IdentityIQ-Engineer Questions and Answers

No. Custom branding changes should not be assumed to update automatically during an IdentityIQ upgrade. Branding changes often involve customized UI resources, message files, images, CSS, JSPs, configuration entries, or other web-application artifacts. During an upgrade, the standard IdentityIQ application files are replaced or changed, and customizations may need to be re-applied, merged, retested, or adjusted to align with the new release. Assuming the upgrade process automatically updates every custom branding change is a bad implementation practice. Engineers should inventory all customizations before upgrade, compare them against the new release, reapply supported changes, and validate the UI after deployment. This also applies to broader customizations such as rules, workflows, Quicklinks, forms, libraries, object extensions, and localized messages. The correct upgrade discipline is controlled migration and regression testing, not blind reliance on automatic preservation. References/topics: IdentityIQ Engineer — upgrade planning, branding customization, UI resource changes, regression testing, customization inventory.

The statement " The rule type must be IdentityAttribute " is correct. In SailPoint IdentityIQ, when writing a rule that is intended to map or manipulate identity attributes during the aggregation process, the rule type should be set to " IdentityAttribute " . This ensures that the rule is recognized and executed in the appropriate context for managing identity attributes.

Therefore, the correct answer is A. Yes.

Yes. An Escalation Rule is designed exactly for this type of certification/access-review handling. In IdentityIQ certifications, an escalation process can be configured so that when a reviewer does not complete required certification work within a defined period, the work item can be escalated, reassigned, or otherwise routed according to business logic. The proposed scenario says that if an access review remains incomplete after 7 days, it should be reassigned to the certifier’s manager. That is a valid escalation pattern because the triggering condition is time-based non-completion, and the action is reassignment to another responsible reviewer. The certifier’s manager can be resolved from the identity relationship and used as the new owner or recipient of the escalated work item. The key point is that escalation rules are not used to generate certifications; they are used to control what happens when review work is overdue or requires escalation. References/topics: IdentityIQ Engineer — certification lifecycle, access review work items, escalation rules, reviewer reassignment.

Not all Application objects in SailPoint IdentityIQ must have an Identity object as the owner. While it is common practice to assign an owner to an Application object for governance and administration purposes, it is not a strict requirement. Applications can exist without a direct association to an Identity object. The ownership concept in IdentityIQ is more of a best practice for accountability rather than a mandatory attribute. Refer to the SailPoint IdentityIQ Application Definition Guide for more information on the configuration and management of Application objects.

No. IdentityIQ report results are not simply stored as files on the application servers as a universal rule. IdentityIQ is a database-backed governance platform, and generated report metadata/results are associated with task/report result objects and persisted through the platform’s data model. While report exports or generated files may be downloaded or temporarily handled by the application server at runtime, the statement “all report results are stored on IdentityIQ application servers” is technically inaccurate. In clustered deployments, relying on local application-server storage for all report results would also be problematic because multiple application servers may serve the same IdentityIQ environment. IdentityIQ centralizes configuration, task history, report metadata, identities, applications, and governance objects through its database-backed object model. Therefore, the correct understanding is that reports are run by the IdentityIQ task/reporting framework and report result information is managed by IdentityIQ, not universally stored as local application-server files. References/topics: IdentityIQ Engineer — reporting architecture, task results, report instances, application server versus database persistence.

Syslog can be used to identify the details of a system error presented in the UI. When a system error occurs, IdentityIQ typically logs detailed error messages, stack traces, and other relevant information to Syslog or other logging frameworks configured in the environment. By reviewing these logs, an administrator or engineer can identify and diagnose the specific error that was encountered in the UI.

SailPoint IdentityIQ Logging and Monitoring Guide

SailPoint IdentityIQ Administration Guide (Sections on Error Handling and Troubleshooting)

No. IdentityIQ BeanShell rules do not all have the same input and output contract. Rule arguments and expected return values depend on the rule type and the execution context in which IdentityIQ invokes the rule.

For example, a correlation rule requires information relevant to account/identity correlation, while provisioning-related rules operate with provisioning plans, applications, accounts, or provisioning results. Workflow rules receive variables associated with the workflow context. Other rule types may return a Boolean, String, Identity, Map, object collection, transformed value, or no meaningful value at all.

IdentityIQ ' s Rule Registry and Rule Editor exist partly to expose this distinction. The Word bank itself states that the typical input variables for a rule are presented according to the Rule Registry, meaning they are determined by rule type rather than being universally identical. It also contains separate propositions concerning Rule Registry descriptions and Rule Editor Arguments.

Therefore, standardizing every BeanShell rule around identical arguments and returns would contradict IdentityIQ ' s rule architecture.

References/topics: IdentityIQ Engineer — BeanShell rules, Rule Registry, Arguments, Returns, rule type, runtime context.

=======

Yes, specifying which access items may be requested can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In IdentityIQ, control variables within LCM workflows allow administrators to define the scope and criteria for access requests, including restricting or specifying which entitlements, roles, or applications can be requested by users. This is part of the request configuration process, where the access items that users can see and request are defined.

Therefore, the correct answer is A. Yes.

This statement is not correct. IdentityIQ syslog event searching is not limited only to Incident Code lookups. Incident Code is useful when a user-facing error displays a code that can be traced back to a logged system event, but syslog analysis is broader than that. Administrators and engineers use syslog data to investigate operational errors, workflow failures, connector issues, provisioning errors, aggregation failures, authentication problems, and application exceptions. Advanced Analytics and log-search capabilities are intended to help filter and locate system events using more than a single incident-code value. Treating Incident Code as the only searchable attribute would make syslog analysis nearly useless for routine troubleshooting where no user-facing incident code is available. The correct engineering view is that Incident Code is one important search key, not the exclusive search mechanism. References/topics: IdentityIQ Engineer — syslog search, Advanced Analytics, incident code troubleshooting, system-error diagnosis, operational logging.

Syslog is not intended for querying or identifying specific objects, such as all Link objects from a particular application. Syslog is used to record events and log information related to system activities, errors, and operations. To identify all Link objects from a particular application, you would use IdentityIQ ' s internal search functionality or reports that allow you to filter and retrieve such objects. These tasks involve querying the database and application-specific data structures rather than examining log files.

SailPoint IdentityIQ Administration Guide (Section on Objects and Searching)

SailPoint IdentityIQ Configuration Guide (Understanding Link Objects)

Yes. IdentityIQ roles can be configured to include permissions as part of the access represented by the role. A role is fundamentally a logical collection of access that can include application entitlements and permission-based profile definitions. SailPoint describes roles as collections of permissions that group underlying system access into meaningful business or technical units.

Within a role profile, IdentityIQ supports Attribute Permissions in addition to attribute rules. Permissions define rights against targets on an application. An engineer can select rights such as create, read, update, delete, or execute and associate those rights with the appropriate target. These permission definitions become part of the role profile and therefore form part of the access granted through the role.

This should not be confused with IdentityIQ administrative SPRight objects. Application-level permissions contained in a role profile are governed access on target systems, whereas SPRights control functionality inside IdentityIQ itself. IdentityIQ roles can also grant capabilities and scopes when that feature is enabled.

Therefore, configuring a role to contain a set of permissions is a valid role configuration.

References/topics: IdentityIQ Engineer — Role Modeling, role profiles, attribute permissions, entitlements, targets and rights.

=======

No. Launching certification campaigns is not default Lifecycle Manager functionality. Lifecycle Manager focuses on identity lifecycle and access-request operations such as joiner, mover, leaver processing, access requests, account management, approvals, and provisioning workflows. Certification campaigns belong to IdentityIQ’s access review and compliance/certification capabilities, not LCM’s default functional scope. Certifications are used to review access, roles, entitlements, policy violations, or account/group membership and then require reviewers to approve, revoke, or otherwise act on access. LCM may interact with certification results indirectly because remediation from a certification can trigger provisioning or access changes, but launching the campaign itself is a certification/compliance function. This question tests whether the engineer separates lifecycle-request processing from access-review governance. Mixing them up leads to poor module design and incorrect implementation expectations. References/topics: IdentityIQ Engineer — Lifecycle Manager, access request, provisioning workflows, certification campaigns, Compliance Manager.

No. This is not a correct locking and persistence pattern for safely modifying a Policy object. The most serious problem is that the object is retrieved and modified before an appropriate transaction lock is obtained . If concurrent processing can update the same persistent object, the object should be obtained under the intended transaction lock before the modification is performed.

The code also never explicitly calls context.saveObject(object). SailPoint ' s recommended object-modification pattern obtains a transaction lock using ObjectUtil.transactionLock() or the appropriate ObjectUtil.lockObject() mechanism, modifies the locked object, calls context.saveObject(), and commits the transaction. In addition, calling context.decache(object) before committing is contrary to the normal persistence pattern because decaching removes the object from the Hibernate/SailPoint object cache before the persistence sequence has been properly completed.

A documented SailPoint example obtains the transaction lock first, performs the modification, saves the object, commits, and then decaches it. The proposed code does not follow that sequence.

References/topics: IdentityIQ Engineer — SailPointContext, ObjectUtil locking, transaction locks, saveObject, commitTransaction, object cache management.

=======

This is not a valid step for creating a custom audit event and associated report. A Custom Certification Event Schedule relates to certification scheduling or certification-event processing, not to defining a new audit action in the audit framework. A ruleRunner task can execute a rule, but simply creating a certification event schedule and ruleRunner task does not establish a custom audit event type, does not register the event in AuditConfig, and does not create a report capable of querying that audit data. For a custom audit event, the engineer must define the audit action/event, ensure the code path writes the audit event with the appropriate attributes, and then create or configure a report that can retrieve and display those audit records. The proposed solution is pointed at the wrong subsystem. It confuses certification scheduling automation with audit event definition and reporting. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction, custom audit events, audit reporting, ruleRunner task limitations.

The statement that " An Application object is not required to aggregate external user account information into IdentityIQ " is false. In SailPoint IdentityIQ, an Application object is essential for aggregating (importing) external user account information. The Application object defines the connection settings, schema, and mapping that enable IdentityIQ to connect to external systems and retrieve identity data. Without an Application object, IdentityIQ would not have the necessary configuration to establish a connection and aggregate user data from external sources.

SailPoint IdentityIQ Administration Guide (Section on Applications and Aggregation)

SailPoint IdentityIQ Integration and Configuration Guide

An Application Owner Certification is primarily used to certify entitlements and roles associated with specific applications. It involves application owners reviewing access within their applications, which is useful for ensuring that access aligns with the intended security policies for that application.

However, in the context of ensuring that roles include the correct entitlements across the entire role model, a more suitable certification type would be a Role Composition Certification. This type specifically focuses on validating the composition of roles, including the entitlements they aggregate.

Therefore, an Application Owner Certification will not fully achieve the goal of ensuring all roles include the correct entitlements. The correct answer is B. No.

Yes. The number of identities is relevant information when planning an IdentityIQ sandbox because it establishes the approximate scale and workload characteristics of the customer environment. A sandbox does not normally need a literal production clone containing every identity, but an engineer must understand production scale to decide how representative the sample data and infrastructure should be and what kinds of performance or processing behavior need to be tested.

SailPoint recommends separating development, test, and production and specifically describes a sandbox using sample data as a safe environment for testing rules under realistic conditions. Identity volume materially affects operations that iterate across Identity Cubes, including Identity Refresh, policy evaluation, certifications, correlation, role propagation, and other background processing. IdentityIQ ' s own Environment Information Report records the number of identities together with application, account, role, certification, processor, database, and version information—demonstrating that identity count is a meaningful environment characteristic.

Therefore, an engineer gathering requirements for a new sandbox should know the customer ' s identity population even when only a representative subset will ultimately be loaded.

References/topics: IdentityIQ Engineer — sandbox planning, realistic test data, environment sizing, identity volume, Identity Refresh, Environment Information Report.

=======

Yes. This is a recognized IdentityIQ BeanShell debugging technique for inspecting the variables available in the current rule ' s BeanShell namespace. BeanShell exposes the namespace variable names through this.variables. The loop processes each name, evaluates it through eval(name), determines whether its value is void, null, or an actual Java object, and prints the variable together with its runtime type and value.

This is valuable because the effective variables available to a rule can depend on both the rule type and the context from which that rule is invoked. The Rule Editor documents normal Arguments and Returns, but runtime inspection can expose the actual namespace provided during a specific execution.

SailPoint ' s published debugging example uses essentially this same pattern and describes it as dumping all variables available in the BeanShell namespace. Newer versions of the example add a check to skip transient, because that name is a Java reserved word and can cause eval() problems in some workflow contexts. That refinement does not invalidate the basic diagnostic technique shown in the question.

References/topics: IdentityIQ Engineer — BeanShell namespace, Rule Editor Arguments/Returns, this.variables, eval(), rule debugging.

=======

No. The key phrase is “inherited from an assigned Business Role.” IdentityIQ distinguishes between roles that are directly requestable and technical access that an identity receives because another role requires or contains it.

An IT Role can certainly be part of the IdentityIQ role model and can provide technical entitlement access. A Business Role can also be related to lower-level roles through required or permitted role relationships. However, when an IT Role is inherited automatically because an assigned Business Role requires it, that inherited access is not independently presented as a new role for the manager to request—the Business Role assignment is what drives the inherited role relationship.

Permitted roles are different because they can define additional role access that becomes eligible or meaningful in the context of another role. That distinction between automatic inheritance and requestability is important in access-model design.

The Word bank already contains the same manager-request stem with Business Role, which it marks valid, and another with HR Role, which it marks invalid. This inherited-IT-role proposition is separate.

References/topics: IdentityIQ Engineer — Business Roles, IT Roles, required roles, permitted roles, inherited role access, access requests.

=======

Inserting the " Managers " QuickLink population as the dynamic scope in the QuickLink object is a valid step when creating a custom QuickLink that should only be accessible by managers. QuickLink populations are used to define which users have access to specific QuickLinks based on criteria like role, department, or other attributes. By assigning the " Managers " population, only users who are members of that population will see and be able to launch the QuickLink.

Therefore, the correct answer is A. Yes.

No, this statement is incorrect. When a wait step is encountered in a foreground workflow, it does not cause the user’s screen to freeze for the specified number of seconds. Instead, the wait step simply pauses the workflow execution for the specified duration, but this is managed in the background. The user interface remains responsive, and the end-user typically won’t notice any freezing or delays caused by the wait step itself.

SailPoint IdentityIQ Workflow Guide (Section on Workflow Step Types)

SailPoint IdentityIQ Scripting and Workflow Best Practices

No. IdentityIQ report execution is based on task/report scheduling behavior, and the platform is not limited to running reports only once per day. Reports can be executed manually or scheduled according to supported scheduling options, depending on task configuration and administrative requirements. A daily schedule is only one possible cadence. IdentityIQ reporting is built on task infrastructure, and report templates can generate report instances based on selected parameters, filters, and schedules. In real deployments, organizations may schedule reports daily, weekly, monthly, or at other configured intervals depending on governance, compliance, and operational needs. The proposed solution is too restrictive because it says “at most once per day,” which incorrectly imposes a limitation that is not inherent to IdentityIQ reporting. The accurate concept is that reports can be scheduled, but the frequency depends on the task scheduler configuration and the report’s business purpose. References/topics: IdentityIQ Engineer — reporting, report templates, scheduled reports, task execution, report instances.

The workflow transition condition shown in the image is Transition to= " Approve " when= " identityName != null " . This condition checks whether the identityName variable is not null. In the provided scenario, the identityName variable has a value of " Catherine.Simmons, " which is clearly not null. Therefore, the condition for transitioning to the " Approve " step will evaluate as true, meaning the workflow will indeed continue to the " Approve " step.

However, it seems like the question might be worded incorrectly as it asks if the workflow will continue to the " Approve " step when it actually will. If this was an error and the intention was to determine if it should not continue, the answer would have been " No. " But based on the logic, the workflow will continue to the " Approve " step.

SailPoint IdentityIQ Workflow Documentation

SailPoint IdentityIQ Scripting Guide (Conditions and Transitions in Workflows)

This is not a valid development step. A Quicklink is configured as an IdentityIQ object that exposes an action to users through the UI and can be configured to launch a workflow. The workflow does not contain or “host” the Quicklink object. The relationship is the other way around: the Quicklink references the workflow it should launch. To restrict the Quicklink to managers only, the engineer should configure visibility, population, capability, or dynamic eligibility logic so only manager identities can see or execute it. Then the Quicklink configuration should identify the workflow to invoke and pass any required arguments into that workflow. Placing a Quicklink object “on” the workflow is not how IdentityIQ Quicklink architecture works. The proposed solution confuses the launching object with the launched process. References/topics: IdentityIQ Engineer — Quicklink object, workflow launch configuration, manager-only visibility, population rules, workflow arguments.

The statement is false. In SailPoint IdentityIQ, the language displayed in the user interface is not always based on the default language selected in the global settings. The language displayed in the user interface is typically determined by the user ' s language preference, which can be set individually for each user. If a user ' s preferred language is not available, then the system may fall back to the default language specified in the global settings. Thus, while the global default language serves as a fallback, the actual language displayed is often based on user-specific settings.

SailPoint IdentityIQ Administration Guide (Localization and Language Settings Sections)

SailPoint IdentityIQ User Guide (User Preferences and Language Selection)

No. ManagedAttribute objects represent managed entitlement or account-group values from applications. They are not generally viewed on the Policy tab of the View Identity QuickLink. The Policy tab is used for policy-related information such as policy violations or compliance policy context, not for listing all entitlements associated with the identity. A user’s entitlements and accounts are normally viewed through identity access/account-related tabs or identity cube access views, depending on UI configuration. This proposed statement confuses ManagedAttribute entitlement data with policy-violation data. A ManagedAttribute may be involved in a policy violation, certification item, access request, or entitlement display, but that does not mean all ManagedAttribute objects associated with an Identity are visible from the Policy tab. The correct engineering distinction is: ManagedAttribute equals governed entitlement metadata; Policy tab equals policy/compliance information. References/topics: IdentityIQ Engineer — ManagedAttribute, Identity Cube, View Identity QuickLink, entitlement display, policy violations.

Yes. IdentityIQ workflow steps support several action types, and both Script and Rule actions execute logic implemented with Java BeanShell.

A Script action contains BeanShell code directly within the workflow step. This is useful for workflow-specific logic that is short or tightly coupled to that business process. In workflow XML, the script may appear inline or inside a nested < Script > < Source > ... < /Source > < /Script > block.

A Rule action also executes BeanShell code, but the code is encapsulated in a reusable IdentityIQ Rule object rather than embedded directly in the workflow. This is preferable when logic needs to be reused, separately maintained, or invoked by multiple workflows or other IdentityIQ components.

IdentityIQ distinguishes these action types from Subprocess , which launches another Workflow object, and Call Method , which invokes a compiled Java method exposed through the IdentityIQ workflow library.

SailPoint ' s workflow documentation explicitly describes Script as executing Java BeanShell code and Rule as executing a reusable workflow Rule containing Java BeanShell code. Therefore, the proposed statement accurately characterizes both action types.

References/topics: IdentityIQ Engineer — Workflow Step actions, Script, Rule, BeanShell, Subprocess, Call Method, Business Process Editor.

This statement is incorrect. IdentityIQ supports extended identity attributes, but searchable extended attributes are not unlimited. Searchable identity attributes require database-backed indexed placeholder properties defined in the extended Hibernate mapping and exposed through Identity Attribute configuration. The Word bank already states the correct limitation: when defining identity mappings under Global Settings > Identity Attributes, only 12 additional searchable attributes can be defined; additional identity attributes and mappings may exist, but they cannot all be searchable. The proposed solution says an unlimited number of additional searchable placeholder extended attributes can be added beyond the 10 shown, which contradicts the searchable-attribute limitation. Engineers must plan identity schema extensions carefully because searchable attributes affect database schema, indexing, performance, and UI search behavior. Adding unlimited searchable placeholders would create maintainability and performance problems and is not supported as a general installation design. References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended identity attributes, searchable attributes, identity mappings, schema planning.

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)

Yes. Importing SailPoint XML objects can be performed through supported IdentityIQ import mechanisms, and using the user interface path Global Settings > Import From File is a valid approach for importing XML object definitions. XML imports are commonly used to move IdentityIQ configuration objects such as rules, workflows, applications, roles, policies, email templates, task definitions, and other SailPoint objects between environments. Engineers may also use the IdentityIQ console for imports, especially for larger or automated deployments, but the existence of the console method does not make the UI method invalid. The proposed solution is specifically asking whether selecting a file through Global Settings > Import From File is a valid step, and it is. The important caution is that imported XML should be reviewed carefully because object names, IDs, references, and environment-specific values can affect behavior after import. References/topics: IdentityIQ Engineer — XML object import/export, Global Settings import, configuration migration, deployment management.

Yes. Sub-workflows are an established IdentityIQ workflow-design mechanism for decomposing a large business process into smaller, reusable units. Instead of placing provisioning, approval, initialization, policy-checking, notification, and other logic into one oversized master workflow, an engineer can move logically independent functions into workflows designated as Subprocess workflows. The parent workflow then invokes those subprocesses at the appropriate processing steps.

SailPoint specifically identifies simplification of the master workflow as one of the benefits of subprocess workflows. The design also improves maintainability because individual subprocesses can be understood, tested, modified, and reused independently. Reusability is particularly important in Lifecycle Manager implementations because several business processes can require the same approval, provisioning, or initialization behavior. IdentityIQ workflow steps can use a Subprocess action to launch another defined workflow and wait until it completes. Variables and results can also be exchanged between parent and subprocess workflows.

The statement is therefore technically correct: subprocesses are not merely permitted; breaking complex workflows into manageable reusable components is a core reason for using them.

References/topics: IdentityIQ Engineer — Workflow Basics, subprocess workflows, master workflows, reusable business processes, Workflow Step action types.

=======

No. Whether an application supports password change requests through the IdentityIQ UI is not controlled by generic LCM workflow control variables. Password-change support depends on the application connector’s capabilities, password-management configuration, application settings, schema/support for password operations, policies, and QuickLink/user-interface configuration. The workflow may process or route a password-change request once launched, but it does not define which target applications support that operation. That capability must be configured at the application/connector and password-management layer. Mixing these layers would create a brittle design: workflow variables should govern execution behavior, while application configuration defines available account operations. Therefore, the proposed solution is not achievable merely by configuring out-of-the-box LCM workflow control variables. References/topics: IdentityIQ Engineer — password management, application connector capabilities, LCM workflows, QuickLink password change, account operation support.

This proposed implementation is not valid as written. The logic is conceptually understandable, but the XML structure is not the correct IdentityIQ workflow transition pattern. In IdentityIQ workflows, transitions are normally declared using < Transition > elements with a destination, such as to= " StepName " , and optional conditional logic through a when expression or scripted evaluation. A raw < Source > block directly inside < Transition > returning destination names is not the standard structure for expressing multiple workflow routing paths after a form step. The engineer’s requirement is to route to Stop when the reject/back action is used, route to Audit when approval occurs and the comment variable is populated, and route to Provision as the fallback. That should be implemented as separate transition definitions with explicit destination steps and conditions. The proposed XML does not properly bind the returned values to valid transition destinations in the expected workflow syntax. References/topics: IdentityIQ Engineer — workflow XML, transition elements, form step routing, BeanShell expressions, Business Process Editor.

No. An Account Group is not a mechanism for selecting a particular subset of user accounts during an Account Aggregation. IdentityIQ distinguishes between Account Aggregation and Account Group Aggregation . Account Aggregation reads account records from the target application and creates or updates Link objects, including the account ' s attributes and entitlements. The population or scope of accounts being aggregated is controlled by connector/application configuration such as search scope, source filters, iteration filters, partitions, or other connector-specific aggregation parameters.

Account Group Aggregation has a different purpose. It reads group or application-object information from applications that have an appropriate group schema. The resulting group information is used to represent governed entitlement objects, support group certifications, and expose group-related information within IdentityIQ.

Consequently, an Account Group is not used as a selector for saying “aggregate these particular accounts” during an Account Aggregation. That requirement must be implemented through the account aggregation configuration itself.

References/topics: IdentityIQ Engineer — Account Aggregation, Account Group Aggregation, Link objects, aggregation filters, group schemas.

=======

No. A standard Correlation Rule and a Manager Correlation Rule perform different functions in IdentityIQ. The scenario specifically requires resolving a manager reference—an employee ' s manager employee number must be matched to the correct Identity despite several employee-number formats. That is manager correlation, not ordinary account-to-identity correlation.

A Correlation Rule is used when IdentityIQ needs custom logic to associate an application account with an Identity and simple attribute-based account correlation is insufficient. By contrast, SailPoint defines a Manager Correlation Rule specifically for establishing the Manager–Direct Report relationship between Identity objects when simple manager attribute mapping cannot accommodate the required matching logic.

Here, the presence of several employee-number formats is exactly the type of complexity that makes custom manager-correlation logic appropriate. The rule can normalize or otherwise interpret those formats and return the identity representing the correct manager.

This proposition is separate from the earlier video proposition using “Write a ManagerCorrelation rule,” which is the correct solution. Under DOMC rules, changing the proposed rule type creates a separate question.

Therefore, writing a generic Correlation Rule does not correctly target the required manager-resolution process.

References/topics: IdentityIQ Engineer — Manager Correlation Rule, Correlation Rule, manager relationships, application aggregation, account correlation, Identity Cube relationships.

=======

Yes. Identity Attribute Changes are explicitly included among IdentityIQ ' s configurable built-in audit categories. Audit collection is not universally enabled for every possible event because recording large quantities of audit information has storage and performance implications. Administrators therefore select the activities that need to be captured through IdentityIQ ' s Audit Configuration.

SailPoint ' s IdentityIQ documentation lists several categories of auditable actions, including General Actions, Link Attribute Changes, Identity Attribute Changes , Class Actions, and SCIM Resource Actions. The Identity Attribute Changes category includes changes to identity-related information such as assigned roles, capabilities, authorized scopes, controlled scopes, passwords, and potentially configured extended identity attributes. Once the appropriate audit actions are enabled, resulting audit events can be searched through Advanced Analytics using the Audit search type.

This is different from merely enabling general application logging. Audit records provide governance-oriented evidence of defined actions, whereas application/server logging is primarily operational and diagnostic. Consequently, the proposition that built-in IdentityIQ audit functionality supports auditing Identity Attribute Changes is directly supported by the product configuration model.

References/topics: IdentityIQ Engineer — Audit Configuration, Identity Attribute Changes, Audit events, Advanced Analytics Audit search, governance logging.

=======

Yes. LCM provisioning workflows contain control behavior for handling provisioning operations that are not completed synchronously. A queued result is materially different from a failed result: IdentityIQ has successfully submitted the request into a provisioning path, but the downstream operation has not necessarily completed yet.

LCM processing can therefore be configured so that asynchronous/queued provisioning does not cause the overall request workflow to be treated as an immediate provisioning failure. This is important for connectors and integrations where target operations are queued, brokered, or fulfilled asynchronously. Otherwise, the workflow could incorrectly follow failure handling merely because the target-system change was not completed during the same execution thread.

The engineer must still distinguish this from claiming that the target access has definitely been provisioned. “Successful” at this workflow stage means the request was accepted into the expected provisioning process. Subsequent transaction processing, retries, aggregation, or request maintenance can establish the final state.

This is precisely why provisioning status management is a workflow concern, whereas whether an application supports a particular account operation is an application/connector concern.

References/topics: IdentityIQ Engineer — LCM provisioning workflows, asynchronous provisioning, queued provisioning status, ProvisioningProject, provisioning transaction status, request maintenance.

=======

Yes. IdentityIQ provides audit configuration capabilities through the user interface so administrators can manage much of the platform’s audit behavior without directly editing XML for every standard case. Audit configuration is used to control which events or actions are captured, allowing organizations to record relevant administrative, governance, provisioning, workflow, and compliance activity. This is important because excessive auditing can create unnecessary database volume and noise, while insufficient auditing can leave gaps in troubleshooting and compliance evidence. For standard audit controls, the Audit Configuration page is the normal administrative place to manage audit behavior. However, this does not mean every custom audit requirement can be completed only through the UI. Custom audit actions, custom reports, or custom rule/workflow audit writes may still require XML or BeanShell work. The statement says the majority of auditing is managed through the UI page, which is valid for standard IdentityIQ auditing operations. References/topics: IdentityIQ Engineer — Audit Configuration, audit events, audit actions, compliance evidence, custom audit extension.

Yes, the current version and patch level of IdentityIQ can be found through the Debug-About page. The Debug-About page in SailPoint IdentityIQ provides critical information about the system, including the software version, patch level, and other configuration details. This page is a useful resource for administrators to quickly verify the IdentityIQ version and ensure that the correct patches have been applied.

Therefore, the correct answer is A. Yes.

Rapid Setup does allow for specifying account correlation by mapping an identity attribute to an account attribute. This is a standard part of the onboarding process where you define how IdentityIQ should correlate accounts to identities. This basic mapping functionality is included in Rapid Setup to facilitate straightforward account correlation during application onboarding.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Mapping Sections)

Certifying user expense reports is not a purpose of IdentityIQ certification. IdentityIQ certifications are focused on access and identity governance, specifically reviewing and validating user access rights within systems. Expense report certification would be a different process, typically managed by financial or expense management systems, not by IdentityIQ.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

Yes. In IdentityIQ, a ManagedAttribute represents managed entitlement metadata associated with an application attribute/value, and it can have an Identity object assigned as its owner . Ownership is an important governance property because the entitlement owner can participate in approval routing, certifications, access-request decisions, remediation, and general accountability for the managed access.

This does not mean every ManagedAttribute is automatically owned by an Identity, nor does it mean its owner must be the same identity that owns the associated Application. Application ownership and entitlement ownership are independent governance relationships. For example, an Active Directory application may have one application owner while individual AD groups represented as ManagedAttributes have different business owners.

The wording “can have” is therefore important. IdentityIQ supports an Identity as the owner of the ManagedAttribute. Depending on configuration, ownership can be populated manually, through aggregation/customization, or through entitlement-management processes.

Do not confuse this relationship with the ManagedAttribute ' s required application context: the ManagedAttribute identifies governed access originating from an Application, while its owner identifies responsibility for that access.

References/topics: IdentityIQ Engineer — ManagedAttribute object, Entitlement Catalog, entitlement ownership, Application ownership, approval routing, entitlement certifications.

=======

Yes. Reviewing provisioning transactions and their processing states is a principal purpose of the Provisioning tab in the IdentityIQ Administrator Console. The engineer can use this administrative view to inspect provisioning activity and distinguish transactions according to states such as pending, failed, or completed/successful.

This visibility is particularly important for troubleshooting asynchronous provisioning. A failed transaction may require investigation into connector errors, target-system responses, invalid attribute values, authentication failures, or workflow/provisioning-plan problems. A pending transaction may indicate queued processing or an operation awaiting further execution. Successful transactions provide confirmation and historical visibility into completed processing.

The Provisioning tab is therefore an operational troubleshooting interface for provisioning transactions; it is not merely a configuration page.

This should also be distinguished from another proposition already present in the Word bank: the bank explicitly states that the Provisioning tab can be used to manually retry the provisioning attempt for pending transactions . The video proposition here tests a different capability—viewing transactions across their various states—so it remains a separate DOMC item.

References/topics: IdentityIQ Engineer — Administrator Console, provisioning transactions, failed provisioning, pending transactions, transaction history, provisioning troubleshooting.

=======

Schedule Policy Composition Certification is not a valid action for handling an individual Account Policy violation. A policy violation owner acts on a violation by making a decision about that violation: allow it, remediate it, mitigate it, or route it according to configured compliance processes. A Policy Composition Certification is a separate governance activity used to review the construction or definition of policies; it is not an immediate action available on a single violation record. The proposed solution also mismatches the policy type. The stem concerns an Account Policy violation, which typically relates to account-count or account-condition rules, not policy-composition review. The Word bank separately identifies Account policies as limiting the number of accounts a user can have on a system. Scheduling a certification might help long-term governance hygiene, but it does not dispose of the current policy violation. References/topics: IdentityIQ Engineer — Account Policy violations, violation owner actions, certification types, policy composition certification, compliance remediation workflow.

This statement is false. BeanShell rules in IdentityIQ do not universally have to produce a meaningful output. A rule’s expected return behavior depends on the rule type and the context in which the rule is executed. Some rules are designed to return a Boolean, String, Map, ProvisioningPlan, Identity, or another object. Other rules perform side effects, such as modifying a plan, transforming values, logging, altering an object, or executing validation logic, and may return null or no useful result. The Word bank contains a related but different rule-output concept: a BeanShell rule does not always need to return an object derived from sailpoint.object.SailPointObject; it may return several other object types or null. The proposed statement is even broader and still incorrect because IdentityIQ rule output is rule-type dependent, not mandatory in a generic sense. References/topics: IdentityIQ Engineer — BeanShell rules, rule registry, return values, rule execution context, input/output contracts.

Yes. IdentityIQ reports are closely tied to the platform’s task framework. Out-of-the-box report templates are represented as task/report definitions, and these definitions describe how the report is executed, what arguments or filters it accepts, and how the resulting report instance is generated. In IdentityIQ, scheduled and executable background operations commonly use TaskDefinition objects, and reporting is implemented through this same general task infrastructure. A report definition is not the same thing as a generated report result. The TaskDefinition defines the report template or executable report behavior, while a run of that report creates task/report result data. This distinction matters because an engineer may inspect, export, import, customize, or troubleshoot report definitions through IdentityIQ objects. The proposed statement is therefore valid for out-of-the-box reports as report definitions/templates. References/topics: IdentityIQ Engineer — reporting framework, TaskDefinition objects, report templates, task execution, generated report results.

Yes. In IdentityIQ workflow processing, a wait step is not simply a client-side pause or a frozen browser session. The workflow case is persisted and resumed after the wait condition has elapsed and the maintenance process revives eligible workflow cases. A wait= " 1 " attribute represents a minimum wait period, and the workflow does not necessarily resume at the exact instant the wait expires. It resumes when IdentityIQ’s background maintenance processing detects that the wait period is over and advances the workflow. That is why the wording says “at least one minute” and “on the next run of the Perform Maintenance Task.” This distinction matters operationally: workflow timing depends on both the configured wait value and the maintenance task schedule. Engineers should not use wait steps when exact real-time execution is required. References/topics: IdentityIQ Engineer — workflow wait attribute, persisted workflow cases, Perform Maintenance task, background workflow resumption, workflow step behavior.

This statement is incorrect. In SailPoint IdentityIQ email templates, entire blocks of text, including whole paragraphs, can indeed be conditionally included or omitted using the appropriate templating syntax such as #if, #else, and #end. The templating engine in IdentityIQ, which typically uses Apache Velocity, supports complex conditional logic that can control large sections of the email content, not just individual lines.

Adding a new object attribute to the Application ObjectConfig in IdentityIQ is not sufficient on its own to generate the database script needed to extend Application attributes. This action updates the configuration within IdentityIQ for how the application object is managed, but it does not produce the necessary SQL scripts to modify the underlying database schema. The actual database schema must be extended using specific IdentityIQ tools and commands like iiq extendedSchema.

SailPoint IdentityIQ Configuration Guide (ObjectConfig and Schema Management)

SailPoint IdentityIQ Administration Guide (Database Schema Extension)

Reassigning all object ownership to a user’s manager during Leaver and Termination events is a complex process that typically involves custom logic or workflows to ensure that all owned objects (like access, certifications, roles, etc.) are correctly reassigned.

The Rapid Setup interface is primarily designed for standard lifecycle management tasks, such as role assignments, account enabling/disabling, and certifications. It does not inherently support the automatic reassignment of object ownership based on lifecycle events such as Leaver and Termination events.

This kind of reassignment would typically require a custom rule or workflow to track and reassign all owned objects, which falls outside the scope of what Rapid Setup can handle directly. Therefore, the correct answer is B. No.

Yes. A String attribute type is appropriate for an account attribute whose value must be derived from application account data such as a privileged attribute and a responsibility-code attribute and subsequently consumed by IdentityIQ analytics, rules, and policy logic.

The source requirements indicate that IdentityIQ needs a persistable account-level value that can represent the result obtained or calculated from those source attributes. A String provides a suitable representation for values such as classification codes, privileged-state labels, responsibility codes, or normalized flag values and can be compared by BeanShell rules, search filters, and policy constraints.

This configuration does not by itself satisfy the entire requirement. Source mapping/calculation must also be configured correctly. The Word bank already contains this same stem with Source Mappings: Application Rule and recognizes that source-processing configuration as necessary, while separately evaluating Edit Mode: Read Only.

DOMC evaluates each proposition independently: the fact that other configuration settings are also necessary does not make Attribute Type: string invalid.

References/topics: IdentityIQ Engineer — account attributes, attribute data types, application-rule source mapping, Advanced Analytics, rules, policy attributes.

No. IdentityExtended.hbm.xml defines extended persistence mappings for additional Identity attributes; it does not represent the complete set of attributes available on the Identity object. Therefore, seeing custom mappings such as employeeId and status in the displayed configuration does not mean that these are the only identity attributes in the installation.

IdentityIQ requires several fundamental identity attributes for normal product operation. SailPoint specifically identifies core attributes including ID, manager, email, firstname, and lastname in Identity Mapping configuration. These standard properties exist independently of customer-defined extended fields. The numbered extended properties and custom named properties shown in IdentityExtended.hbm.xml supplement that standard Identity object model rather than replacing it.

The Word bank contains a different proposition for this same IdentityExtended.hbm.xml scenario concerning how many additional searchable attributes can be configured, demonstrating that the extended mapping is specifically concerned with schema extension rather than defining the entire Identity object.

Therefore, the conclusion that firstname and lastname would be missing simply because they are not shown in this extended mapping is incorrect.

References/topics: IdentityIQ Engineer — Identity object, Identity Mappings, IdentityExtended.hbm.xml, core identity attributes, extended attributes, searchable attributes.

=======

No. Setting the length of an IdentityIQ extended String attribute to 9000 is not a supported general mechanism for storing an identity image. The length value in IdentityExtended.hbm.xml influences how Hibernate maps the String property to a database column. It therefore has database-specific consequences and must not be treated as an arbitrary storage-capacity control.

The standard IdentityIQ extended-attribute configuration uses String properties with much smaller lengths—for example, length= " 450 " —specifically so the resulting columns remain suitable for searching and indexing. SailPoint ' s own configuration commentary warns that database platforms have different VARCHAR limitations and that sufficiently large String definitions may cause Hibernate to map the value to a LOB/blob-like type that cannot be used in the same way for searches.

An image is binary content and should not be modeled merely by making an extended searchable String column extremely large. Even an encoded image can exceed practical database/index limits and introduces unnecessary Identity Cube and persistence overhead.

Therefore, length= " 9000 " is not a prescribed IdentityIQ image-storage configuration.

References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended properties, Hibernate mappings, VARCHAR limits, searchable attributes, database schema design.

=======

In SailPoint IdentityIQ, every Link object, which represents an account on an application for an identity, must be associated with an Identity object. The Link object is inherently tied to an identity, as it is a representation of that identity’s account on a target system. Without this association, the Link would not have context within IdentityIQ. This is a fundamental aspect of IdentityIQ ' s data model. Refer to the SailPoint IdentityIQ Data Model documentation for detailed information on the relationships between Link objects and Identity objects.

Yes. IdentityIQ ' s authorization model uses granular SPRights and higher-level Capabilities to control access to product functions. SPRights govern access to menus, tools, tabs, pages, and individual operations. Capabilities group one or more of those rights into logical sets that can be assigned according to job responsibilities.

A capability can be assigned directly to an Identity through the identity ' s User Rights configuration. Capabilities may also be inherited indirectly through workgroup membership. Therefore, the capabilities available to a logged-in identity are one of the mechanisms IdentityIQ uses to determine which product features that user can see and what administrative or operational actions the user can perform.

Capabilities should not be confused with Scopes . Scopes constrain the objects or portions of the environment to which a user has visibility or control, whereas capabilities determine the functions/features the user is authorized to use. The two mechanisms can operate together.

SailPoint documentation explicitly states that identities can have capabilities assigned directly and that capabilities determine which IdentityIQ features users can access.

References/topics: IdentityIQ Engineer — SPRights, Capabilities, User Rights, authorization, workgroup-inherited rights, scopes.

=======

Yes. This implementation follows the essential IdentityIQ transaction-locking pattern for modifying a persistent SailPoint object. ObjectUtil.transactionLock() retrieves the named Policy object while obtaining a transaction-level database lock. A transaction lock is appropriate when processing needs exclusive access to an object for the duration of a short transaction and must prevent another transaction from updating the same object simultaneously.

After obtaining the locked Policy object, the engineer performs the required changes and then calls context.saveObject(object). saveObject() persists changes to an object derived from SailPointObject; however, persistence is not complete until the transaction is committed. The subsequent context.commitTransaction() therefore completes the modification and releases the transaction-level database lock as the transaction finishes.

SailPoint ' s documented transaction-lock example follows essentially the same sequence: obtain the object using ObjectUtil.transactionLock, modify it, invoke context.saveObject, and commit. Calling context.decache(object) afterward may be useful to remove the object from the context cache, particularly in longer-running processing, but its omission does not invalidate this basic implementation.

References/topics: IdentityIQ Engineer — ObjectUtil, transaction locking, Policy objects, SailPointContext persistence, object save/commit lifecycle.

=======

No, the " Email Protocol " is not a setting that an engineer must set up to ensure successful communication with the SMTP server. Instead, the essential settings include the mail server address, port, authentication details (like username and password if required), and possibly the security settings (such as SSL/TLS). While the email protocol (e.g., SMTP) is implicitly involved, it is not a specific setting that needs to be configured separately within IdentityIQ. The critical setup revolves around configuring the mail server connection parameters.

SailPoint IdentityIQ Configuration Guide (Email and Notification Settings)

SailPoint IdentityIQ Administration Guide (SMTP Configuration for Email Notifications)

Yes. Policy checking behavior is one of the areas commonly controlled in LCM request workflows through workflow variables or configuration controlling policy evaluation mode. IdentityIQ can evaluate whether a requested access change would violate configured policies before the request is finalized or provisioned. Depending on configuration, the system can present policy violations to the requester, block submission, continue with warnings, or require additional approval/mitigation. The proposed behavior — checking whether an access request would violate policies and letting the requester review before submitting — aligns with interactive policy-checking behavior in LCM. This is an execution behavior of the request workflow, not an application schema setting. The engineer must still ensure policies are configured and enabled, but the workflow/control-variable layer can determine how those checks are applied during request submission. References/topics: IdentityIQ Engineer — LCM workflow control variables, policy checking, request policy violations, interactive policy review, access request governance.

In SailPoint IdentityIQ, certain objects, such as the Link object, cannot be directly extended by updating the corresponding .HBM (Hibernate Mapping) file. Modifying or extending core IdentityIQ objects typically requires a deeper level of customization involving the extension of the application schema and possibly custom Java code. The .HBM files are part of IdentityIQ ' s internal persistence framework, and altering them is not a supported or recommended method for extending objects in a production environment. Customization should instead be done using SailPoint’s supported extension points, such as using ManagedAttributes or CustomAttributes within the IdentityIQ application framework. For guidelines on extending IdentityIQ objects, refer to the SailPoint IdentityIQ Customization Guide and best practices documentation.

Top of Form

Bottom of Form

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

The statement that " the staging period is required " for certifications is not true. In SailPoint IdentityIQ, the staging period is an optional phase during the certification campaign configuration. The staging period is used to pre-generate certifications and allow for any preparatory actions or adjustments before the certifications are officially launched and sent to reviewers. However, it is not a mandatory component for all certification campaigns.

Administrators may choose to bypass the staging period entirely depending on the specific requirements of the certification process or the urgency of the certification campaign. Therefore, while the staging period can be beneficial for managing large or complex certifications, it is not a required step.

SailPoint IdentityIQ Certification Overview Guide

SailPoint IdentityIQ Administration Guide (Sections on Certification Configuration and Staging Period)

The correct order for performing an initial installation of SailPoint IdentityIQ is:

Ensure all of the application servers are stopped.

Stopping all application servers is crucial to prevent any conflicts or transactional interference during the installation process.

Un-jar the IdentityIQ WAR file in the desired directory of each application server.

Extract the IdentityIQ WAR file in the appropriate location for the application server. This step deploys the IdentityIQ application code.

Configure iiq.properties file with database credentials and datasource.

The iiq.properties file must be updated with correct database credentials and datasource configurations to establish a connection to the IdentityIQ database.

Create the IdentityIQ database.

A new IdentityIQ database must be created for the system. This is the foundation where all IdentityIQ data will be stored.

Generate database schema to include custom attributes by executing ' iiq schema ' .

Use the iiq schema command to generate the necessary database schema. This includes tables, constraints, and other structural components for IdentityIQ.

Initialize default IdentityIQ system objects from ' iiq console ' using the ' import ' command.

Import default system objects like roles, policies, and configuration settings using the IdentityIQ console’s import feature. This sets up the base configuration.

Start all of the application servers.

Once everything is configured, start the application servers to make the IdentityIQ application available.

Apply the latest patch.

Finally, apply any patches to ensure the system is up to date with the latest security and feature enhancements.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Stopping all application servers is necessary to avoid file locks and ensure the WAR deployment and database setup processes can proceed smoothly.

Un-jarring the WAR file deploys IdentityIQ into the server directory structure, making its code accessible for execution.

Configuring the iiq.properties file connects IdentityIQ to the database, establishing where it will read and write data.

Creating the database is fundamental, as the IdentityIQ system relies on a structured data environment.

Generating the database schema via iiq schema builds out the tables and structures necessary for storing identity, access, and policy data.

Initializing system objects sets up core elements of IdentityIQ (like roles, capabilities, and system configurations) required for its operation.

Starting the application servers activates the IdentityIQ environment, allowing the system to begin processing requests.

Applying the latest patch ensures that the installation is up-to-date with all bug fixes, enhancements, and security updates from SailPoint.

SailPoint IdentityIQ Installation Guide (steps on fresh installation and post-installation configurations).

No. Updating the original shipped HTML file is not the general IdentityIQ configuration mechanism for changing UI settings or branding. IdentityIQ exposes different customization mechanisms depending on what the engineer needs to modify. For example, table presentation can be controlled through UIConfig and ColumnConfig, login-page text can be driven through message-catalog keys, and styling or branding can be implemented through supported CSS or branding mechanisms. The existing question bank itself distinguishes these configuration mechanisms: it identifies ColumnConfig for table display and message-catalog keys for login-page text.

The bank also notes that primary and secondary color behavior is associated with custom CSS/branding rather than the IdentityIQ Configuration > Miscellaneous page.

Direct modification of original product HTML/XHTML resources is also poor upgrade practice because shipped web resources can be replaced during patches and version upgrades. Supported configuration objects, message catalogs, CSS customization, or plugin UI mechanisms provide safer and more maintainable extension points.

References/topics: IdentityIQ Engineer — UIConfig, ColumnConfig, message catalogs, CSS, branding, upgrade-safe UI customization.

Yes. If a user already has an account on an application and needs the ability to request an additional/new account through Manage User Access, the relevant LCM/QuickLink configuration must permit requesting new accounts. The proposed setting, “Allow requesting new accounts,” is specifically aligned with that requirement. Manage User Access and Manage Accounts behavior is controlled through Lifecycle Manager quicklink and population configuration, which determines what actions are visible and available to eligible users. Without enabling new-account requests for the appropriate QuickLink population, the user may only be able to manage existing account access or request entitlements for current accounts, not initiate a new account request on that application. This setting must also align with the application’s provisioning support and account creation policy. The configuration grants the UI/request capability; successful fulfillment still depends on application schema, create policy, approvals, and provisioning workflow. References/topics: IdentityIQ Engineer — LCM, Manage User Access, Manage Accounts QuickLink, QuickLink population, new account request, provisioning policy.

No. IdentityIQ does not require a dedicated Catch step to accompany every individual workflow step capable of throwing an exception. Such a requirement would make workflows unnecessarily verbose and would not reflect normal workflow exception-handling design.

Workflow steps can execute scripts, rules, subprocesses, methods, approvals, and other operations, many of which can theoretically throw runtime exceptions. Exception handling can be designed at an appropriate level depending on the workflow ' s requirements. BeanShell logic can explicitly use exception handling where necessary, subprocess behavior can be handled by the calling process, and workflow-level failure processing can deal with unhandled exceptions.

A Catch construct is useful when the workflow needs to intercept a particular failure and intentionally route execution into recovery, cleanup, notification, auditing, or another controlled path. It is therefore an exception-handling mechanism , not a mandatory companion to every potentially failing step.

The Word bank already tests other workflow-step semantics, including the available Script, Rule, Subprocess, and Call Method actions; those are separate concepts from mandatory exception handling. The universal wording “must accompany every step” makes this proposition false.

References/topics: IdentityIQ Engineer — workflow step types, exception handling, Catch processing, BeanShell exceptions, subprocess failure handling, workflow error paths.

IdentityIQ supports localization, allowing custom messages to be retrieved using SailPoint APIs within custom Java or BeanShell code. This capability is useful for creating applications that need to support multiple languages or regional formats. The SailPoint APIs provide methods to retrieve localized messages based on the current user ' s locale settings or other localization contexts.

Thus, the correct answer is A. Yes.

No. Create Entitlement is not one of the standard IdentityIQ Lifecycle Manager batch request operation types used for bulk access cleanup. The requirement concerns modifying users ' access: some identities need entitlements added while others need excessive access removed. IdentityIQ provides specific batch operations for those tasks.

SailPoint ' s supported batch request operations include Create Identity, Modify Identity, Create Account, Delete Account, Enable/Disable Account, Unlock Account, Add Role, Remove Role, Add Entitlement , Remove Entitlement , and Change Password. “Create Entitlement” does not appear as a standard batch request operation in this list. The distinction is fundamental: an entitlement is a governed access value represented through the application schema and usually as a ManagedAttribute in the Entitlement Catalog. Creating or maintaining that entitlement definition is different from granting an existing entitlement to identities.

For the described regional cleanup, Add Entitlement can repair missing access and Remove Entitlement can revoke excessive access. Therefore, “Create Entitlement” does not represent the appropriate supported batch request type and the proposed solution is false.

References/topics: IdentityIQ Engineer — Lifecycle Manager Batch Requests, AddEntitlement, RemoveEntitlement, ManagedAttribute versus entitlement assignment, bulk remediation.

=======

No. IdentityIQ upgrades do not automatically rewrite customer-developed Java or BeanShell code when APIs or methods become deprecated. Deprecation indicates that an API is obsolete, replaced, or scheduled for eventual removal; it does not provide automatic source-code migration.

Before an upgrade, an engineer must inventory custom rules, workflow scripts, plugins, libraries, connector customizations, Java classes, and other code that calls IdentityIQ APIs. Release notes, upgrade documentation, and API changes must then be reviewed to identify deprecated or removed methods. References to affected methods must be manually evaluated and, where necessary, refactored to use the supported replacement API. The resulting customizations must be compiled or executed and regression-tested against the target IdentityIQ release.

This matters particularly for BeanShell because many errors are discovered at runtime rather than during a traditional compilation phase. Assuming automatic conversion could therefore result in broken workflows, aggregation rules, provisioning logic, or plugins after the upgrade.

Therefore, custom method references are the implementation team ' s responsibility and are not automatically updated by the IdentityIQ upgrade.

References/topics: IdentityIQ Engineer — upgrade planning, API compatibility, deprecated methods, BeanShell customization, custom Java code, regression testing.

=======

Yes, the typical input variables for a rule are listed in the BeanShell rule editor in IdentityIQ, based on the rule registry. When you create or edit a rule in IdentityIQ using the BeanShell editor, the available input variables that are relevant to the rule type are typically pre-defined and listed based on the rule registry. These input variables provide context and data that the rule can operate on, and their availability helps guide the rule development process.

Therefore, the correct answer is A. Yes.

No. To permit users to unlock accounts through the Manage Accounts interface, the relevant Lifecycle Manager configuration is the Unlock Manage Account Action. Selecting a Rehire action does not configure the account-unlock operation described in the requirement.

IdentityIQ ' s Lifecycle Manager Configuration includes explicit Manage Account Actions for Delete, Disable, Enable, and Unlock . Administrators choose which of these operations users can request for themselves and, where authorization permits, for subordinates. If Unlock is deselected, that type of Manage Accounts request is unavailable.

Rehire is a lifecycle concept associated with restoring access for an identity returning to the organization; it is not the configuration switch that enables an account-unlock request. Unlock specifically addresses a target account that is locked while otherwise remaining an existing account.

This question is easy to mistake for the existing Word-bank question because the proposition is identical. However, the existing item asks about enabling an account, not unlocking one. Under the required DOMC comparison, that change in the stem makes this a distinct question.

Therefore, the proposed Rehire configuration does not meet the unlock requirement.

References/topics: IdentityIQ Engineer — Lifecycle Manager Configuration, Manage Accounts, Unlock Account, Enable Account, account actions, subordinate account management.

An AfterProvisioning rule in SailPoint IdentityIQ is typically used to execute custom logic after the provisioning process has been completed successfully. However, if provisioning fails, this rule will not be triggered because it is specifically designed for post-successful provisioning activities. To log an error message in the audit record when provisioning fails, a better approach would be to use a provisioning error handler or configure a specific workflow that captures errors and logs them accordingly. The AfterProvisioning rule is not the correct solution for this use case. Refer to the SailPoint IdentityIQ Provisioning and Workflow documentation for appropriate methods of handling provisioning errors and audit logging.

This statement is correct. IdentityIQ uses rule types and rule metadata to guide engineers when creating or editing rules. The Rule Registry describes expected rule behavior, including contextual information such as the rule’s purpose, expected inputs, and often the intended output or return behavior. This is important because IdentityIQ rules are not generic scripts running in isolation; they execute in specific product contexts such as aggregation, correlation, provisioning, workflow, certification, policy evaluation, or lifecycle processing. The rule editor can expose information derived from the rule registry so that an engineer understands which variables are available and what the rule is expected to return. This reduces implementation errors, especially in DOMC-style topics where a wrong return type or missing context variable can cause runtime failures. The Word bank separately confirms that the BeanShell rule editor lists typical input variables based on the rule registry. References/topics: IdentityIQ Engineer — Rule Registry, BeanShell rule editor, rule metadata, expected inputs, expected outputs.

Based on the goals and scheduling parameters provided, the tasks should be scheduled in the following order to achieve efficient processing for a 24-hour period:

1st Check Expired Work Items (12:00 AM)

This task runs at midnight to check for expired work items. It’s important to run this first to clean up any pending tasks from the previous day.

1st Perform Identity Request Maintenance (2:00 AM)

This maintenance task is scheduled at 2:00 AM, a time when the system is least likely to be under load.

1st Aggregate Employee Authoritative Application (5:00 AM)

The aggregation for the Employee Authoritative application starts early in the day, at 5:00 AM.

1st Aggregate Contractor Authoritative Application (5:10 AM)

The Contractor Authoritative application aggregation is scheduled 10 minutes after the Employee aggregation, as per the goals.

1st Identity Refresh (5:20 AM)

Active Directory aggregation runs next at 5:20 AM.

2nd Aggregate Employee Authoritative Application (12:00 PM)

The second run for the Employee Authoritative application happens at noon.

2nd Aggregate Contractor Authoritative Application (12:10 PM)

At 12:10 PM, the Contractor Authoritative application runs again for its second aggregation.

2nd Identity Refresh (12:20 PM)

The second aggregation for Active Directory happens at 12:20 PM.

1st Aggregate Finance Authoritative Application (8:00 PM)

The Finance application aggregation is scheduled for 8:00 PM, which aligns with the goal of processing it in the evening.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Check Expired Work Items (12:00 AM)

This task is run first to ensure any expired or pending work items from the previous day are cleared out and do not interfere with the new day’s tasks. Running it at midnight ensures that any workflows or approvals with expirations are processed efficiently.

Identity Request Maintenance (2:00 AM)

This is a maintenance task that keeps the system running smoothly by managing identity requests. Scheduling it at 2:00 AM minimizes interference with other key business tasks since it ' s an off-peak hour.

Authoritative Application Aggregations (Employee/Contractor/Active Directory)

The authoritative applications (Employee, Contractor, Active Directory) need to be processed twice a day: once early in the morning and once at noon. Each aggregation must follow the specified order, as it ensures that the data flow is properly managed from the more critical Employee applications to the less frequent Contractor and Active Directory ones.

Finance Application (8:00 PM)

The Finance application is aggregated once a day, in the evening, after other high-priority applications have been processed. This ensures that financial data is up to date for reporting and compliance purposes, without overlapping with the core workday processes.

SailPoint IdentityIQ Scheduler Documentation (section on task scheduling and run-time configuration).

Yes, this is indeed one of the primary purposes of an IdentityIQ certification. Certifications are conducted to attest to a user ' s system access, ensuring that each user has appropriate and justified access rights to applications, data, and systems within the organization. This is central to IdentityIQ’s access governance and compliance processes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

Yes. IdentityIQ supports certain UI branding customizations, but product attribution requirements still matter. If a customer removes SailPoint branding from a prominent UI location such as the header bar, the product attribution should still be preserved elsewhere, such as in the copyright footer with wording like “Powered by SailPoint IdentityIQ.” This reflects the distinction between cosmetic branding changes and removal of required product identification. From an engineering standpoint, UI customization should be implemented carefully so it survives upgrades as much as possible and does not violate branding, licensing, or support expectations. Teams should also document all branding changes because customized UI files are commonly impacted during upgrades and patching. The proposed statement is valid because it preserves SailPoint product attribution while allowing the customer to modify the visible header branding. References/topics: IdentityIQ Engineer — UI customization, branding requirements, copyright footer, upgrade-safe customization, customer-specific UI changes.