SailPoint IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Exam Practice Test

No, the " Email Protocol " is not a setting that an engineer must set up to ensure successful communication with the SMTP server. Instead, the essential settings include the mail server address, port, authentication details (like username and password if required), and possibly the security settings (such as SSL/TLS). While the email protocol (e.g., SMTP) is implicitly involved, it is not a specific setting that needs to be configured separately within IdentityIQ. The critical setup revolves around configuring the mail server connection parameters.

SailPoint IdentityIQ Configuration Guide (Email and Notification Settings)

SailPoint IdentityIQ Administration Guide (SMTP Configuration for Email Notifications)

No. IdentityIQ report results are not simply stored as files on the application servers as a universal rule. IdentityIQ is a database-backed governance platform, and generated report metadata/results are associated with task/report result objects and persisted through the platform’s data model. While report exports or generated files may be downloaded or temporarily handled by the application server at runtime, the statement “all report results are stored on IdentityIQ application servers” is technically inaccurate. In clustered deployments, relying on local application-server storage for all report results would also be problematic because multiple application servers may serve the same IdentityIQ environment. IdentityIQ centralizes configuration, task history, report metadata, identities, applications, and governance objects through its database-backed object model. Therefore, the correct understanding is that reports are run by the IdentityIQ task/reporting framework and report result information is managed by IdentityIQ, not universally stored as local application-server files. References/topics: IdentityIQ Engineer — reporting architecture, task results, report instances, application server versus database persistence.

No. SailPoint XML objects must be imported through IdentityIQ ' s supported object-import mechanisms, not inserted into IdentityIQ by using a SQL database-management utility.

IdentityIQ XML represents application-level SailPoint objects such as Rules, Workflows, Applications, TaskDefinitions, EmailTemplates, Bundles, Policies, and configuration objects. Importing these objects through IdentityIQ ensures that the XML is parsed according to the SailPoint object model and that object identifiers, references, persistence behavior, and associated processing are handled by the IdentityIQ application layer.

SailPoint officially supports importing files through Global Settings > Import From File and also supports XML import through the IdentityIQ console using the console import functionality. The existing bank already contains the latter approach as a valid proposition.

Direct SQL insertion bypasses the application/object persistence layer and risks creating malformed records, missing relationships, inconsistent identifiers, or cache inconsistencies. WEB-INF/database and database-management tools are used for database schemas/scripts, not for treating SailPoint object XML as ordinary database rows.

References/topics: IdentityIQ Engineer — XML import, Import From File, IIQ console, SailPointObject persistence, configuration migration.

=======

Yes. In IdentityIQ, a ManagedAttribute represents managed entitlement metadata associated with an application attribute/value, and it can have an Identity object assigned as its owner . Ownership is an important governance property because the entitlement owner can participate in approval routing, certifications, access-request decisions, remediation, and general accountability for the managed access.

This does not mean every ManagedAttribute is automatically owned by an Identity, nor does it mean its owner must be the same identity that owns the associated Application. Application ownership and entitlement ownership are independent governance relationships. For example, an Active Directory application may have one application owner while individual AD groups represented as ManagedAttributes have different business owners.

The wording “can have” is therefore important. IdentityIQ supports an Identity as the owner of the ManagedAttribute. Depending on configuration, ownership can be populated manually, through aggregation/customization, or through entitlement-management processes.

Do not confuse this relationship with the ManagedAttribute ' s required application context: the ManagedAttribute identifies governed access originating from an Application, while its owner identifies responsibility for that access.

References/topics: IdentityIQ Engineer — ManagedAttribute object, Entitlement Catalog, entitlement ownership, Application ownership, approval routing, entitlement certifications.

=======

Yes. Reviewing provisioning transactions and their processing states is a principal purpose of the Provisioning tab in the IdentityIQ Administrator Console. The engineer can use this administrative view to inspect provisioning activity and distinguish transactions according to states such as pending, failed, or completed/successful.

This visibility is particularly important for troubleshooting asynchronous provisioning. A failed transaction may require investigation into connector errors, target-system responses, invalid attribute values, authentication failures, or workflow/provisioning-plan problems. A pending transaction may indicate queued processing or an operation awaiting further execution. Successful transactions provide confirmation and historical visibility into completed processing.

The Provisioning tab is therefore an operational troubleshooting interface for provisioning transactions; it is not merely a configuration page.

This should also be distinguished from another proposition already present in the Word bank: the bank explicitly states that the Provisioning tab can be used to manually retry the provisioning attempt for pending transactions . The video proposition here tests a different capability—viewing transactions across their various states—so it remains a separate DOMC item.

References/topics: IdentityIQ Engineer — Administrator Console, provisioning transactions, failed provisioning, pending transactions, transaction history, provisioning troubleshooting.

=======

Yes, specifying which access items may be requested can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In IdentityIQ, control variables within LCM workflows allow administrators to define the scope and criteria for access requests, including restricting or specifying which entitlements, roles, or applications can be requested by users. This is part of the request configuration process, where the access items that users can see and request are defined.

Therefore, the correct answer is A. Yes.

Yes. A Boolean datatype is appropriate because the stated purpose is to flag privileged accounts . A flag normally represents a binary condition: the account either satisfies the privileged-account criteria or it does not. Consequently, true and false accurately represent the resulting classification.

The engineer can derive this Boolean from the Financial application ' s privileged attribute and/or calculate the result through logic involving the Keystore application ' s responsibility-code attribute. Once populated, the Boolean value can be referenced reliably from rules and policy conditions and can participate in searchable/analytics configuration when the associated attribute is configured appropriately.

This distinction also resolves the earlier Attribute Type: string proposition. A String could technically hold textual values, but the requirement here is specifically a Boolean privilege flag. Therefore, for this DOMC scenario, Boolean is the configuration that matches the requirement , while String should be answered No.

The bank already tests source mapping and edit mode for the same scenario but does not contain this Boolean proposition.

References/topics: IdentityIQ Engineer — account schema, Boolean attributes, privileged-account classification, source mapping, rules, policies.

=======

Yes. Hierarchy is a valid relationship concept for IdentityIQ roles when a role model has a multiple-level structure. IdentityIQ roles are not limited to flat entitlement collections. Role models can be built with layered relationships, where higher-level roles represent broader business access and lower-level roles represent more technical or application-specific access. This is common in mature role-based access control designs: a business role may include IT roles, which in turn may include entitlements or application roles. A hierarchical structure allows organizations to express access in business terms while still mapping that access down to technical resources. The important engineering point is that the role model must be carefully designed to avoid circular dependencies, overbroad inheritance, and difficult certification outcomes. Hierarchical role relationships support maintainable access modeling when used properly, especially in enterprises that are actively using role-based provisioning and role reviews. References/topics: IdentityIQ Engineer — role hierarchy, role relationships, Bundle object, business roles, IT roles, role-based access model.

Allowing a user to create a new identity cube in IdentityIQ is not a scenario that can be achieved through QuickLink populations. QuickLink populations are used to define which users have access to specific QuickLinks or tasks in the IdentityIQ interface. They do not control the creation of identity cubes, which is a function typically handled through the aggregation process, API calls, or specific administrative actions within the IdentityIQ platform. The creation of an identity cube involves data import and transformation processes, not just a UI-level permission.

Therefore, the correct answer is B. No.

Running the command iiq extendedSchema in the IIQ_Home/WEB-INF/bin directory is correct and one of the standard procedures for generating database scripts to extend Application attributes in the IdentityIQ database. This command processes the schema definitions (including any new attributes) and generates the appropriate SQL scripts to update the database schema. These scripts can then be executed against the database to apply the changes.

SailPoint IdentityIQ Administration Guide (Schema Extension and Database Management Sections)

SailPoint IdentityIQ Configuration Guide (Extended Schema Management)

This implementation is correct in structure. The code first resolves the Application object named MagicBox, then creates an IdentityService, then calls service.getLinks(identity, application) to retrieve the account links for that identity on the application. Because the requirement is to return all account names, using getLinks and iterating over the returned List < Link > is the right pattern. Each Link represents an account on an application, and getNativeIdentity() returns the account’s native identifier, which is the account name or unique account key from the target application. The null check prevents a null-pointer issue if no links are returned. In a production-quality version, an engineer might also handle a missing application object and ensure Java collection imports are available, but those do not invalidate the core implementation pattern shown. Compared with the flawed single-link version, this solution correctly handles multiple accounts. References/topics: IdentityIQ Engineer — IdentityService API, Application object lookup, Link collection retrieval, nativeIdentity, BeanShell utility methods.

Yes. The numbered placeholder model used by IdentityExtended.hbm.xml provides ten extended attributes by default—extended1 through extended10—and that numbered set can be expanded through extended20. This requires adding the appropriate property definitions to the extended Hibernate mapping and subsequently applying the corresponding database-schema extension process.

The distinction between numbered placeholder attributes and named attributes using ExtendedPropertyAccessor is important. Twenty is the traditional limit of the numbered SailPointObject extended-property slots; it is not an absolute claim that IdentityIQ can never support additional custom attributes. SailPoint provides ExtendedPropertyAccessor for named extended properties beyond the numbered placeholder model.

The configuration comments associated with IdentityExtended.hbm.xml explicitly state that ten extended attributes are mapped by default and that this can be raised to twenty. They also caution that excessive searchable/indexed attributes can degrade Identity Cube update performance.

Therefore, the proposition is correct specifically for adding further placeholder numbered extended attributes beyond the ten shown, through extended20 .

References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended1–extended20, searchable identity attributes, ExtendedPropertyAccessor, extended schema.

=======

Yes. In the IdentityIQ branding guidance relevant to this certification material, retaining the SailPoint copyright notice is identified as a minimum SailPoint branding requirement . Customers can make substantial user-interface customizations—such as modifying logos, CSS styling, message text, colors, and selected page elements—but the supported branding guidance does not mean all SailPoint product identification may simply be removed.

The copyright notice is treated separately from cosmetic branding elements. The established IdentityIQ branding convention requires the copyright notice to remain in the page HTML and to be displayed throughout the IdentityIQ interface. A related requirement applies when the SailPoint name or logo is removed from the header: product attribution such as “Powered by SailPoint IdentityIQ” must be retained in the copyright footer. The existing question bank also contains that separate product-attribution proposition and marks it as valid.

Accordingly, customization is permitted, but the stated minimum copyright attribution requirement remains valid.

References/topics: IdentityIQ Engineer — UI customization, minimum SailPoint branding requirements, copyright footer, SailPoint product attribution, upgrade-safe branding.

=======

The Rapid Setup user interface configuration options in IdentityIQ can be used to disable an account and remove all its entitlements on a particular application during Leaver events. Rapid Setup is designed to simplify the configuration of common identity lifecycle processes, including handling leaver (termination) events. When configuring these events, you can specify actions such as disabling accounts and removing entitlements from specific applications as part of the termination process.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Lifecycle Manager Guide (Sections on Lifecycle Event Configuration)

HR Role is not a default IdentityIQ role type. IdentityIQ role modeling uses standard role types such as Business Role, IT Role, Application Role, and Composite Role; the Word bank lists those default types and separately notes that a nonstandard label such as Entitlement Role is not a recognized default role type. “HR Role” could exist in a customer environment as a custom role name, a business-role naming convention, or a role representing human resources access, but it is not a default role type in IdentityIQ. The question is not asking whether a role named “HR Role” can be created. It asks whether HR Role is a default type available for manager request during access request. That distinction matters. Managers request role objects configured as requestable, but the role type must be one of the supported model types. Therefore, the proposed solution is invalid. References/topics: IdentityIQ Engineer — role model, default role types, Business Role, IT Role, Application Role, Composite Role, access request configuration.

Creating and loading a Custom Audit Report TaskDefinition XML and corresponding Custom Audit Report Form XML is indeed part of the process for setting up a custom audit report in SailPoint IdentityIQ. The TaskDefinition XML defines the report task, and the Form XML defines the user interface for running the report. These steps are essential to creating a custom audit report, and the solution correctly outlines a valid approach. Refer to the SailPoint IdentityIQ Reporting Guide, particularly the section on creating custom reports and forms, for more detailed instructions.

Yes. A Manager Correlation Rule is specifically intended for situations where IdentityIQ must establish the manager/direct-report relationship but a straightforward attribute-to-attribute mapping is insufficient. In a simple implementation, IdentityIQ can correlate an application attribute containing the manager identifier directly to an identity attribute. Here, however, the organization has inherited several employee-number formats through mergers. That requires normalization, transformation, conditional comparison, or other custom matching logic before the manager identity can be resolved.

SailPoint explicitly documents that Manager Correlation normally uses an application attribute and an identity attribute, but when the matching requirement is more complex than a simple field match, a Manager Correlation Rule can implement the correlation programmatically. The rule can normalize the different employee-number formats, generate appropriate comparison values, search for the matching Identity object, and return the manager relationship required during identity processing. A normal account Correlation Rule addresses account-to-identity correlation and is therefore not the precise rule type for this requirement.

References/topics: IdentityIQ Engineer — Manager Correlation Rule, authoritative-source aggregation, Identity Cube manager relationships, complex correlation logic, Application Definition Rules.

=======

Yes. IdentityIQ stores email templates as IdentityIQ objects, and after installation they can be inspected through the Debug pages as EmailTemplate objects. Email templates define notification content used by workflows, certifications, lifecycle events, approvals, policy violations, provisioning processes, and other system activities. The Debug page allows administrators and engineers to view many persisted IdentityIQ object types directly, including rules, workflows, task definitions, applications, identities, configuration objects, and email templates. This is useful when troubleshooting notification behavior, checking template names, verifying variables used in template content, or confirming whether a customized template exists in the environment. However, editing production templates directly through Debug should be handled carefully and normally controlled through proper change-management practices. The proposed location is technically valid: email templates can be viewed as EmailTemplate objects through the Debug interface. References/topics: IdentityIQ Engineer — EmailTemplate objects, Debug pages, notification configuration, workflow and certification email notifications.

No. Launching certification campaigns is not default Lifecycle Manager functionality. Lifecycle Manager focuses on identity lifecycle and access-request operations such as joiner, mover, leaver processing, access requests, account management, approvals, and provisioning workflows. Certification campaigns belong to IdentityIQ’s access review and compliance/certification capabilities, not LCM’s default functional scope. Certifications are used to review access, roles, entitlements, policy violations, or account/group membership and then require reviewers to approve, revoke, or otherwise act on access. LCM may interact with certification results indirectly because remediation from a certification can trigger provisioning or access changes, but launching the campaign itself is a certification/compliance function. This question tests whether the engineer separates lifecycle-request processing from access-review governance. Mixing them up leads to poor module design and incorrect implementation expectations. References/topics: IdentityIQ Engineer — Lifecycle Manager, access request, provisioning workflows, certification campaigns, Compliance Manager.

The statement suggests moving the XML file into IIQ_HOME/WEB-INF/database as part of the process to import SailPoint XML file objects into IdentityIQ. However, this is not a valid step for importing XML objects.

The correct procedure to import SailPoint XML objects typically involves the following steps:

Use the iiq console command-line tool provided by SailPoint to import the XML file.

The command typically looks like: iiq console import < filename > .xml.

The XML file does not need to be moved to any specific directory like WEB-INF/database for the import process.

Moving the XML file into the WEB-INF/database directory does not align with the documented process and does not facilitate the import. The correct answer is B. No.

The statement is false. In SailPoint IdentityIQ, while message files may indeed be added to support additional languages, the out-of-the-box supplied message files can also be modified. Administrators can customize these message files to adapt the text in the user interface to better suit the organization’s needs. This includes modifying existing translations or adding custom messages to meet specific requirements.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Configuration Guide (Customization of Message Files)

No. The proposed XML is not correct because the reference class is wrong. In IdentityIQ, rule libraries are represented through rule objects used as reusable BeanShell libraries. When a rule references a common library, the referenced object should be a Rule object, not a nonstandard sailpoint.object.RuleLibrary class. The correct pattern is to reference the library as a rule by name under the rule’s referenced-rules section. Rule libraries allow shared methods and reusable code to be included across multiple rules, which is important for reducing duplication and maintaining consistent logic. However, XML object references must use the correct IdentityIQ object class. If the class does not correspond to the persisted object type, the import or runtime resolution can fail. The concept of referencing a common rules library is valid, but this specific code is not. References/topics: IdentityIQ Engineer — Rule libraries, ReferencedRules XML, Rule object references, BeanShell code reuse, XML object configuration.

Yes. In IdentityIQ workflow processing, a wait step is not simply a client-side pause or a frozen browser session. The workflow case is persisted and resumed after the wait condition has elapsed and the maintenance process revives eligible workflow cases. A wait= " 1 " attribute represents a minimum wait period, and the workflow does not necessarily resume at the exact instant the wait expires. It resumes when IdentityIQ’s background maintenance processing detects that the wait period is over and advances the workflow. That is why the wording says “at least one minute” and “on the next run of the Perform Maintenance Task.” This distinction matters operationally: workflow timing depends on both the configured wait value and the maintenance task schedule. Engineers should not use wait steps when exact real-time execution is required. References/topics: IdentityIQ Engineer — workflow wait attribute, persisted workflow cases, Perform Maintenance task, background workflow resumption, workflow step behavior.

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

Yes. Every configured IdentityIQ application requires a Name because the Application object must have a unique logical identifier within IdentityIQ. The Name is not an Active Directory-specific connector parameter such as a domain controller, service account, or forest; it is a fundamental property of the IdentityIQ Application object itself.

IdentityIQ uses the application name throughout the platform when referencing the configured source or target. Application definitions, aggregation tasks, provisioning plans, rules, certifications, policies, reports, ManagedAttributes, Link objects, and workflow logic can all rely on the application identity. Without a usable application name, IdentityIQ could not reliably distinguish one configured Application object from another.

SailPoint ' s application configuration procedure therefore begins with the Details page and requires the engineer to enter the application Name before configuring connector-specific settings. The application type then determines the additional Active Directory configuration fields that become available.

Thus, regardless of the fact that this application uses the Active Directory connector, Name remains a required configuration option.

References/topics: IdentityIQ Engineer — Application object, Application Definition, Name, connector configuration, Active Directory application onboarding.

=======

No, the code snippet provided in the image is incorrect for including a rule library named " Common Rules Library " in a Rule. The correct syntax should reference the sailpoint.object.RuleLibrary class if the intent is to include a Rule Library, as seen in the second image. The first image incorrectly references the sailpoint.object.Rule class, which is not suitable for a rule library inclusion.

Correct Syntax (as shown in the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

No. A standard Correlation Rule and a Manager Correlation Rule perform different functions in IdentityIQ. The scenario specifically requires resolving a manager reference—an employee ' s manager employee number must be matched to the correct Identity despite several employee-number formats. That is manager correlation, not ordinary account-to-identity correlation.

A Correlation Rule is used when IdentityIQ needs custom logic to associate an application account with an Identity and simple attribute-based account correlation is insufficient. By contrast, SailPoint defines a Manager Correlation Rule specifically for establishing the Manager–Direct Report relationship between Identity objects when simple manager attribute mapping cannot accommodate the required matching logic.

Here, the presence of several employee-number formats is exactly the type of complexity that makes custom manager-correlation logic appropriate. The rule can normalize or otherwise interpret those formats and return the identity representing the correct manager.

This proposition is separate from the earlier video proposition using “Write a ManagerCorrelation rule,” which is the correct solution. Under DOMC rules, changing the proposed rule type creates a separate question.

Therefore, writing a generic Correlation Rule does not correctly target the required manager-resolution process.

References/topics: IdentityIQ Engineer — Manager Correlation Rule, Correlation Rule, manager relationships, application aggregation, account correlation, Identity Cube relationships.

=======

Yes, this is a valid action. When using the Services Standard Build (SSB) in SailPoint IdentityIQ, placing the patch jar file in the build ' s base/patch folder is a correct procedure, provided the patch version matches what the client is using. This allows the build process to incorporate the patch into the deployment, ensuring that the correct versions and fixes are applied to the IdentityIQ instance.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Patching and Version Management Guide

No. Profile Class is explicitly an optional application configuration property. Its purpose is role modeling, not connectivity to Active Directory. A Profile Class allows multiple applications to be logically associated with a larger application class so a single role profile can apply across those applications.

For example, several similar application instances can share the same Profile Class so that role-detection logic does not require a separate profile for every individual instance. This can simplify enterprise role modeling, but it is not necessary for IdentityIQ to connect to Active Directory, aggregate accounts or groups, correlate accounts, perform certifications, or provision access.

SailPoint ' s Edit Application documentation describes Profile Class as an optional class used to associate an application with a larger set of applications for role-modeling purposes. This differs fundamentally from required connector configuration such as application identity, schema, forest/domain information, and authentication details.

An engineer may therefore configure Profile Class when the organization ' s role model requires it, but an Active Directory application can be successfully configured and operated without one.

References/topics: IdentityIQ Engineer — Profile Class, Application Definition, role modeling, Active Directory connector, optional application properties.

=======

Yes, the code provided in the second image is correct for including a rule library named " Common Rules Library " in a Rule. The correct syntax is to use class= " sailpoint.object.RuleLibrary " and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the " Common Rules Library. "

Correct Syntax (from the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

A Role Membership Certification is appropriate for this requirement because the hospital is trying to confirm that users assigned to a role are correct. The test is not about whether the role contains the right entitlements; that would point to Role Composition Certification. It is also not primarily about application ownership or account group membership. The wording says the business analysts want to verify the role assignment rules by certifying the users who have been assigned the role. That maps directly to a membership review: who is in the role, whether each membership is valid, and whether the assignment rule is producing the expected population. The security team can be configured as the certifier, final reviewer, or sign-off participant depending on certification ownership and sign-off configuration. Therefore, the proposed certification type achieves the stated goal. References/topics: IdentityIQ Engineer — Role Membership Certification, role assignment rules, certification ownership, sign-off, access review routing.

Yes. In IdentityIQ workflow XML, subprocess calls can exchange data with the calling workflow through configured input and output variable handling. The send attribute is used to pass variables into the subprocess, while the returns attribute identifies variables that should be returned from the subprocess to the parent workflow context. This is important when a reusable subprocess performs initialization, provisioning-plan generation, identity-request creation, approval preparation, or other common logic and the parent workflow needs the resulting values. In the example, identityName and plan are sent into the subprocess, while identityRequestId and project are expected back. This is a valid workflow pattern and is one reason standard LCM subprocesses can be reused in custom workflows. The engineer must still ensure that variable names match and the subprocess actually sets the returned variables. References/topics: IdentityIQ Engineer — workflow subprocesses, send attribute, returns attribute, workflow variables, reusable LCM workflows.

The " Name " configuration option is required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Name " field is a mandatory identifier for the application within IdentityIQ. This name is used throughout the system to reference the application and is critical for configuration, management, and integration processes. Without specifying a name, IdentityIQ cannot properly identify and interact with the SCIM 2.0 application.

SailPoint IdentityIQ SCIM 2.0 Application Configuration Guide

SailPoint IdentityIQ Administration Guide (Application Setup and Naming Conventions)

Yes, the Provisioning tab under the " Administrator Console " can be used to manually retry provisioning attempts for pending transactions. This feature allows administrators to retry failed provisioning operations or manually trigger provisioning actions that are in a pending state, providing greater control over the provisioning process.

SailPoint IdentityIQ Administration Guide (Provisioning Management and Manual Retry)

SailPoint IdentityIQ Provisioning Guide

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)

No. This is not a correct locking and persistence pattern for safely modifying a Policy object. The most serious problem is that the object is retrieved and modified before an appropriate transaction lock is obtained . If concurrent processing can update the same persistent object, the object should be obtained under the intended transaction lock before the modification is performed.

The code also never explicitly calls context.saveObject(object). SailPoint ' s recommended object-modification pattern obtains a transaction lock using ObjectUtil.transactionLock() or the appropriate ObjectUtil.lockObject() mechanism, modifies the locked object, calls context.saveObject(), and commits the transaction. In addition, calling context.decache(object) before committing is contrary to the normal persistence pattern because decaching removes the object from the Hibernate/SailPoint object cache before the persistence sequence has been properly completed.

A documented SailPoint example obtains the transaction lock first, performs the modification, saves the object, commits, and then decaches it. The proposed code does not follow that sequence.

References/topics: IdentityIQ Engineer — SailPointContext, ObjectUtil locking, transaction locks, saveObject, commitTransaction, object cache management.

=======

The " Delete Entitlement " batch request type is not designed for cleaning up access by correcting or updating entitlements in bulk. Instead, " Delete Entitlement " is used to remove specific entitlements from the system entirely, which may not be what is needed if the goal is to correct incorrect entitlements (e.g., removing excess entitlements while adding missing ones). For the scenario described, where users need their entitlements corrected, other batch processes such as " Update Entitlement, " " Revoke Access, " or specific role re-assignment processes would be more appropriate.

SailPoint IdentityIQ Batch Request Types Documentation

SailPoint IdentityIQ Administration Guide (Entitlement Management Sections)

Yes, an Escalation Rule can be used to handle the scenario of automatically reassigning parts of an access review to a different certifier. In SailPoint IdentityIQ, Escalation Rules are often employed within certification campaigns to manage situations where a primary certifier has not completed their review within a specified timeframe. The rule can trigger actions such as reassigning the review items to a different certifier, thus ensuring that the certification process continues smoothly without delays.

Therefore, the correct answer is A. Yes.

Yes, this is indeed one of the primary purposes of an IdentityIQ certification. Certifications are conducted to attest to a user ' s system access, ensuring that each user has appropriate and justified access rights to applications, data, and systems within the organization. This is central to IdentityIQ’s access governance and compliance processes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

No. This proposed lifecycle sequence does not fit the standard Rapid Setup configuration available for a Mover event. A mover represents a change in an existing identity ' s organizational state—for example, a department, location, position, or other employment change—where access typically needs to be recalculated or adjusted rather than handled as terminating access.

The proposed process instead describes a termination-style account lifecycle: immediately disable an account and subsequently delete that account after a 30-day retention period. That pattern is appropriate to Leaver/termination processing, where access is first blocked and an account may subsequently be removed after a configured retention period.

The distinction is reinforced by the question bank. It already contains a different Mover proposition—“Disable an account and remove all its entitlements on a particular application during Mover events”—and marks that Rapid Setup scenario No. The video proposition changes the operation to delayed account deletion, so it remains a distinct DOMC item rather than a duplicate.

Therefore, standard Rapid Setup Mover configuration does not provide the stated disable-then-delete-after-30-days behavior.

References/topics: IdentityIQ Engineer — Rapid Setup, Mover lifecycle events, Leaver lifecycle events, account disablement, delayed account deletion, lifecycle-event configuration.

No. A workflow does not require a step specifically named " end " in order to finish correctly. IdentityIQ workflows end based on transition flow and workflow execution semantics, not because a magic step name exists. Many workflows include an end or stop step by convention because it improves readability and gives designers a clear terminal destination, but the name itself is not mandatory. A workflow may complete when there are no further transitions, when it reaches a terminal workflow structure, or when the process returns/finishes according to the configured step behavior. Confusing a naming convention with a workflow-engine requirement is dangerous because it leads to rigid, incorrect workflow design. Engineers should focus on proper transitions, variables, step actions, approval/form handling, and termination behavior. If a project standard uses a step called end, that is a local design convention, not a product requirement. References/topics: IdentityIQ Engineer — workflow step design, terminal steps, workflow transitions, Business Process Editor, workflow XML conventions.

Yes. An account attribute must have an Attribute Name because the name provides the logical identifier IdentityIQ uses to reference that attribute throughout the application configuration and subsequent processing. In this scenario, the engineer needs an attribute representing whether an account is privileged. That attribute must be identifiable when its value is populated from source data, calculated by rule logic, exposed to Advanced Analytics, referenced from BeanShell, or evaluated in policies.

The Attribute Name is distinct from the source mapping and datatype. The name establishes what attribute is being defined ; the source mapping determines where or how its value is obtained; and the datatype specifies what kind of value IdentityIQ expects.

The existing Word bank tests this same scenario with Source Mappings: Application Rule, which it marks as required, and separately with Edit Mode: Read Only. Those do not duplicate this proposition because DOMC treats each configuration option independently.

Therefore, Attribute Name is necessary for the account-attribute definition.

References/topics: IdentityIQ Engineer — application schema, account attributes, attribute naming, source mappings, Advanced Analytics, policy attributes.

=======

The provided solution does not fulfill the client ' s requirement. Setting " Who can members request for? " to " report to the requester " only limits the request scope to users who directly report to the requester, which does not account for the location attribute. The goal is to restrict requests based on the location attribute, and this specific configuration does not consider that attribute. To achieve the desired behavior, the configuration should include logic that filters users based on the same location as the requester.

The correct order for performing an initial installation of SailPoint IdentityIQ is:

Ensure all of the application servers are stopped.

Stopping all application servers is crucial to prevent any conflicts or transactional interference during the installation process.

Un-jar the IdentityIQ WAR file in the desired directory of each application server.

Extract the IdentityIQ WAR file in the appropriate location for the application server. This step deploys the IdentityIQ application code.

Configure iiq.properties file with database credentials and datasource.

The iiq.properties file must be updated with correct database credentials and datasource configurations to establish a connection to the IdentityIQ database.

Create the IdentityIQ database.

A new IdentityIQ database must be created for the system. This is the foundation where all IdentityIQ data will be stored.

Generate database schema to include custom attributes by executing ' iiq schema ' .

Use the iiq schema command to generate the necessary database schema. This includes tables, constraints, and other structural components for IdentityIQ.

Initialize default IdentityIQ system objects from ' iiq console ' using the ' import ' command.

Import default system objects like roles, policies, and configuration settings using the IdentityIQ console’s import feature. This sets up the base configuration.

Start all of the application servers.

Once everything is configured, start the application servers to make the IdentityIQ application available.

Apply the latest patch.

Finally, apply any patches to ensure the system is up to date with the latest security and feature enhancements.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Stopping all application servers is necessary to avoid file locks and ensure the WAR deployment and database setup processes can proceed smoothly.

Un-jarring the WAR file deploys IdentityIQ into the server directory structure, making its code accessible for execution.

Configuring the iiq.properties file connects IdentityIQ to the database, establishing where it will read and write data.

Creating the database is fundamental, as the IdentityIQ system relies on a structured data environment.

Generating the database schema via iiq schema builds out the tables and structures necessary for storing identity, access, and policy data.

Initializing system objects sets up core elements of IdentityIQ (like roles, capabilities, and system configurations) required for its operation.

Starting the application servers activates the IdentityIQ environment, allowing the system to begin processing requests.

Applying the latest patch ensures that the installation is up-to-date with all bug fixes, enhancements, and security updates from SailPoint.

SailPoint IdentityIQ Installation Guide (steps on fresh installation and post-installation configurations).

Creating a custom audit event and setting up an associated report involves steps such as defining the audit event, modifying the audit configuration, and creating a custom report using the SailPoint IdentityIQ reporting framework. Simply creating a Data Export task does not fulfill these requirements. A Data Export task is used for exporting data from IdentityIQ and is unrelated to the creation of custom audit events or custom reports. Refer to the SailPoint IdentityIQ Reporting Guide and the IdentityIQ Audit Framework documentation for more information on correctly creating and configuring custom audit events and reports.

Yes. The Environment area under the Administrator Console is intended for administrative visibility into the running IdentityIQ environment, including product/environment details and installed components or extensions where exposed by the platform. Viewing the status or presence of installed SailPoint modules/extensions is consistent with environment inspection. This is very different from controlling the application server itself. The engineer can use IdentityIQ administrative pages to understand what is installed, enabled, or available in the current deployment, which helps during troubleshooting, patch verification, upgrade planning, and support analysis. In multi-node deployments, this kind of environment visibility is useful because module or extension inconsistencies can cause unpredictable behavior. However, viewing status does not imply the Environment tab can install, uninstall, start, or stop all components. The proposed action is read/inspection-oriented, so it fits the purpose of the tab. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, installed modules, extensions, environment validation, upgrade/troubleshooting checks.

An Account Group Membership Certification is designed to certify group memberships within accounts, typically focusing on the validation of access within specific account groups (e.g., Active Directory groups).

This type of certification does not directly address the accuracy of role composition or the correctness of entitlements assigned within roles. Since the bank ' s goal is to ensure that all roles include the correct entitlements, an Account Group Membership Certification is not suitable for this purpose.

Thus, the correct answer is B. No.

Yes. Identity Provisioning Policies provide the field definitions and associated behavior used for identity-management operations such as Create Identity and Edit Identity . They can control which identity attributes are presented, which are required, what defaults or calculations are performed, and what validation or allowed-values logic applies.

For identity creation, the Create Identity Provisioning Policy defines the information collected when an authorized user creates an identity through IdentityIQ. Update/Edit behavior can similarly be governed through the appropriate identity provisioning policy. This allows implementations to expose controlled identity-management functionality without relying on arbitrary direct editing of Identity objects.

This proposition is different from two related items already in the Word bank. The bank contains a proposition stating that a Create Identity policy is applied during authoritative-source aggregation, and another covering allowed-values/validation logic when using Create Identity. Neither is the same DOMC proposition as defining policies for create/edit operations through the IdentityIQ UI.

Therefore, this is a separate unique question and the answer is Yes.

References/topics: IdentityIQ Engineer — Identity Provisioning Policies, Create Identity, Edit Identity, form fields, validation, identity lifecycle management.

=======

Yes. An Escalation Rule is designed exactly for this type of certification/access-review handling. In IdentityIQ certifications, an escalation process can be configured so that when a reviewer does not complete required certification work within a defined period, the work item can be escalated, reassigned, or otherwise routed according to business logic. The proposed scenario says that if an access review remains incomplete after 7 days, it should be reassigned to the certifier’s manager. That is a valid escalation pattern because the triggering condition is time-based non-completion, and the action is reassignment to another responsible reviewer. The certifier’s manager can be resolved from the identity relationship and used as the new owner or recipient of the escalated work item. The key point is that escalation rules are not used to generate certifications; they are used to control what happens when review work is overdue or requires escalation. References/topics: IdentityIQ Engineer — certification lifecycle, access review work items, escalation rules, reviewer reassignment.

Rapid Setup application onboarding is designed to simplify the initial configuration and does not typically provide advanced configuration options like specifying an account attribute and value filter to identify secondary accounts. Such detailed configurations often require custom scripting or detailed adjustments within the standard application setup, outside of the Rapid Setup interface.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Sections on Application Onboarding and Advanced Account Mapping)

This scenario describes an employee quitting their job and needing all of their accounts disabled, which aligns with a leaver lifecycle event rather than a mover event. A leaver event typically involves the deactivation of accounts and removal of access for users who are leaving the organization entirely, whereas a mover event involves changes to roles or access as part of an internal transition (e.g., promotion, transfer).

Therefore, the correct answer is B. No.

No. The key phrase is “inherited from an assigned Business Role.” IdentityIQ distinguishes between roles that are directly requestable and technical access that an identity receives because another role requires or contains it.

An IT Role can certainly be part of the IdentityIQ role model and can provide technical entitlement access. A Business Role can also be related to lower-level roles through required or permitted role relationships. However, when an IT Role is inherited automatically because an assigned Business Role requires it, that inherited access is not independently presented as a new role for the manager to request—the Business Role assignment is what drives the inherited role relationship.

Permitted roles are different because they can define additional role access that becomes eligible or meaningful in the context of another role. That distinction between automatic inheritance and requestability is important in access-model design.

The Word bank already contains the same manager-request stem with Business Role, which it marks valid, and another with HR Role, which it marks invalid. This inherited-IT-role proposition is separate.

References/topics: IdentityIQ Engineer — Business Roles, IT Roles, required roles, permitted roles, inherited role access, access requests.

=======

Yes. Once the custom audit action and report definition have been created and loaded into IdentityIQ, configuring and scheduling the resulting custom report through Intelligence > Reports is a valid step in completing the reporting solution.

IdentityIQ ' s reporting framework exposes standard and custom report definitions through the Reports UI. A report can be opened and configured with the required filters or parameters, saved as an appropriate report instance, executed immediately, or scheduled for future and recurring execution. SailPoint documents that reports can be scheduled to execute once, hourly, daily, weekly, monthly, quarterly, or annually.

For a custom audit-report implementation, this scheduling step logically follows the underlying development work: the custom AuditAction must first be defined, executable logic must actually create AuditEvent records using that action, and a custom report definition must be created that queries the required audit data. Scheduling the report does not replace any of those earlier implementation steps, but it is a legitimate final operational step once the custom report exists.

Therefore, this proposed solution is one valid step toward accomplishing the stated goal.

References/topics: IdentityIQ Engineer — custom AuditEvent reporting, custom TaskDefinition reports, Intelligence > Reports, report scheduling, recurring compliance reporting.

Yes. Out-of-the-box LCM workflows commonly support configurable notification behavior, and email templates can be selected or referenced through workflow variables, arguments, or workflow configuration. IdentityIQ workflows use email templates to generate notification content for approvals, requests, provisioning outcomes, policy violations, reminders, and other lifecycle events. The ability to control which template is used allows implementers to customize communications without rewriting the whole workflow. This is a valid use of workflow configuration because the workflow is responsible for sending or triggering notifications during lifecycle processing. The engineer still needs to ensure the referenced EmailTemplate object exists, contains the correct variables for the workflow context, and is suitable for the intended recipient. But conceptually, specifying the email template for notifications is exactly the type of behavior that can be controlled through LCM workflow configuration rather than through application schema or identity-attribute configuration. References/topics: IdentityIQ Engineer — LCM workflow variables, EmailTemplate objects, notification configuration, approval emails, workflow-controlled messaging.

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in the provisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.

Rapid Setup does allow for specifying account correlation by mapping an identity attribute to an account attribute. This is a standard part of the onboarding process where you define how IdentityIQ should correlate accounts to identities. This basic mapping functionality is included in Rapid Setup to facilitate straightforward account correlation during application onboarding.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Mapping Sections)

Allow is a valid action when acting on a policy violation, assuming the policy violation owner has the required permissions. In IdentityIQ compliance workflows, not every violation is immediately remediated. Some violations are business-approved exceptions, temporary exceptions, or accepted risks. The Allow action is used to acknowledge that the violation may remain in place, often with justification, comments, expiration, or compensating-control context depending on configuration. This is different from remediation, where access is changed or removed, and different from mitigation, where a mitigating control is attached. In the Account Policy context, the violation may indicate that a user exceeds a permitted account condition. If the business determines the condition is acceptable, the owner may allow it rather than immediately remove or alter an account. This is a legitimate compliance decision, provided the user has permission to take that action. References/topics: IdentityIQ Engineer — policy violation lifecycle, Account Policy, allow/exception handling, mitigation, remediation, Compliance Manager.

This proposed implementation is not valid as written. The logic is conceptually understandable, but the XML structure is not the correct IdentityIQ workflow transition pattern. In IdentityIQ workflows, transitions are normally declared using < Transition > elements with a destination, such as to= " StepName " , and optional conditional logic through a when expression or scripted evaluation. A raw < Source > block directly inside < Transition > returning destination names is not the standard structure for expressing multiple workflow routing paths after a form step. The engineer’s requirement is to route to Stop when the reject/back action is used, route to Audit when approval occurs and the comment variable is populated, and route to Provision as the fallback. That should be implemented as separate transition definitions with explicit destination steps and conditions. The proposed XML does not properly bind the returned values to valid transition destinations in the expected workflow syntax. References/topics: IdentityIQ Engineer — workflow XML, transition elements, form step routing, BeanShell expressions, Business Process Editor.

No. The statement is too absolute. IdentityIQ does not always require the scheduled challenge-period duration to expire before sign-off can occur.

When a challenge period is enabled and revocation decisions exist, the related challenge processing must reach an appropriate completed state before the access review can be signed off. However, IdentityIQ documentation explicitly permits sign-off while the certification is in the challenge phase when all items are complete, all applicable revocation decisions have progressed through the challenge procedure, and no open decisions remain.

Expiration of the configured challenge period is another condition that permits the certification to proceed, but it is not the only possible path. In other words, there is an important difference between saying that challenge processing must be complete and saying that the reviewer must always wait until the full scheduled challenge period expires.

SailPoint ' s Access Review documentation lists both conditions independently: completed challenge processing can permit sign-off, or the challenge period can expire.

Therefore, the proposition “cannot be signed off until after the challenge period ends” is technically false.

References/topics: IdentityIQ Engineer — challenge phase, certification sign-off, completed challenges, revocation procedure, certification lifecycle.

=======

This is not a valid development step. A Quicklink is configured as an IdentityIQ object that exposes an action to users through the UI and can be configured to launch a workflow. The workflow does not contain or “host” the Quicklink object. The relationship is the other way around: the Quicklink references the workflow it should launch. To restrict the Quicklink to managers only, the engineer should configure visibility, population, capability, or dynamic eligibility logic so only manager identities can see or execute it. Then the Quicklink configuration should identify the workflow to invoke and pass any required arguments into that workflow. Placing a Quicklink object “on” the workflow is not how IdentityIQ Quicklink architecture works. The proposed solution confuses the launching object with the launched process. References/topics: IdentityIQ Engineer — Quicklink object, workflow launch configuration, manager-only visibility, population rules, workflow arguments.

Yes, defining account correlation via a rule is an action that can be performed as part of configuring an application definition in SailPoint IdentityIQ. Account correlation rules are often used to determine how accounts from different sources are linked to identities within IdentityIQ. These rules allow for complex logic to be applied when matching accounts to identities, beyond simple attribute matching.

SailPoint IdentityIQ Administration Guide (Section on Account Correlation)

SailPoint IdentityIQ Application Configuration Guide (Using Rules for Account Correlation)

The statement is incorrect. The " For Others " option in the quicklink configuration is used to allow users to perform actions on behalf of other identities (e.g., a manager performing an action for a subordinate). However, setting the quicklink to " For Others " does not make it launch a workflow immediately. To have a quicklink launch a workflow immediately when clicked, you would typically need to configure the quicklink to call the workflow directly, without requiring additional user input. " For Others " is more about the context of the action rather than triggering workflows automatically.

SailPoint IdentityIQ Quicklink Development Guide

SailPoint IdentityIQ Administration Guide (Quicklink and Workflow Configuration)

Specifying account correlation using a rule cannot be performed using the Rapid Setup application onboarding process. Rapid Setup is designed for straightforward and simplified onboarding processes with a focus on quick configuration, typically using predefined templates and options. However, advanced configurations like custom account correlation rules require more detailed setup, typically done outside of the Rapid Setup UI, involving scripting or detailed configuration within the application definition.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Application Onboarding Sections)

Yes. A ManagedAttribute represents managed access originating from an IdentityIQ application—for example an entitlement value, account group, or permission. Consequently, its definition includes an association with the Application object that supplies or owns that managed access.

The Entitlement Catalog makes this relationship explicit. For each managed attribute, IdentityIQ displays an Application property identifying the application associated with the attribute. The remaining ManagedAttribute metadata—such as Type, Attribute or Target, Value, owner, requestability, classifications, and associated roles—is interpreted within that application ' s schema and governance context.

This relationship is important because identical entitlement values can exist on different systems but represent completely different access. IdentityIQ therefore requires application context to uniquely and correctly interpret the entitlement. For example, a value called Administrators on one Active Directory application is not inherently the same governed entitlement as Administrators on another target.

A ManagedAttribute can participate in roles, certifications, requests, classifications, and policy evaluation, but those governance relationships do not remove its underlying application association.

References/topics: IdentityIQ Engineer — ManagedAttribute object, Application object, Entitlement Catalog, managed entitlements, application schemas.

=======

No. Custom branding changes should not be assumed to update automatically during an IdentityIQ upgrade. Branding changes often involve customized UI resources, message files, images, CSS, JSPs, configuration entries, or other web-application artifacts. During an upgrade, the standard IdentityIQ application files are replaced or changed, and customizations may need to be re-applied, merged, retested, or adjusted to align with the new release. Assuming the upgrade process automatically updates every custom branding change is a bad implementation practice. Engineers should inventory all customizations before upgrade, compare them against the new release, reapply supported changes, and validate the UI after deployment. This also applies to broader customizations such as rules, workflows, Quicklinks, forms, libraries, object extensions, and localized messages. The correct upgrade discipline is controlled migration and regression testing, not blind reliance on automatic preservation. References/topics: IdentityIQ Engineer — upgrade planning, branding customization, UI resource changes, regression testing, customization inventory.

Yes. Reusing appropriate standard Lifecycle Manager subprocesses is a sound IdentityIQ workflow-design practice because those subprocesses encapsulate established processing for common lifecycle and provisioning operations. Building every custom provisioning workflow entirely from scratch duplicates tested logic and makes future maintenance substantially harder.

SailPoint describes subprocess workflows as a way to divide complex workflows into smaller components that are easier to manage and can be reused by multiple master workflows. Standard LCM workflows make extensive use of this pattern for initialization, approval processing, provisioning, policy checking, identity-request handling, notifications, and related activities. A custom workflow can call an existing subprocess and provide the input/control variables required by that subprocess.

However, “as much as possible” does not mean blindly invoking every standard LCM subprocess. The engineer must understand the subprocess contract, including expected inputs, returned values, workflow variables, provisioning-plan assumptions, and release-specific behavior. Custom logic should only replace or extend standard processing when business requirements genuinely require it.

Therefore, leveraging standard LCM subprocesses where their behavior fits the requirement is a valid best-practice approach.

References/topics: IdentityIQ Engineer — LCM workflows, subprocess reuse, reusable business processes, workflow variables, provisioning customization.

=======

This proposed solution is not correct. In IdentityIQ, features and functional access are controlled primarily through capabilities, not scopes. Capabilities determine whether a user can perform administrative or functional actions such as managing identities, accessing reports, configuring applications, launching tasks, or using privileged pages. Scopes, by contrast, are generally used to restrict which objects or data a user can see or act upon. For example, a scoped administrator may only be able to view or administer identities, applications, or work items within an assigned organizational boundary. That is object/data visibility control, not feature enablement. Saying that scopes control “the features that are used” confuses two different authorization layers. The correct IdentityIQ distinction is: capabilities control functional permissions, while scopes constrain object access boundaries. References/topics: IdentityIQ Engineer — authentication, authorization, capabilities, scopes, delegated administration.

Yes. IdentityIQ uses message-catalog properties to supply a large amount of user-interface text rather than hard-coding every label directly into individual pages. In traditional IdentityIQ deployments, the iiqMessages resource files contain message keys and their displayed text. Changing or overriding the relevant message key is therefore a standard mechanism for customizing labels, prompts, descriptions, placeholders, and other localized UI strings.

A safer customization pattern is generally to place customer-specific overrides into the appropriate custom message properties file rather than directly altering the SailPoint-delivered base resource, because base files can be replaced during an upgrade. This also supports internationalization because locale-specific message catalogs can provide different values for the same key.

For example, IdentityIQ certification screens, access-request pages, login-related messages, and general interface labels frequently resolve displayed strings through message keys. SailPoint ' s internationalization and templating mechanisms likewise retrieve translated values from message catalogs.

Therefore, the statement that iiQMessages files can be used to change text labels is valid.

References/topics: IdentityIQ Engineer — message catalogs, iiqMessages.properties, iiqCustom.properties, localization, UI labels and branding.

=======

No. IdentityIQ does not require a dedicated Catch step to accompany every individual workflow step capable of throwing an exception. Such a requirement would make workflows unnecessarily verbose and would not reflect normal workflow exception-handling design.

Workflow steps can execute scripts, rules, subprocesses, methods, approvals, and other operations, many of which can theoretically throw runtime exceptions. Exception handling can be designed at an appropriate level depending on the workflow ' s requirements. BeanShell logic can explicitly use exception handling where necessary, subprocess behavior can be handled by the calling process, and workflow-level failure processing can deal with unhandled exceptions.

A Catch construct is useful when the workflow needs to intercept a particular failure and intentionally route execution into recovery, cleanup, notification, auditing, or another controlled path. It is therefore an exception-handling mechanism , not a mandatory companion to every potentially failing step.

The Word bank already tests other workflow-step semantics, including the available Script, Rule, Subprocess, and Call Method actions; those are separate concepts from mandatory exception handling. The universal wording “must accompany every step” makes this proposition false.

References/topics: IdentityIQ Engineer — workflow step types, exception handling, Catch processing, BeanShell exceptions, subprocess failure handling, workflow error paths.

SMTP Port is a required mail configuration value for successful SMTP communication. IdentityIQ must know not only the mail server host but also the network port used to connect to that SMTP service. Common SMTP ports include 25, 465, or 587 depending on whether the environment uses unauthenticated SMTP relay, SSL/TLS, or STARTTLS. Without the port, IdentityIQ cannot reliably establish the socket connection to the mail server, even if the hostname and credentials are correct. Email notification is used heavily across IdentityIQ processes, including workflow approvals, certification reminders, lifecycle events, policy violations, provisioning notifications, and work-item escalation. Therefore, SMTP connectivity settings must be complete and accurate. SMTP Port is not merely cosmetic; it is part of the transport configuration required for IdentityIQ to communicate with the mail infrastructure. References/topics: IdentityIQ Engineer — email notification setup, SMTP server configuration, mail host and port, workflow and certification notifications.

The scenario describes triggering a workflow when a " Division " attribute changes from a specific value to " Senior IT, " but only when the user is a manager. The proposed solution suggests creating a trigger with an event type of " rule " that checks the previous and new values of the " Division " attribute.

However, this approach has a couple of issues:

Trigger Configuration: In SailPoint IdentityIQ, a lifecycle event trigger typically operates on changes in identity attributes, but it’s not standard to define this trigger using a rule that directly inspects the previous and new values. Instead, the lifecycle event would usually be configured in the context of the application or identity to directly listen to specific changes without needing to define the logic in a custom rule.

Condition Validation: The condition of checking if the user is a manager should ideally be integrated within the workflow itself or the lifecycle event configuration, not just as part of a rule in the trigger.

While a rule can be used to define complex conditions, the correct way to implement this in IdentityIQ would involve setting up the lifecycle event trigger specifically for the attribute change and managing any additional conditions (like checking if the user is a manager) within the workflow or using an appropriate script/rule in that context.

Therefore, while partially correct in approach, the described solution is not the best practice or a valid process in IdentityIQ, so the correct answer is B. No.

Yes, the Provisioning tab under the " Administrator Console " in IdentityIQ can be used to view the specific operations on each attribute being provisioned. This tab provides detailed visibility into the provisioning operations, including which attributes are being modified, created, or removed as part of the provisioning process. This is essential for administrators to monitor and troubleshoot provisioning tasks.

SailPoint IdentityIQ Administration Guide (Provisioning Tab Overview)

SailPoint IdentityIQ Provisioning Guide

No. The Provisioning area of the Administrator Console is focused on provisioning transactions , not on providing the current connector/application connection-health status for the associated target application.

A provisioning transaction can provide information about the access request and its processing state—for example whether provisioning is pending, completed, failed, or otherwise awaiting processing. Engineers can use transaction information to investigate provisioning behavior and determine which application and operations are involved. That is not equivalent to displaying whether the underlying application connector is presently connected or healthy.

Application connectivity is investigated through application configuration/testing and the relevant application or connector diagnostic mechanisms. A transaction can fail because of connectivity, authentication, connector configuration, target-system errors, invalid data, workflow problems, or many other causes. Consequently, the transaction state cannot simply be interpreted as the application ' s connection status.

The distinction is tested directly by this DOMC proposition: provisioning transaction monitoring and application connectivity monitoring are separate administrative functions.

References/topics: IdentityIQ Engineer — Administrator Console, Provisioning Transactions, Application connectivity testing, connector troubleshooting, provisioning status.

=======

Yes. This is a recognized IdentityIQ BeanShell debugging technique for inspecting the variables available in the current rule ' s BeanShell namespace. BeanShell exposes the namespace variable names through this.variables. The loop processes each name, evaluates it through eval(name), determines whether its value is void, null, or an actual Java object, and prints the variable together with its runtime type and value.

This is valuable because the effective variables available to a rule can depend on both the rule type and the context from which that rule is invoked. The Rule Editor documents normal Arguments and Returns, but runtime inspection can expose the actual namespace provided during a specific execution.

SailPoint ' s published debugging example uses essentially this same pattern and describes it as dumping all variables available in the BeanShell namespace. Newer versions of the example add a check to skip transient, because that name is a Java reserved word and can cause eval() problems in some workflow contexts. That refinement does not invalidate the basic diagnostic technique shown in the question.

References/topics: IdentityIQ Engineer — BeanShell namespace, Rule Editor Arguments/Returns, this.variables, eval(), rule debugging.

=======

The statement that " An Application object is not required to aggregate external user account information into IdentityIQ " is false. In SailPoint IdentityIQ, an Application object is essential for aggregating (importing) external user account information. The Application object defines the connection settings, schema, and mapping that enable IdentityIQ to connect to external systems and retrieve identity data. Without an Application object, IdentityIQ would not have the necessary configuration to establish a connection and aggregate user data from external sources.

SailPoint IdentityIQ Administration Guide (Section on Applications and Aggregation)

SailPoint IdentityIQ Integration and Configuration Guide

This solution correctly addresses the client ' s requirement. By setting the membership match list to " All " and configuring " Who can members request for? " as " share attributes with the requester, " with the attribute set to location, the system ensures that users in the " Management " workgroup can only request roles and entitlements for other users who share the same location. This setup effectively filters based on the location attribute, aligning with the client ' s needs.

time → show how much time a command takes to run

source → execute a file of commands

run → launch a background task

import → import objects from a file

The statement " The rule type must be IdentityAttribute " is correct. In SailPoint IdentityIQ, when writing a rule that is intended to map or manipulate identity attributes during the aggregation process, the rule type should be set to " IdentityAttribute " . This ensures that the rule is recognized and executed in the appropriate context for managing identity attributes.

Therefore, the correct answer is A. Yes.

Yes, the statement is true. Both logging and auditing in SailPoint IdentityIQ can have a negative influence on performance because they involve additional function calls within the application. These processes generate data that needs to be stored, which can impact performance if not managed properly. Extensive logging and auditing, particularly at high levels of detail, can lead to increased I/O and storage usage, potentially slowing down system operations.

SailPoint IdentityIQ Performance Tuning Guide

SailPoint IdentityIQ Logging and Auditing Guide (Impact on Performance)

Yes. Rapid Setup supports standard lifecycle-event actions for Leaver processing, including application-specific account actions and delayed account deletion. This enables an implementation to disable an account when the Leaver event occurs and configure account deletion for a later point, such as 30 days afterward.

This pattern is useful because many organizations do not immediately delete accounts when employment ends. Immediate disablement blocks interactive access while preserving the account temporarily for investigation, handover, retention, reconciliation, or recovery requirements. After the retention interval expires, deletion can remove the target-system account according to the configured lifecycle policy.

The important distinction is that this is a standard timing sequence for the same lifecycle population , rather than complex branching where different categories of users receive entirely different actions. The Word bank already contains a different Rapid Setup proposition involving disabling accounts for one group while deleting accounts for another group during termination, and marks that more complex population-dependent scenario invalid. It also separately tests disable-plus-entitlement-removal during Leaver.

Therefore, this delayed-delete Leaver proposition is unique and valid.

References/topics: IdentityIQ Engineer — Rapid Setup, Leaver events, Disable Account, Delete Account, delayed deletion, lifecycle configuration.

=======