and identity correlation.

IdentityIQ supports this purpose by building IdentityCubes that consolidate identity, account, entitlement, role, and manager data from connected applications. Once access is visible, governance controls such as certifications allow managers, application owners, or entitlement owners to approve, revoke, or delegate access decisions. Policies can also detect toxic combinations, prohibited access, or access inconsistent with business rules. Remediation can then be routed through provisioning, work items, or manual fulfillment processes.

Therefore, the statement aligns directly with IGA and IdentityIQ’s identity security model. Reference topic: Foundational Concepts — purpose of identity security; also related to Governance — certifications, policy detection, and remediation.

The statement is false. In SailPoint IdentityIQ, groups and populations are used to classify, filter, and organize identities for governance, reporting, certifications, and targeted user experiences. A population is a defined collection of identities, and group factories can dynamically create identity groups based on configured identity attributes. These constructs are useful for segmentation, analysis, and campaign targeting, but they are not the standard objects assigned as owners of IdentityIQ objects.

Ownership in IdentityIQ is normally assigned to an identity or to a workgroup. A workgroup is used when ownership or responsibility must be shared by multiple users, such as application owners, certification owners, entitlement owners, or approval groups. This distinction matters because ownership drives accountability, work item assignment, approvals, escalations, and administrative responsibility. Populations and generated groups do not function as accountable owners in the same way workgroups do.

Therefore, while groups and populations can influence governance scope and visibility, they are not assigned as object owners. Reference topics: Identity Modeling — groups and populations; Foundational Concepts — common objects and usage; Governance — ownership, certifications, and work item responsibility.

No. The “Detect deleted accounts” aggregation task option is not used to ignore accounts that were previously deleted from IdentityIQ. Its purpose is to compare the accounts returned by the current aggregation with the accounts already stored in IdentityIQ for that application. When an account exists in IdentityIQ but is no longer found in the authoritative aggregation results from the source application, IdentityIQ can treat that account as deleted or removed from the target system.

This option helps keep IdentityIQ’s account inventory accurate by identifying stale Links that remain in IdentityIQ even though the corresponding account is no longer present on the application. It is especially important for governance accuracy because certifications, policy checks, identity warehouse views, and access reporting rely on current account and entitlement data.

The statement is incorrect because it reverses the behavior. Detecting deleted accounts is about recognizing accounts missing from the source during aggregation, not ignoring newly returned source accounts that were once deleted in IdentityIQ.

Reference topics: Applications, aggregation task options, account aggregation, deleted account detection, Link maintenance, IdentityCube account data, and application data reconciliation.

The statement is true. In SailPoint IdentityIQ, identity attributes are stored on the IdentityCube and represent normalized information about a user. These attributes describe the identity at the governance level rather than describing a single account on a connected application. Common examples include first name, last name, email, department, location, job title, employee number, manager, lifecycle state, and status.

Identity attributes are important because IdentityIQ uses them throughout identity governance processes. They support identity correlation, manager correlation, certification scoping, policy evaluation, role assignment, lifecycle events, access request routing, reporting, and population or group membership. Identity attributes may be sourced from an authoritative application, derived from account data, calculated through rules, or refreshed through Identity Refresh processing.

This differs from account attributes, which are defined in an application account schema and belong to a specific application account link. Identity attributes provide the consolidated user profile that IdentityIQ uses to make governance decisions.

Reference topics: Identity Modeling — IdentityCubes, identity attributes versus account attributes, manager correlation, Identity Refresh options.

The statement is false. Preventive policy checking in SailPoint IdentityIQ is not limited only to self-service requests. Preventive policy evaluation is used to identify policy violations before access changes are completed. This can occur during access request processing, provisioning-related activity, or other configured request paths where IdentityIQ evaluates proposed changes against defined policies before allowing the transaction to proceed.

A self-service request is only one possible entry point. IdentityIQ access requests may be submitted by an end user, a manager, an administrator, or another authorized requester depending on QuickLink Population rules, request configuration, and access-request permissions. Preventive policy checking evaluates the requested access change itself, not merely the fact that the request was self-initiated. If the proposed access would violate a separation-of-duty, risk, or other governance policy, IdentityIQ can warn, require additional handling, or block the request depending on policy and workflow configuration.

Therefore, the word “only” makes the statement incorrect. Preventive policy checking is a governance control applied to configured access-change activity, not exclusively to self-service actions. Reference topics: Governance, policy detection, preventive policy checking, access request policy evaluation, User-Driven Requests, and provisioning request control.

The statement is true. In SailPoint IdentityIQ, groups and populations are identity-segmentation mechanisms used to define sets of identities that share specific characteristics. A population is typically a saved collection of identities based on search criteria or defined membership logic. A group factory can dynamically generate identity groups based on identity attributes, such as department, location, cost center, job title, or business unit.

These constructs are useful because many IdentityIQ operations should not apply to the entire identity population. They allow administrators to scope or target actions to the relevant identities only. For example, populations and groups can support targeted reporting, focused analysis, certification scoping, and other governance activities where only a defined subset of identities should be included. This improves accuracy, reduces review noise, and aligns governance activity with business structure.

They should not be confused with ownership objects such as workgroups. Their primary purpose is identity grouping and operational targeting, not shared ownership accountability.

Reference topics: Identity Modeling — groups and populations; Governance — certification targeting and reporting scope; Foundational Concepts — business modeling and identity segmentation.

No. An Identity Cube is not an IdentityIQ account. In SailPoint IdentityIQ, the Identity Cube is the central identity record that represents a person or identity being governed by the platform. It consolidates identity attributes, correlated application accounts, account links, entitlements, assigned roles, detected roles, manager relationship, lifecycle state, policy violations, and other governance-relevant information.

An “IdentityIQ account” usually refers to a login account or user object that allows someone to access the IdentityIQ application itself. That is different from the Identity Cube, which is used to model the user’s enterprise identity and access across connected systems. For example, one Identity Cube may contain links to multiple accounts such as Active Directory, Workday, ServiceNow, database accounts, and cloud application accounts.

Therefore, the proposed definition is inaccurate because it confuses an application login account with the broader identity model used for governance. Reference topics: Identity Modeling, IdentityCube contents, identity attributes, application account links, entitlements, roles, manager correlation, and Identity Warehouse.

The statement is true. In SailPoint IdentityIQ, account attributes are defined on the application’s account schema. The application definition tells IdentityIQ how to represent accounts from a connected source, and the account schema specifies which attributes exist on those accounts. Examples may include account ID, display name, email, status, department, groups, roles, permissions, or other source-specific fields returned by the connector during aggregation.

This is distinct from identity attributes, which are stored on the IdentityCube and represent normalized identity-level data used across IdentityIQ. Account attributes belong to application account links, while identity attributes belong to the identity model. During aggregation, IdentityIQ reads account data according to the application schema and stores the discovered values as account/link attributes. Some account schema attributes may also be marked as managed when their values represent entitlement-like access that should be governed through the Entitlement Catalog.

Therefore, account attributes are correctly defined in the application account schema. Reference topics: Applications — application definitions, account schema attributes, schema attribute properties; Identity Modeling — identity attributes versus account attributes; Access Modeling — managed attributes and entitlement catalog.

This is not a correct example of an IdentityIQ policy as stated. IdentityIQ policies are used to detect governance violations based on identity, account, entitlement, role, risk, or activity conditions. An account policy is concerned with whether an identity has an account, lacks a required account, or has an account that violates defined account-related criteria. It evaluates existing identity and account state after data is aggregated and correlated into IdentityIQ.

The phrase “has requested the appropriate account” describes an access request validation concept rather than a policy-detection use case. Requests are handled through the user-driven request and provisioning framework, including QuickLinks, request forms, approvals, workflows, provisioning policies, and provisioning plans. A request can be evaluated, approved, rejected, or fulfilled, but a governance policy is normally not defined to determine whether a request itself was “appropriate.”

IdentityIQ policies detect violations against current or observed access conditions. Therefore, an account policy may check whether an identity has an inappropriate account, but not whether the identity requested the appropriate account. Reference topics: Governance — common policy examples and policy detection; User-Driven Requests — access requests; Provisioning — provisioning process and provisioning policies.

The statement is not technically accurate. In SailPoint IdentityIQ, applications are defined to represent external systems, platforms, directories, databases, or resources from which account, group, entitlement, and attribute data are aggregated, and in some cases to which provisioning changes are written. IdentityIQ does not generally “read identities” directly from applications. Instead, it reads account records and associated attributes from applications, then uses identity correlation, authoritative-source logic, and identity refresh processing to construct or update IdentityCubes.

This distinction is fundamental. An application may be an authoritative source, such as an HR system, where account attributes contribute heavily to identity creation and lifecycle state. However, the object read from the source is still an account or source record, not an IdentityIQ identity object. The identity is modeled inside IdentityIQ after aggregation and correlation occur.

Therefore, the more precise statement is that applications represent systems from which IdentityIQ reads account and access data, not systems from which IdentityIQ simply reads identities. Reference topics: Applications, application definition, account aggregation, authoritative applications, correlation, IdentityCube creation, and Identity Modeling.

Yes. In SailPoint IdentityIQ, the Active period is the main review window of a certification campaign. During this period, assigned certifiers review the certification items and make access decisions such as approve, revoke, delegate, allow exception, or otherwise act according to the certification configuration. This is the required operational phase in which reviewers complete their access review responsibilities before the certification moves into later lifecycle stages.

The Active period is distinct from other certification timing or processing stages. For example, generation prepares the certification contents, while challenge and remediation periods may occur after reviewer decisions depending on campaign configuration. The Active period specifically represents the time when certification decisions are expected to be made by the responsible reviewers.

Therefore, the definition is accurate because it correctly identifies the Active period as the required review period for certification decision-making. Reference topics: Governance, access reviews, certification lifecycle, Active period, certification decisions, certifier work items, challenge period, remediation, and certification sign-off.

No. QuickLink Populations do not control which capabilities are granted to an identity. In SailPoint IdentityIQ, capabilities are administrative permission sets assigned to identities to determine what system-level functions they can perform, such as administration, certification management, report access, or other privileged IdentityIQ operations. Capabilities are part of the identity’s authorization model and are managed separately from QuickLink Population configuration.

QuickLink Populations serve a different purpose. They determine which QuickLinks are visible and usable for a defined population of users, and they can also influence request behavior such as who may perform a request, what actions are available, and for whom the request may be submitted. For example, a QuickLink Population may allow certain users to request access for themselves, request access for others, edit identities, or initiate password-related actions, depending on configuration.

Therefore, QuickLink Populations control access to request actions and QuickLink availability, not the granting of IdentityIQ capabilities themselves. Reference topics: User-Driven Requests, QuickLink Populations, identity authorization, capabilities, access request configuration, and self-service request controls.

The statement is true. In SailPoint IdentityIQ, account correlation is the process used to associate an application account, represented as a Link, with the appropriate IdentityCube. Correlation logic is configured on the application and may use account attributes, identity attributes, or correlation rules to determine ownership. When that logic is changed, a subsequent account aggregation can evaluate account data against the updated correlation configuration and adjust account-to-identity associations where the aggregation process is configured to perform correlation.

This is important when accounts were previously uncorrelated, incorrectly correlated, or correlated under outdated matching criteria. For example, if an application originally correlated accounts by user name but is later changed to correlate by employee ID, aggregation can apply the new logic so that accounts align with the correct identities. Manual correlation is therefore not the only remediation path; proper correlation configuration followed by aggregation is a standard way to resolve or correct account ownership.

The behavior depends on the aggregation and correlation configuration, but the principle is accurate: aggregation can apply changed correlation logic to account correlations. Reference topics: Applications, correlation options, account aggregation, uncorrelated account resolution, Link-to-IdentityCube association, and Identity Modeling.

No. This definition describes a rule more closely than an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the centralized identity model that represents a person or non-person identity inside IdentityIQ. It contains consolidated identity information such as identity attributes, correlated application accounts, assigned and detected roles, entitlements, manager relationship, lifecycle state, policy violations, certifications, and other governance-relevant data.

A “snippet of code containing custom business logic” refers to a BeanShell rule. Rules are executable logic used to customize IdentityIQ behavior in areas such as aggregation, correlation, provisioning, policy evaluation, workflow processing, and identity attribute transformation. They are configuration objects containing code, while Identity Cubes are data/model objects representing identities and their access.

Therefore, the statement is inaccurate because an Identity Cube is not custom code. It is the core identity record used by IdentityIQ for governance, access modeling, policy detection, requests, certifications, and provisioning decisions.

Reference topics: Identity Modeling, IdentityCube contents, identity attributes, correlated accounts, roles and entitlements, BeanShell rules, Foundational Concepts, and IdentityIQ object model.

Defining corporate reporting hierarchies is not a primary purpose of Identity Governance and Administration. In SailPoint IdentityIQ, reporting hierarchy data is typically consumed from an authoritative source, such as an HR system, rather than created as the central objective of IGA. IdentityIQ may use manager relationships for identity correlation, access reviews, approval routing, escalation, lifecycle processing, and certification ownership, but the system’s purpose is not to design or maintain the enterprise organizational chart.

IGA focuses on identity security outcomes: determining who users are, what access they have, whether that access is appropriate, how access was granted, and how inappropriate or risky access should be remediated. Manager and reporting-line data supports these controls, but it is supporting identity context, not the governance objective itself.

For example, a manager attribute may be used during Identity Refresh, certification generation, or access request approval. However, the business function of defining the reporting hierarchy normally remains with HR or organizational management systems.

Reference topics: Foundational Concepts — purpose of identity security; Identity Modeling — manager correlation and IdentityCube attributes; Governance — certification ownership and approval routing.

No. This statement does not accurately describe role acquisition in IdentityIQ. Business roles are not restricted to being requested only by managers. In IdentityIQ, roles may be acquired through role assignment logic, role detection, access requests, or administrative action, depending on the role configuration and the organization’s request model.

A business role commonly represents access associated with a business function, job, department, location, or organizational responsibility. Users may receive business roles automatically when their identity attributes satisfy configured role profiles or assignment rules, typically recalculated during Identity Refresh. Separately, roles may be made requestable through Lifecycle Manager and exposed through QuickLinks, where request eligibility is controlled by QuickLink Populations, request configuration, and workflow rules.

Managers may be allowed to request roles for direct reports, but that is only one possible configuration. IdentityIQ can also allow users to request roles for themselves, allow delegated requesters to request for others, or restrict requests to specific populations.

Therefore, “only requested by managers” is too narrow and incorrect. Reference topics: Access Modeling, business roles, role assignment, role detection, Identity Refresh, User-Driven Requests, QuickLink Populations, and role request configuration.

The statement is false. In SailPoint IdentityIQ, the Application Name is a logical identifier used to label and distinguish the application object inside IdentityIQ. It does not determine which connector the application uses. The connector is selected separately as part of the application configuration, and that connector selection determines the available connection parameters, supported operations, schema behavior, aggregation capabilities, and provisioning capabilities.

For example, an application could be named “HR System,” “Active Directory,” or “Corporate Accounts,” but the name itself does not cause IdentityIQ to use an LDAP, JDBC, Delimited File, Web Services, or other connector. The selected connector type defines how IdentityIQ communicates with the source or target system. It also influences whether the application can aggregate accounts, discover schema, manage groups, perform provisioning, or write changes back to the managed system.

Therefore, the application name is descriptive metadata, while the connector type is the technical integration mechanism. Reference topics: Applications, application definition, connector selection, connector-dependent settings, schema configuration, aggregation, and provisioning support.

Yes. The Identity Warehouse in SailPoint IdentityIQ is used to display identity-centered information from the IdentityCube and related IdentityIQ object relationships. In addition to core identity attributes, accounts, roles, entitlements, manager relationships, and direct reports, IdentityIQ can show objects for which the identity is designated as the owner. Ownership is an important governance concept because owners may be responsible for approving access, maintaining roles, reviewing entitlements, managing applications, or participating in certification and remediation processes.

An object owner in IdentityIQ may be associated with configurable objects such as roles, applications, managed attributes, policies, or other governance-related items. Displaying owned objects from the identity view helps administrators and governance users understand the responsibilities assigned to that identity, not just the access held by the identity. This distinction matters because IdentityIQ models both “what access the identity has” and “what governance responsibilities the identity owns.”

Therefore, a list of objects the user owns is appropriately displayed in the Identity Warehouse when ownership relationships exist and the viewer has sufficient permission. Reference topics: Identity Modeling, IdentityCube contents, Identity Warehouse, object ownership, manager relationships, and governance responsibility modeling.

The statement is accurate. In SailPoint IdentityIQ LifeCycle Manager, the Manage Accounts feature is used for account-level request operations. It allows authorized users to request account changes on connected applications, including requesting an additional account when the target application and IdentityIQ configuration support multiple or additional accounts for the same identity.

This capability is controlled through the application definition, request configuration, QuickLink availability, provisioning policies, and workflow approvals. When an application supports additional accounts, IdentityIQ can present account-request options that allow the requester to create another account rather than only modifying or removing an existing one. The request is then converted into a provisioning plan, routed through configured approval logic, and fulfilled either automatically through the connector or manually through a work item.

This is different from requesting entitlements alone. Manage Accounts focuses on account lifecycle operations such as create, modify, delete, enable, disable, or unlock, depending on connector and application support. Therefore, allowing users to request additional accounts on applications configured to support them is a valid Manage Accounts function.

Reference topics: User-Driven Requests — account request types and operations; Provisioning — provisioning plans and provisioning policies; Applications — application configuration and connector support.