IdentityIQ-Associate SailPoint Certified IdentityIQ Associate Exam Question and Answers

The statement is true. In SailPoint IdentityIQ, manager relationships are an important part of the identity model and are frequently used by workflows. Once an identity’s manager is resolved through manager correlation, IdentityIQ can use that manager relationship in governance and request processes. A workflow may route an approval work item to the requester’s manager, notify the manager about a submitted request, request a decision during access approval, or involve the manager in lifecycle-related actions such as onboarding, transfer, or termination processing.

Managers are commonly used because they represent business accountability for a user’s access. For example, in an access request workflow, the manager may approve or reject requested roles, entitlements, or accounts before provisioning occurs. In certification workflows, managers may also be assigned review responsibility for their direct reports’ access.

Therefore, IdentityIQ workflows can interact with managers both for approvals and notifications. Reference topics: Identity Modeling — manager correlation and IdentityCube relationships; User-Driven Requests — approval routing; Provisioning — workflow-driven provisioning; Governance — manager certifications and access review ownership.

No. The “Detect deleted accounts” aggregation task option is not used to ignore accounts that were previously deleted from IdentityIQ. Its purpose is to compare the accounts returned by the current aggregation with the accounts already stored in IdentityIQ for that application. When an account exists in IdentityIQ but is no longer found in the authoritative aggregation results from the source application, IdentityIQ can treat that account as deleted or removed from the target system.

This option helps keep IdentityIQ’s account inventory accurate by identifying stale Links that remain in IdentityIQ even though the corresponding account is no longer present on the application. It is especially important for governance accuracy because certifications, policy checks, identity warehouse views, and access reporting rely on current account and entitlement data.

The statement is incorrect because it reverses the behavior. Detecting deleted accounts is about recognizing accounts missing from the source during aggregation, not ignoring newly returned source accounts that were once deleted in IdentityIQ.

Reference topics: Applications, aggregation task options, account aggregation, deleted account detection, Link maintenance, IdentityCube account data, and application data reconciliation.

The statement is not technically accurate. In SailPoint IdentityIQ, applications are defined to represent external systems, platforms, directories, databases, or resources from which account, group, entitlement, and attribute data are aggregated, and in some cases to which provisioning changes are written. IdentityIQ does not generally “read identities” directly from applications. Instead, it reads account records and associated attributes from applications, then uses identity correlation, authoritative-source logic, and identity refresh processing to construct or update IdentityCubes.

This distinction is fundamental. An application may be an authoritative source, such as an HR system, where account attributes contribute heavily to identity creation and lifecycle state. However, the object read from the source is still an account or source record, not an IdentityIQ identity object. The identity is modeled inside IdentityIQ after aggregation and correlation occur.

Therefore, the more precise statement is that applications represent systems from which IdentityIQ reads account and access data, not systems from which IdentityIQ simply reads identities. Reference topics: Applications, application definition, account aggregation, authoritative applications, correlation, IdentityCube creation, and Identity Modeling.

No. In SailPoint IdentityIQ, tasks are execution mechanisms used to perform system operations such as aggregation, identity refresh, certification generation support, report execution, maintenance processing, and other repeatable administrative jobs. A task can collect data, refresh calculated identity information, process objects, or execute configured logic, but it does not itself provide the business review function of confirming whether an account group provides the correct access.

Confirming that an account group provides appropriate access is a governance activity. That type of validation is performed through access reviews or certifications, where a designated reviewer evaluates group membership, permissions, ownership, or entitlement meaning and decides whether the access remains appropriate. This requires human or configured governance judgment, not simply execution of a background task.

A task may support the process indirectly by aggregating current account group data or preparing certification data, but the actual confirmation of correctness belongs to certification and governance review functionality.

Reference topics: Foundational Concepts, tasks versus workflows, Governance, certifications, account group reviews, access reviews, and Access Modeling.

Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed designates that the values discovered for that attribute are treated as managed entitlement values and promoted into the Entitlement Catalog. This is typically used for attributes that represent access, such as groups, roles, permissions, profiles, or other application-specific entitlement assignments. During aggregation, IdentityIQ reads account data from the application. When a schema attribute is marked as managed, the distinct values of that attribute can become ManagedAttribute objects, allowing IdentityIQ to govern them as cataloged access items.

This catalog promotion is important because raw technical values often need business context before they can be reviewed, requested, approved, certified, or reported on. The Entitlement Catalog can store metadata such as display name, description, owner, requestability, classification, and other governance attributes. These values then become usable in access certifications, access requests, reports, policy evaluation, and role modeling.

Therefore, the statement accurately describes the managed attribute function. Reference topics: Applications — account schema attribute properties; Access Modeling — entitlement catalog; Governance — certification content and entitlement review.

No. In SailPoint IdentityIQ, tasks are used to execute defined system operations, often as background or scheduled processes. Common task usage includes account aggregation, identity refresh, entitlement aggregation, maintenance activities, report execution, role processing, and other repeatable administrative operations. A task may calculate, update, import, refresh, or process data, but it does not itself perform the governance decision of confirming whether access in a role is correct.

Confirming that the correct access is included in a role is a governance review function, most closely associated with role certification, especially role composition certification. In that process, a role owner or designated certifier reviews the access profiles, entitlements, permissions, or requirements contained in a role and decides whether they are appropriate. The confirmation requires business judgment and reviewer action, not merely task execution.

A task may support role governance indirectly by refreshing role data or generating background processing, but the validation of role contents belongs to certifications and access governance. Therefore, this statement is not accurate for the use of tasks. Reference topics: Foundational Concepts, tasks versus workflows, Governance, role composition certification, Access Modeling, and role governance.

No. This definition describes a rule more closely than an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the centralized identity model that represents a person or non-person identity inside IdentityIQ. It contains consolidated identity information such as identity attributes, correlated application accounts, assigned and detected roles, entitlements, manager relationship, lifecycle state, policy violations, certifications, and other governance-relevant data.

A “snippet of code containing custom business logic” refers to a BeanShell rule. Rules are executable logic used to customize IdentityIQ behavior in areas such as aggregation, correlation, provisioning, policy evaluation, workflow processing, and identity attribute transformation. They are configuration objects containing code, while Identity Cubes are data/model objects representing identities and their access.

Therefore, the statement is inaccurate because an Identity Cube is not custom code. It is the core identity record used by IdentityIQ for governance, access modeling, policy detection, requests, certifications, and provisioning decisions.

Reference topics: Identity Modeling, IdentityCube contents, identity attributes, correlated accounts, roles and entitlements, BeanShell rules, Foundational Concepts, and IdentityIQ object model.

The statement is false. In IdentityIQ, an account attribute is defined within a specific application account schema and represents data stored on an account link for that application. Its value is obtained from the account data aggregated from that particular application connector. For example, an account attribute such asmemberOf,department,title, oraccountStatusbelongs to the account schema of a defined application and is populated from that application’s aggregation results.

The concept of sourcing values from several applications applies more directly to identity attributes, not account attributes. Identity attributes reside on the IdentityCube and may be derived from authoritative sources, account links, rules, mappings, or precedence logic across multiple applications. IdentityIQ uses identity attribute configuration to normalize data such as department, location, manager, email, or lifecycle state at the identity level.

Therefore, while multiple applications may contain similarly named account attributes, each account attribute value is tied to its own application account schema and account link. It is not a single shared account attribute sourced from several applications.

Reference topics: Applications — account schema attributes; Identity Modeling — identity attributes versus account attributes; Identity Refresh — updating IdentityCube attributes.

Yes. The Identity Warehouse in SailPoint IdentityIQ is used to display identity-centered information from the IdentityCube and related IdentityIQ object relationships. In addition to core identity attributes, accounts, roles, entitlements, manager relationships, and direct reports, IdentityIQ can show objects for which the identity is designated as the owner. Ownership is an important governance concept because owners may be responsible for approving access, maintaining roles, reviewing entitlements, managing applications, or participating in certification and remediation processes.

An object owner in IdentityIQ may be associated with configurable objects such as roles, applications, managed attributes, policies, or other governance-related items. Displaying owned objects from the identity view helps administrators and governance users understand the responsibilities assigned to that identity, not just the access held by the identity. This distinction matters because IdentityIQ models both “what access the identity has” and “what governance responsibilities the identity owns.”

Therefore, a list of objects the user owns is appropriately displayed in the Identity Warehouse when ownership relationships exist and the viewer has sufficient permission. Reference topics: Identity Modeling, IdentityCube contents, Identity Warehouse, object ownership, manager relationships, and governance responsibility modeling.

No. This definition does not describe an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the central identity record that represents a person or identity within IdentityIQ. It consolidates identity attributes, correlated application accounts, entitlements, assigned roles, detected roles, manager relationship, policy violations, lifecycle state, and other governance-relevant information. The Identity Cube is the primary object used by IdentityIQ to understand who a user is and what access that user has across connected systems.

The statement given describes provisioning, not an Identity Cube. Provisioning is the process of adding, removing, or modifying a user’s access on an application. Examples include creating an account, changing account attributes, adding an entitlement, removing group membership, disabling an account, or deleting an account.

Therefore, the definition is inaccurate because it describes an access-change process, while an Identity Cube is an identity data model. Reference topics: Identity Modeling, IdentityCube contents, application account correlation, entitlements, roles, Provisioning, account requests, and access-change fulfillment.

No. In the default IdentityIQ role model, role acquisition and role recalculation are not handled by the Perform Maintenance task. Role assignment and detection are primarily evaluated during identity refresh processing. The Identity Refresh task can update IdentityCubes, evaluate role assignment rules or role profiles, refresh detected roles, process policy evaluations, and recalculate identity-related governance state. This is the mechanism that keeps role relationships aligned with current identity attributes and account access.

The Perform Maintenance task serves a different operational purpose. It is generally used for system maintenance and cleanup activities, not for determining whether a user should acquire or lose a role. It does not function as the default engine for adjusting role assignments based on changes such as department, job title, location, lifecycle state, or account entitlements.

Therefore, the statement is inaccurate. Keeping role acquisition current is associated with identity refresh and role evaluation logic, not the Perform Maintenance task.

Reference topics: Access Modeling, business roles, IT roles, role assignment, detected roles, Identity Refresh task, IdentityCube recalculation, and Foundational Concepts: tasks versus workflows.

The statement is false. Preventive policy checking in SailPoint IdentityIQ is not limited only to self-service requests. Preventive policy evaluation is used to identify policy violations before access changes are completed. This can occur during access request processing, provisioning-related activity, or other configured request paths where IdentityIQ evaluates proposed changes against defined policies before allowing the transaction to proceed.

A self-service request is only one possible entry point. IdentityIQ access requests may be submitted by an end user, a manager, an administrator, or another authorized requester depending on QuickLink Population rules, request configuration, and access-request permissions. Preventive policy checking evaluates the requested access change itself, not merely the fact that the request was self-initiated. If the proposed access would violate a separation-of-duty, risk, or other governance policy, IdentityIQ can warn, require additional handling, or block the request depending on policy and workflow configuration.

Therefore, the word “only” makes the statement incorrect. Preventive policy checking is a governance control applied to configured access-change activity, not exclusively to self-service actions. Reference topics: Governance, policy detection, preventive policy checking, access request policy evaluation, User-Driven Requests, and provisioning request control.

This is not a correct example of an IdentityIQ policy as stated. IdentityIQ policies are used to detect governance violations based on identity, account, entitlement, role, risk, or activity conditions. An account policy is concerned with whether an identity has an account, lacks a required account, or has an account that violates defined account-related criteria. It evaluates existing identity and account state after data is aggregated and correlated into IdentityIQ.

The phrase “has requested the appropriate account” describes an access request validation concept rather than a policy-detection use case. Requests are handled through the user-driven request and provisioning framework, including QuickLinks, request forms, approvals, workflows, provisioning policies, and provisioning plans. A request can be evaluated, approved, rejected, or fulfilled, but a governance policy is normally not defined to determine whether a request itself was “appropriate.”

IdentityIQ policies detect violations against current or observed access conditions. Therefore, an account policy may check whether an identity has an inappropriate account, but not whether the identity requested the appropriate account. Reference topics: Governance — common policy examples and policy detection; User-Driven Requests — access requests; Provisioning — provisioning process and provisioning policies.

No. QuickLink Populations do not determine which identities can approve access requests. In SailPoint IdentityIQ, QuickLink Populations control the availability and scope of QuickLinks for users. They define who can initiate a specific request action, what type of request can be launched, and in many cases who the request can be submitted for. For example, they may allow an employee to request access for themselves or allow a manager to request access for direct reports.

Approval authority is handled separately through request workflows, approval schemes, approval rules, work item assignment logic, application or role owners, managers, governance groups, or configured business processes. When an access request is submitted, IdentityIQ evaluates the configured approval path to determine which identities receive approval work items. That approval routing is not controlled by the QuickLink Population itself.

Therefore, the statement is inaccurate. QuickLink Populations govern request initiation and visibility, while approval routing is governed by workflow and approval configuration. Reference topics: User-Driven Requests, QuickLink Populations, access request process, approval workflows, work items, and request authorization.

The statement is false. In SailPoint IdentityIQ, an uncorrelated account is an account record aggregated from an application that has not been matched to an IdentityCube. Manual correlation is one valid remediation method, but it is not the only method. IdentityIQ can also resolve uncorrelated accounts through configured correlation logic, correlation rules, identity refresh processing, and re-aggregation after application correlation settings are corrected.

Correlation is normally configured on the application using identity attributes, account attributes, or rules that determine how an account should be associated with an identity. For example, an account attribute such as employee ID, email address, user name, or another unique identifier can be used to locate the matching IdentityCube. When the correlation configuration is improved and aggregation or refresh is rerun, previously uncorrelated accounts may be automatically linked without manual intervention.

Manual correlation is primarily an administrative correction path for exceptions where automatic matching cannot safely determine ownership. Therefore, “only manually” is too restrictive and does not reflect IdentityIQ’s correlation model. Reference topics: Applications, correlation configuration, uncorrelated account resolution, account aggregation, IdentityCube association, and Identity Modeling.

Yes. In SailPoint IdentityIQ, tasks are used to automate repeatable system processes that build, update, and maintain IdentityIQ data. Tasks are executable operations that can be run manually or scheduled to run at defined intervals. They are commonly used for core operational activities such as account aggregation, group aggregation, identity refresh, role processing, certification generation support, report execution, data maintenance, and other background processing.

This statement accurately describes the purpose of tasks because much of IdentityIQ’s governance model depends on current and processed data. For example, aggregation tasks bring account and entitlement data from applications into IdentityIQ. Identity Refresh tasks update IdentityCubes, calculate role assignments, process lifecycle events, evaluate policies, and refresh identity attributes. Maintenance tasks help keep stored information consistent and usable.

Tasks differ from workflows because tasks are primarily system-executed jobs, while workflows coordinate business processes, approvals, provisioning logic, and human interaction. Therefore, tasks are correctly described as mechanisms that automate the operational processes used to build, update, and maintain information inside IdentityIQ.

Reference topics: Foundational Concepts, tasks versus workflows, aggregation tasks, identity refresh, IdentityCube maintenance, application data processing, and system automation.

No. The statement is too restrictive. In SailPoint IdentityIQ, business roles do not have to be requested in order to become associated with identities. A business role can be associated through access-request processing when the role is configured as requestable, but request submission is not the only acquisition path.

In the default role model, role association is maintained through IdentityIQ role evaluation and identity refresh behavior. Business roles may be assigned directly, assigned through administrative action, or associated through configured assignment logic. IdentityIQ then evaluates role relationships and updates the IdentityCube accordingly during refresh processing. By contrast, detected roles are commonly inferred from the access an identity already has, based on role profiles and entitlement conditions.

The important distinction is between requestable access and role association. Requestability controls whether users can ask for a role through Lifecycle Manager and QuickLinks. It does not mean the role can only be associated through a request. Therefore, “must be requested” is inaccurate.

Reference topics: Access Modeling, business roles, role assignment, detected roles, requestable roles, Identity Refresh, IdentityCube role data, and User-Driven Requests.

The statement is true. In SailPoint IdentityIQ, account attributes are defined on the application’s account schema. The application definition tells IdentityIQ how to represent accounts from a connected source, and the account schema specifies which attributes exist on those accounts. Examples may include account ID, display name, email, status, department, groups, roles, permissions, or other source-specific fields returned by the connector during aggregation.

This is distinct from identity attributes, which are stored on the IdentityCube and represent normalized identity-level data used across IdentityIQ. Account attributes belong to application account links, while identity attributes belong to the identity model. During aggregation, IdentityIQ reads account data according to the application schema and stores the discovered values as account/link attributes. Some account schema attributes may also be marked as managed when their values represent entitlement-like access that should be governed through the Entitlement Catalog.

Therefore, account attributes are correctly defined in the application account schema. Reference topics: Applications — application definitions, account schema attributes, schema attribute properties; Identity Modeling — identity attributes versus account attributes; Access Modeling — managed attributes and entitlement catalog.