IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Question and Answers

Yes, the code provided in the second image is correct for including a rule library named " Common Rules Library " in a Rule. The correct syntax is to use class= " sailpoint.object.RuleLibrary " and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the " Common Rules Library. "

Correct Syntax (from the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

Yes, setting the " Source Mappings: Application Rule " configuration on the account attribute is necessary to meet the requirements described. The use case involves flagging privileged accounts based on attributes read from different applications and using these flags in various IdentityIQ features like Advanced Analytics, rule writing, and policy enforcement. By configuring the attribute with a source mapping that uses an Application Rule, you can implement complex logic to derive the attribute ' s value from multiple sources, such as a financial application and a keystore application, according to the specific requirements.

Therefore, the correct answer is A. Yes.

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)

In SailPoint IdentityIQ, a Workgroup can indeed be used to provide a group of users with specific capabilities. Workgroups are collections of users that can be assigned roles, tasks, and permissions. By associating capabilities with a Workgroup, all members of that Workgroup will inherit the capabilities defined.

This feature is commonly used to manage teams or departments that need to share specific privileges, such as the ability to approve access requests or manage certifications. Configuring capabilities for a Workgroup is a standard practice within IdentityIQ to simplify permission management and ensure consistent access control across the group.

Therefore, the correct answer is A. Yes.

No. Specifying which applications support new account requests is not normally achieved by changing control variables in the out-of-the-box LCM workflows. That behavior is driven by application configuration, provisioning support, account creation policies, schemas, QuickLink configuration, and requestability settings. LCM workflow control variables influence how an already-launched workflow behaves: approval handling, policy checking, provisioning behavior, notifications, foreground/background behavior, trace/debug options, and similar execution controls. They do not define whether an application itself supports account creation. For an application to support new-account requests, the application must support provisioning, have the relevant create-account capability/configuration, and expose the request path through LCM/QuickLink settings. Putting this into workflow control variables would be the wrong design layer. References/topics: IdentityIQ Engineer — LCM workflows, control variables, application provisioning configuration, Create Account policy, Manage Accounts/Manage User Access.

Yes. The IdentityIQ version is essential information when setting up a new sandbox environment. Version affects installation steps, supported Java versions, supported application servers, database compatibility, connector behavior, patch requirements, schema scripts, upgrade paths, and available product features. A sandbox is usually intended to mirror or safely test changes for another environment, so the engineer must know which IdentityIQ version the sandbox should run. Without the version, the engineer could deploy the wrong WAR file, apply incompatible patches, use the wrong schema scripts, or test behavior that does not match production. Version also matters for customizations such as rules, workflows, Quicklinks, UI branding, extended attributes, and connector configuration because APIs and supported patterns can differ between releases. Therefore, IdentityIQ version is not optional background information; it is a core environment-planning input. References/topics: IdentityIQ Engineer — sandbox setup, installation planning, version compatibility, patching, environment parity.

IdentityIQ supports localization, allowing custom messages to be retrieved using SailPoint APIs within custom Java or BeanShell code. This capability is useful for creating applications that need to support multiple languages or regional formats. The SailPoint APIs provide methods to retrieve localized messages based on the current user ' s locale settings or other localization contexts.

Thus, the correct answer is A. Yes.

An Account Group Membership Certification is designed to certify group memberships within accounts, typically focusing on the validation of access within specific account groups (e.g., Active Directory groups).

This type of certification does not directly address the accuracy of role composition or the correctness of entitlements assigned within roles. Since the bank ' s goal is to ensure that all roles include the correct entitlements, an Account Group Membership Certification is not suitable for this purpose.

Thus, the correct answer is B. No.

No. A workflow does not require a step specifically named " end " in order to finish correctly. IdentityIQ workflows end based on transition flow and workflow execution semantics, not because a magic step name exists. Many workflows include an end or stop step by convention because it improves readability and gives designers a clear terminal destination, but the name itself is not mandatory. A workflow may complete when there are no further transitions, when it reaches a terminal workflow structure, or when the process returns/finishes according to the configured step behavior. Confusing a naming convention with a workflow-engine requirement is dangerous because it leads to rigid, incorrect workflow design. Engineers should focus on proper transitions, variables, step actions, approval/form handling, and termination behavior. If a project standard uses a step called end, that is a local design convention, not a product requirement. References/topics: IdentityIQ Engineer — workflow step design, terminal steps, workflow transitions, Business Process Editor, workflow XML conventions.

This is a valid process. The requirement has two parts: detect a specific Division transition and confirm that the identity is a manager. A rule-based lifecycle event trigger is appropriate when the condition is more complex than a simple single-attribute check. The rule can inspect the previous and new values of the Division attribute and return true only when the value changes from IT to Senior IT. It can also evaluate the identity’s managerStatus value on the Identity Cube to confirm that the user is a manager. Returning true from the rule allows IdentityIQ to launch the associated workflow only for identities that satisfy both conditions. This approach avoids the flaw of triggering on the wrong attribute and gives the engineer precise control over the lifecycle event condition. The key is that the rule must be written against the correct before-and-after identity data available during refresh or lifecycle-event evaluation. References/topics: IdentityIQ Engineer — rule-based lifecycle triggers, identity attribute changes, Identity Cube attributes, workflow launch rules, mover-event logic.

A Workgroup in SailPoint IdentityIQ is a collection of users or identities grouped together for the purpose of task assignment, workflow approvals, or certifications. Workgroups are not typically used for automatically creating multiple groups based on the values of a single identity attribute. To achieve automatic grouping based on identity attributes, you would need to use dynamic roles or possibly rule-based population. These methods allow for creating roles or groups dynamically by evaluating identity attributes and assigning memberships accordingly.

SailPoint IdentityIQ Administration Guide (Sections on Workgroups and Dynamic Roles)

SailPoint IdentityIQ Configuration Guide (Role Management)

Yes. The requirement explicitly says the value must be listed as an entitlement on Identity Cubes. In IdentityIQ attribute configuration, marking an attribute as an entitlement-type attribute is what allows the value to be treated and displayed in entitlement/access contexts rather than merely as ordinary profile data. The rest of the requirements describe source mappings and usability: Workday is authoritative, Contractor file is fallback, the value should be usable in rules, and it should appear as an Advanced Analytics option. Those needs may require additional configuration such as source mappings, searchable/indexed behavior, and edit-mode considerations. However, the specific proposed option is “Entitlement,” and that maps directly to Usage 4. Without setting the attribute appropriately, the value may exist on the identity but not appear as an entitlement on the Identity Cube. Therefore, this configuration option is needed. References/topics: IdentityIQ Engineer — identity attribute configuration, entitlement flag, Identity Cube display, Advanced Analytics, source mappings.

The configuration option " Comment Character " is not required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Comment Character " option is generally used for handling comment lines in flat files or CSV file-based connectors. Since SCIM 2.0 is a RESTful API-based protocol designed for managing identities in a standardized way, this option does not apply to SCIM 2.0 integrations. Therefore, it is not a necessary configuration when working with SCIM 2.0 applications.

SailPoint IdentityIQ SCIM 2.0 Integration Guide

SailPoint IdentityIQ Application Configuration Guide (SCIM and REST API sections)

Setting the configuration option " Edit Mode: Read Only " on the account attribute would not meet the requirements as specified. The requirement to " Calculate from: Keystore application, responsibility-code attribute " implies that the attribute needs to be dynamically calculated or updated based on another attribute. If the attribute is set to " Read Only, " it cannot be modified, which would prevent it from being calculated or updated as needed. Therefore, " Edit Mode: Read Only " should not be used in this scenario.

SailPoint IdentityIQ Administration Guide (Sections on Account Attributes and Attribute Calculation)

SailPoint IdentityIQ Configuration Guide (Field Properties and Edit Modes)

Yes. The Environment area under the Administrator Console is intended for administrative visibility into the running IdentityIQ environment, including product/environment details and installed components or extensions where exposed by the platform. Viewing the status or presence of installed SailPoint modules/extensions is consistent with environment inspection. This is very different from controlling the application server itself. The engineer can use IdentityIQ administrative pages to understand what is installed, enabled, or available in the current deployment, which helps during troubleshooting, patch verification, upgrade planning, and support analysis. In multi-node deployments, this kind of environment visibility is useful because module or extension inconsistencies can cause unpredictable behavior. However, viewing status does not imply the Environment tab can install, uninstall, start, or stop all components. The proposed action is read/inspection-oriented, so it fits the purpose of the tab. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, installed modules, extensions, environment validation, upgrade/troubleshooting checks.

Syslog cannot be used to launch a certification using the search results. Launching a certification in IdentityIQ is a process that involves interacting with the application’s certification module, where you define parameters, select users or roles, and initiate the certification campaign. This process requires using the IdentityIQ user interface or APIs, not the Syslog, which is purely for logging purposes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ API and UI Guide

Rapid Setup does allow for specifying account correlation by mapping an identity attribute to an account attribute. This is a standard part of the onboarding process where you define how IdentityIQ should correlate accounts to identities. This basic mapping functionality is included in Rapid Setup to facilitate straightforward account correlation during application onboarding.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Mapping Sections)

Yes. IdentityIQ role configuration can support conditional role requestability and assignment logic. A role does not have to be universally requestable for every identity. Engineers can restrict role availability through role configuration, assignment logic, population rules, request controls, or related role requirements depending on the implementation design. The proposed solution describes a role that can only be requested if the target user already has a related role. That is a valid access-governance pattern because role models often contain dependency relationships, prerequisites, or related-role structures. For example, a business role may make another IT role or application role meaningful only when the identity already satisfies a prerequisite access condition. This type of restriction prevents users from requesting access that is inappropriate outside a defined role relationship. The important engineering point is that IdentityIQ roles are not just static entitlement containers; they can include assignment rules, profiles, permitted/requestable behavior, and relationships that influence when they are visible or eligible during access requests. References/topics: IdentityIQ Engineer — role model design, requestable roles, role relationships, assignment rules, access-request governance.

Create Policy is not required for every IdentityIQ application. In IdentityIQ, provisioning policies are used when the system needs structured forms and field definitions for operations such as account creation, update, delete, enable, disable, or password actions. A Create Policy is specifically relevant when IdentityIQ is expected to create accounts on that target application and needs to collect or calculate the required values for account creation. Many applications may be onboarded initially for aggregation, correlation, governance, certifications, or visibility only, without immediate provisioning. In those cases, a Create Policy is unnecessary. Even in provisioning-enabled environments, not all applications support account creation, and some may support only entitlement changes or account disables. Therefore, Create Policy is an optional provisioning configuration, not a required field for setting up any application. References/topics: IdentityIQ Engineer — application onboarding, provisioning policies, Create Account policy, aggregation-only applications, account provisioning configuration.

This statement is incorrect. In SailPoint IdentityIQ email templates, entire blocks of text, including whole paragraphs, can indeed be conditionally included or omitted using the appropriate templating syntax such as #if, #else, and #end. The templating engine in IdentityIQ, which typically uses Apache Velocity, supports complex conditional logic that can control large sections of the email content, not just individual lines.

Yes. IdentityIQ stores email templates as IdentityIQ objects, and after installation they can be inspected through the Debug pages as EmailTemplate objects. Email templates define notification content used by workflows, certifications, lifecycle events, approvals, policy violations, provisioning processes, and other system activities. The Debug page allows administrators and engineers to view many persisted IdentityIQ object types directly, including rules, workflows, task definitions, applications, identities, configuration objects, and email templates. This is useful when troubleshooting notification behavior, checking template names, verifying variables used in template content, or confirming whether a customized template exists in the environment. However, editing production templates directly through Debug should be handled carefully and normally controlled through proper change-management practices. The proposed location is technically valid: email templates can be viewed as EmailTemplate objects through the Debug interface. References/topics: IdentityIQ Engineer — EmailTemplate objects, Debug pages, notification configuration, workflow and certification email notifications.

This proposed solution is incorrect. A create-type lifecycle event trigger is used when a new identity is created or first detected in IdentityIQ. The requirement is not about a new identity; it is about an existing identity whose Division attribute changes from IT to Senior IT. That is an update or attribute-change scenario. A create event would not reliably fire when an existing user’s Division attribute is modified during aggregation or identity refresh. It also does not address the second required condition: the user must be a manager. The correct approach must detect the specific attribute transition and then evaluate the manager condition. Using a create trigger would either never launch the workflow for the intended case or launch it only at identity creation time, which is outside the stated requirement. This is a basic but important lifecycle-event design distinction: joiner/create events are not substitutes for mover or attribute-change events. References/topics: IdentityIQ Engineer — lifecycle events, create triggers, attribute-change triggers, mover events, identity refresh processing.

In SailPoint IdentityIQ, when dealing with a policy violation of the type " Role Separation of Duties (SOD) Policy, " there are specific actions that the policy violation owner can take. These options typically include:

Mitigate: Applying a mitigating control to the violation.

Remediate: Addressing the violation by removing or altering access.

Accept: Acknowledging the violation without making changes, which usually requires justification.

Forward: Assigning the violation to another individual or group for resolution.

The option " Schedule Policy Composition Certification " is not a valid action for addressing a Role SOD Policy violation directly. The concept of scheduling a certification is related to periodic review processes, not immediate policy violation handling. Certification campaigns are scheduled and executed to review roles, entitlements, or policies, but this is not an action taken in response to a specific policy violation.

Thus, " Schedule Policy Composition Certification " is not an appropriate or valid option in this context, and the correct answer is B. No.

This is a valid implementation pattern. The workflow requirement has three routing outcomes, and the proposed solution expresses them as three explicit transition elements. The first transition routes to Stop when the approval flag is false, which corresponds to the Reject or back action. The second transition routes to Audit when the comment variable is not null or empty, using sailpoint.tools.Util.isNotNullOrEmpty(comment). That satisfies the condition that the Approve action was used and the returned form field has a value. The final transition to Provision has no condition, making it the default fallback when the prior transition conditions are not satisfied. This is the correct style for workflow routing because the destination steps are explicitly declared through the to attribute, and the conditional routing is attached to each transition rather than relying on an invalid free-form return block. References/topics: IdentityIQ Engineer — workflow transitions, when conditions, script expressions, form approval routing, default workflow transition behavior.

When setting up a new IdentityIQ test environment, it is important to assess the needs of the customer, including whether they would benefit from using a deployment accelerator.

Deployment accelerators are pre-configured sets of rules, policies, and workflows that can significantly reduce the time and effort required to deploy IdentityIQ in a test or production environment. These accelerators are particularly useful for rapidly setting up environments that align with common industry practices or specific compliance requirements.

Asking the customer whether they need a deployment accelerator is a valid and important question during the initial setup phase, as it helps to determine the best approach to configuring the test environment efficiently. Therefore, the correct answer is A. Yes.

Yes, the Provisioning tab under the " Administrator Console " can be used to manually retry provisioning attempts for pending transactions. This feature allows administrators to retry failed provisioning operations or manually trigger provisioning actions that are in a pending state, providing greater control over the provisioning process.

SailPoint IdentityIQ Administration Guide (Provisioning Management and Manual Retry)

SailPoint IdentityIQ Provisioning Guide

Schedule Policy Composition Certification is not a valid action for handling an individual Account Policy violation. A policy violation owner acts on a violation by making a decision about that violation: allow it, remediate it, mitigate it, or route it according to configured compliance processes. A Policy Composition Certification is a separate governance activity used to review the construction or definition of policies; it is not an immediate action available on a single violation record. The proposed solution also mismatches the policy type. The stem concerns an Account Policy violation, which typically relates to account-count or account-condition rules, not policy-composition review. The Word bank separately identifies Account policies as limiting the number of accounts a user can have on a system. Scheduling a certification might help long-term governance hygiene, but it does not dispose of the current policy violation. References/topics: IdentityIQ Engineer — Account Policy violations, violation owner actions, certification types, policy composition certification, compliance remediation workflow.

This statement is incorrect. IdentityIQ supports extended identity attributes, but searchable extended attributes are not unlimited. Searchable identity attributes require database-backed indexed placeholder properties defined in the extended Hibernate mapping and exposed through Identity Attribute configuration. The Word bank already states the correct limitation: when defining identity mappings under Global Settings > Identity Attributes, only 12 additional searchable attributes can be defined; additional identity attributes and mappings may exist, but they cannot all be searchable. The proposed solution says an unlimited number of additional searchable placeholder extended attributes can be added beyond the 10 shown, which contradicts the searchable-attribute limitation. Engineers must plan identity schema extensions carefully because searchable attributes affect database schema, indexing, performance, and UI search behavior. Adding unlimited searchable placeholders would create maintainability and performance problems and is not supported as a general installation design. References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended identity attributes, searchable attributes, identity mappings, schema planning.

The statement is true. In the SailPoint IdentityIQ Reporting user interface, report templates are located on the " Reports " tab. These templates define the structure and parameters of reports but do not contain actual report data. Instances of reports, which are the actual generated reports containing data based on the templates, are located on the " My Reports " tab. The " My Reports " tab is used for viewing and managing reports that have been generated for a specific user.

SailPoint IdentityIQ Reporting Guide

SailPoint IdentityIQ Administration Guide (Section on Reporting Interface)

Yes. IdentityIQ Identity Provisioning Policies define the fields and validation behavior used when identities are created or updated through supported identity-management flows. When an explicit Update Identity Provisioning Policy is not configured, IdentityIQ can fall back to the Create Identity Provisioning Policy for Edit Identity operations. This fallback allows environments to avoid duplicating identity-field configuration when the create and update forms require the same data model or validation logic. The engineer still needs to design this carefully: create and update operations are not always identical. Create flows may require fields that should not be editable later, while update flows may expose fields that are irrelevant at creation. If the organization needs separate behavior for editing identities, an Update Identity Provisioning Policy should be defined. But the proposed statement is true as a product behavior: the Create Identity policy can be used when no Update Identity policy exists. References/topics: IdentityIQ Engineer — Identity Provisioning Policies, Create Identity, Edit Identity, Update Identity policy, field validation and allowed values.

This is a valid step. To create a custom audit event in IdentityIQ, the event/action must be registered so the audit framework recognizes it. Adding an AuditAction entry in the AuditConfig object XML is the correct type of configuration because it defines the audit action name, display name, and enabled state. The name value is the internal audit action identifier that code, rules, workflows, or tasks can use when writing audit records. The displayName provides the readable label, and enabled= " true " allows the event to be captured. This step alone is not the entire solution because the engineer must also write logic to create the audit record and configure a report to query and display it. However, the question asks whether this is one of the required steps, and it is. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction XML, custom audit actions, audit event enablement, audit report setup.

The statement " The rule type must be IdentityAttribute " is correct. In SailPoint IdentityIQ, when writing a rule that is intended to map or manipulate identity attributes during the aggregation process, the rule type should be set to " IdentityAttribute " . This ensures that the rule is recognized and executed in the appropriate context for managing identity attributes.

Therefore, the correct answer is A. Yes.

Yes, this is indeed one of the primary purposes of an IdentityIQ certification. Certifications are conducted to attest to a user ' s system access, ensuring that each user has appropriate and justified access rights to applications, data, and systems within the organization. This is central to IdentityIQ’s access governance and compliance processes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

This statement is correct. IdentityIQ uses rule types and rule metadata to guide engineers when creating or editing rules. The Rule Registry describes expected rule behavior, including contextual information such as the rule’s purpose, expected inputs, and often the intended output or return behavior. This is important because IdentityIQ rules are not generic scripts running in isolation; they execute in specific product contexts such as aggregation, correlation, provisioning, workflow, certification, policy evaluation, or lifecycle processing. The rule editor can expose information derived from the rule registry so that an engineer understands which variables are available and what the rule is expected to return. This reduces implementation errors, especially in DOMC-style topics where a wrong return type or missing context variable can cause runtime failures. The Word bank separately confirms that the BeanShell rule editor lists typical input variables based on the rule registry. References/topics: IdentityIQ Engineer — Rule Registry, BeanShell rule editor, rule metadata, expected inputs, expected outputs.

Changing the Email Notification Type to POP3 under Global Settings > Configure IdentityIQ Settings > Mail Settings is not a correct procedure for testing generated emails in a non-production system. POP3 is an email retrieval protocol, not a method for sending or redirecting email notifications from IdentityIQ. IdentityIQ requires an SMTP server to send emails, and POP3 is typically used by email clients to retrieve emails from a server, not by a server to send emails.

For testing purposes in a non-production environment, you would typically configure the SMTP server settings to either redirect emails to a specific testing mailbox or use a " Redirect to File " option, if available, to capture emails locally.

Thus, the correct answer is B. No.

Yes. Attesting assignment of roles to users is a valid purpose of an IdentityIQ certification. Role-based governance depends not only on whether roles contain the correct entitlements, but also on whether the correct users hold those roles. A certification can ask reviewers to validate role membership, confirm that role assignments are appropriate for job function, and revoke or remediate role assignments that are no longer justified. This is especially important in environments where role assignment rules, business roles, or automated provisioning logic are used. If the rule assigns a role to the wrong population, users may inherit incorrect access even if the role composition itself is technically correct. Certification provides a formal review and sign-off process, creating accountability and audit evidence. Therefore, attesting role assignment to users is squarely within IdentityIQ certification functionality. References/topics: IdentityIQ Engineer — role membership certification, access review, role assignment attestation, certification sign-off, remediation decisions.

Yes. IdentityIQ’s Lifecycle Manager workflows are built from reusable workflow components and subprocesses. Many standard LCM subprocesses can be called from custom workflows, provided the engineer understands the expected input variables, return variables, and control flags. This is a preferred engineering pattern because it avoids rewriting complex provisioning, approval, identity request, policy-checking, or notification logic from scratch. Input variables can alter behavior such as approval routing, provisioning mode, policy checking, notification behavior, target identity, requester, plan handling, and subprocess execution path. However, reuse requires discipline: the custom workflow must pass the correct variables, preserve expected types, and handle returned values correctly. Blindly calling an LCM subprocess without matching its contract can produce broken approvals or provisioning behavior. The proposed statement is therefore true because standard LCM subprocesses are intentionally reusable when controlled through documented workflow variables. References/topics: IdentityIQ Engineer — LCM workflows, subprocess reuse, workflow input variables, provisioning workflows, custom workflow development.

The statement is incorrect. Email templates in SailPoint IdentityIQ are not restricted to just Identity object attributes or methods. They can access attributes and methods of any object passed to the template through its input arguments, including WorkItems, CertificationItems, and others. The template system allows the use of various objects’ properties as long as they are properly referenced within the script or template context.

No. Launching certification campaigns is not default Lifecycle Manager functionality. Lifecycle Manager focuses on identity lifecycle and access-request operations such as joiner, mover, leaver processing, access requests, account management, approvals, and provisioning workflows. Certification campaigns belong to IdentityIQ’s access review and compliance/certification capabilities, not LCM’s default functional scope. Certifications are used to review access, roles, entitlements, policy violations, or account/group membership and then require reviewers to approve, revoke, or otherwise act on access. LCM may interact with certification results indirectly because remediation from a certification can trigger provisioning or access changes, but launching the campaign itself is a certification/compliance function. This question tests whether the engineer separates lifecycle-request processing from access-review governance. Mixing them up leads to poor module design and incorrect implementation expectations. References/topics: IdentityIQ Engineer — Lifecycle Manager, access request, provisioning workflows, certification campaigns, Compliance Manager.

Yes, the text on the login page of IdentityIQ is set through message keys in the message catalog. The message catalog in IdentityIQ contains localized text strings that are used throughout the user interface, including on the login page. By modifying the appropriate message keys in the catalog, you can customize the text that appears on the login page to match the organization ' s branding or messaging requirements.

Therefore, the correct answer is A. Yes.

The statement that the application server must be restarted after reloading the logging file through the Debug-Logging page is incorrect. SailPoint IdentityIQ allows you to reload the logging configuration from the Debug-Logging page without restarting the application server. The Debug-Logging page provides a way to dynamically reload the logging settings, including those in the log4j file, so that changes can take effect immediately without the need for a server restart.

Therefore, the correct answer is B. No.

One of the primary purposes of an IdentityIQ certification is to provide reviewers with a snapshot of a user ' s system access at a given point in time. This snapshot allows managers, auditors, or other designated reviewers to verify whether the access privileges assigned to a user are appropriate, based on their job responsibilities and compliance requirements. By reviewing this snapshot, organizations can identify and remediate any inappropriate or excessive access, thus maintaining a secure and compliant environment.

Therefore, the correct answer is A. Yes.

Yes, the typical input variables for a rule are listed in the BeanShell rule editor in IdentityIQ, based on the rule registry. When you create or edit a rule in IdentityIQ using the BeanShell editor, the available input variables that are relevant to the rule type are typically pre-defined and listed based on the rule registry. These input variables provide context and data that the rule can operate on, and their availability helps guide the rule development process.

Therefore, the correct answer is A. Yes.

Yes. Out-of-the-box LCM workflows commonly support configurable notification behavior, and email templates can be selected or referenced through workflow variables, arguments, or workflow configuration. IdentityIQ workflows use email templates to generate notification content for approvals, requests, provisioning outcomes, policy violations, reminders, and other lifecycle events. The ability to control which template is used allows implementers to customize communications without rewriting the whole workflow. This is a valid use of workflow configuration because the workflow is responsible for sending or triggering notifications during lifecycle processing. The engineer still needs to ensure the referenced EmailTemplate object exists, contains the correct variables for the workflow context, and is suitable for the intended recipient. But conceptually, specifying the email template for notifications is exactly the type of behavior that can be controlled through LCM workflow configuration rather than through application schema or identity-attribute configuration. References/topics: IdentityIQ Engineer — LCM workflow variables, EmailTemplate objects, notification configuration, approval emails, workflow-controlled messaging.

The provided solution does not fulfill the client ' s requirement. Setting " Who can members request for? " to " report to the requester " only limits the request scope to users who directly report to the requester, which does not account for the location attribute. The goal is to restrict requests based on the location attribute, and this specific configuration does not consider that attribute. To achieve the desired behavior, the configuration should include logic that filters users based on the same location as the requester.

The purpose of an IdentityIQ certification is not to attest to a user ' s integrity. Certifications in IdentityIQ are designed to review and verify user access rights to ensure they are appropriate based on roles, policies, and organizational rules. The focus is on access management rather than personal qualities like integrity.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

No. This is not a correct procedure. IMAP is a protocol used to retrieve/read mail from a mailbox; it is not the normal protocol IdentityIQ uses to send generated notification emails. IdentityIQ email notification delivery is based on SMTP configuration, including SMTP host, port, authentication, and security settings where required. For non-production testing, engineers generally avoid sending test notifications to real user mailboxes. A safer approach is to configure email redirection, a test SMTP server, or a controlled mailbox so workflow, certification, approval, and lifecycle emails can be validated without accidentally notifying real users. The proposed solution is flawed in two ways: it uses IMAP as though it were a sending mechanism, and it suggests verifying delivery to mailboxes specified on Identity objects, which is risky in a non-production test. References/topics: IdentityIQ Engineer — SMTP mail settings, email notification testing, non-production safety, mail redirection, workflow/certification notifications.

Yes. CertificationItem is one of the IdentityIQ object areas that can be extended to store client-specific data through the supported extended-object/Hibernate mapping approach. The purpose of updating a corresponding .hbm file is to introduce persistent custom columns or mapped properties into the IdentityIQ database model. For certification use cases, client-specific data may need to be stored with review items, such as additional context, classification values, remediation metadata, or custom review attributes. The extension process must not stop at editing the mapping file. The Word bank’s schema-extension process describes the broader pattern: update the Hibernate mapping, generate the schema update script, apply the script to the IdentityIQ database while the application server is stopped, then start the application server and update the corresponding ObjectConfig. Therefore, CertificationItem is a valid object for this proposed extension approach, provided the engineer follows the full supported schema-extension process. References/topics: IdentityIQ Engineer — object extension, CertificationItem, Hibernate mapping, extended schema, ObjectConfig.

Defining an application is not a default functionality of the Lifecycle Manager (LCM) module. Application definitions are typically part of the core IdentityIQ platform and are managed through the IdentityIQ Administration module, not Lifecycle Manager. LCM is primarily focused on managing identity lifecycle events, such as onboarding (Joiner), role changes (Mover), and offboarding (Leaver).

Therefore, the correct answer is B. No.

Yes, the current version and patch level of IdentityIQ can be found through the Debug-About page. The Debug-About page in SailPoint IdentityIQ provides critical information about the system, including the software version, patch level, and other configuration details. This page is a useful resource for administrators to quickly verify the IdentityIQ version and ensure that the correct patches have been applied.

Therefore, the correct answer is A. Yes.

The statement is true. In SailPoint IdentityIQ, it is possible to configure a role to include a set of IdentityIQ capabilities. Capabilities in IdentityIQ are permissions that grant users access to specific functionalities within the platform, such as managing identities, viewing reports, or administering roles. By associating a role with specific capabilities, you can control what actions users assigned to that role can perform within the IdentityIQ environment.

SailPoint IdentityIQ Administration Guide (Role Configuration and Capabilities Section)

SailPoint IdentityIQ Configuration Guide (Sections on Roles and Capabilities)

The solution provided is incomplete. To create a custom audit event and set up an associated report, the process involves several steps, including defining the custom audit event in the Audit Configuration object, updating or creating relevant audit triggers in the system, and defining the custom report using XML or the IdentityIQ report editor. The steps mentioned in the solution do not cover the necessary configuration and implementation details required for this task. For a complete process, consult the SailPoint IdentityIQ Reporting Guide and the Audit Framework documentation.

Yes, this is an example of a mover lifecycle event. A mover lifecycle event typically occurs when an individual ' s role or employment status within the organization changes, requiring updates to their accounts and access rights. In this scenario, a contractor whose accounts were previously disabled due to contract expiration needs those accounts re-enabled upon securing a new contract. This reactivation and adjustment of access rights based on a change in employment status fits the definition of a mover event.

Therefore, the correct answer is A. Yes.

Syslog is not intended for querying or identifying specific objects, such as all Link objects from a particular application. Syslog is used to record events and log information related to system activities, errors, and operations. To identify all Link objects from a particular application, you would use IdentityIQ ' s internal search functionality or reports that allow you to filter and retrieve such objects. These tasks involve querying the database and application-specific data structures rather than examining log files.

SailPoint IdentityIQ Administration Guide (Section on Objects and Searching)

SailPoint IdentityIQ Configuration Guide (Understanding Link Objects)

This is a valid step, with the typo corrected as “create the audit event.” Registering an AuditAction in AuditConfig only defines the custom event type; IdentityIQ still needs executable logic to actually write the audit event when the relevant condition occurs. That logic can be placed in a BeanShell rule, task, workflow step, or other appropriate execution point depending on the business process being audited. The code must create/populate the audit record with the configured action name and the relevant data values, such as target identity, actor, source object, application, attribute values, or other fields needed by the later report. Without this implementation logic, the custom audit action would exist but no audit records would be generated. Therefore, writing the logic to create the audit event is a legitimate step in the end-to-end process. References/topics: IdentityIQ Engineer — BeanShell audit logic, workflow audit events, custom AuditAction usage, audit data population, custom audit reporting.

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in the provisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.