Practice Free IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Exam Questions Answers With Explanation

Yes, the sets of columns displayed in most tables in the IdentityIQ user interface are controlled by entries in the ColumnConfig elements of the UIConfig object. The UIConfig object in IdentityIQ is responsible for defining various aspects of the user interface, including the configuration of columns that are displayed in tables throughout the application. By modifying the ColumnConfig elements within this object, administrators can customize which columns appear in specific tables, including their order, visibility, and labels.

Therefore, the correct answer is A. Yes.

Certifying user expense reports is not a purpose of IdentityIQ certification. IdentityIQ certifications are focused on access and identity governance, specifically reviewing and validating user access rights within systems. Expense report certification would be a different process, typically managed by financial or expense management systems, not by IdentityIQ.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

An Application Owner Certification is primarily used to certify entitlements and roles associated with specific applications. It involves application owners reviewing access within their applications, which is useful for ensuring that access aligns with the intended security policies for that application.

However, in the context of ensuring that roles include the correct entitlements across the entire role model, a more suitable certification type would be a Role Composition Certification. This type specifically focuses on validating the composition of roles, including the entitlements they aggregate.

Therefore, an Application Owner Certification will not fully achieve the goal of ensuring all roles include the correct entitlements. The correct answer is B. No.

Yes. This is the classic joiner lifecycle event. The person has not previously been with the company, has now been hired, and needs new access and new accounts. In IdentityIQ Lifecycle Manager terms, a joiner process usually starts from an authoritative-source change such as a new HR record. The process may create or activate the Identity Cube, assign birthright roles, request or automatically provision accounts, calculate policies, trigger approvals, and send notifications. Unlike rehire or reinstatement scenarios, there are no existing disabled accounts to restore. The access model should be built from onboarding rules, role assignment logic, provisioning policies, application create policies, and approval workflows. This is exactly why joiner workflows exist: to standardize new-person onboarding and ensure access is created consistently, securely, and audibly. References/topics: IdentityIQ Engineer — joiner lifecycle event, LCM onboarding, birthright access, account creation, provisioning policy, role assignment.

Schedule Policy Composition Certification is not a valid action for handling an individual Account Policy violation. A policy violation owner acts on a violation by making a decision about that violation: allow it, remediate it, mitigate it, or route it according to configured compliance processes. A Policy Composition Certification is a separate governance activity used to review the construction or definition of policies; it is not an immediate action available on a single violation record. The proposed solution also mismatches the policy type. The stem concerns an Account Policy violation, which typically relates to account-count or account-condition rules, not policy-composition review. The Word bank separately identifies Account policies as limiting the number of accounts a user can have on a system. Scheduling a certification might help long-term governance hygiene, but it does not dispose of the current policy violation. References/topics: IdentityIQ Engineer — Account Policy violations, violation owner actions, certification types, policy composition certification, compliance remediation workflow.

The statement that supported platforms of an older version of IdentityIQ will always be supported in newer versions of IdentityIQ is incorrect. As SailPoint releases new versions of IdentityIQ, the list of supported platforms (such as specific versions of Java, databases, application servers, etc.) may change. Newer versions of IdentityIQ might deprecate support for older platforms or require newer versions of software components. It is essential to consult the Release Notes or the Supported Platforms documentation for the specific IdentityIQ version to ensure compatibility.

Thus, the correct answer is B. No.

Yes. The Environment area under the Administrator Console is intended for administrative visibility into the running IdentityIQ environment, including product/environment details and installed components or extensions where exposed by the platform. Viewing the status or presence of installed SailPoint modules/extensions is consistent with environment inspection. This is very different from controlling the application server itself. The engineer can use IdentityIQ administrative pages to understand what is installed, enabled, or available in the current deployment, which helps during troubleshooting, patch verification, upgrade planning, and support analysis. In multi-node deployments, this kind of environment visibility is useful because module or extension inconsistencies can cause unpredictable behavior. However, viewing status does not imply the Environment tab can install, uninstall, start, or stop all components. The proposed action is read/inspection-oriented, so it fits the purpose of the tab. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, installed modules, extensions, environment validation, upgrade/troubleshooting checks.

Export CSV / Import CSV is not a valid action for a policy violation owner when acting on an individual Account Policy violation. In IdentityIQ, a policy violation owner is expected to resolve or manage the violation through violation-handling actions such as allowing, mitigating, remediating, forwarding, or otherwise taking governance action depending on configured permissions and workflow. Exporting or importing CSV files is an administrative or bulk-data activity, not a violation-disposition action. An Account Policy violation normally relates to a condition such as a user having more accounts than permitted on an application or system. The Word bank describes Account policies as policies that limit the number of accounts users may have on a given system. Acting on that violation requires a compliance decision or remediation path, not a CSV operation. Therefore, this proposed solution is not a valid policy-violation owner action. References/topics: IdentityIQ Engineer — Compliance Manager, policy violations, Account Policy, violation remediation, policy owner actions.

The statement is true. In the SailPoint IdentityIQ Reporting user interface, report templates are located on the " Reports " tab. These templates define the structure and parameters of reports but do not contain actual report data. Instances of reports, which are the actual generated reports containing data based on the templates, are located on the " My Reports " tab. The " My Reports " tab is used for viewing and managing reports that have been generated for a specific user.

SailPoint IdentityIQ Reporting Guide

SailPoint IdentityIQ Administration Guide (Section on Reporting Interface)

Yes, this statement is true. The default language of IdentityIQ can be changed from English by replacing the appropriate message files. Administrators can modify or replace the default English message files with those for another language, which will then become the system’s default language. This allows IdentityIQ to be localized according to the organization ' s language preferences.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Administration Guide (Language Settings and Message File Management Sections)

The statement is incorrect. When writing and executing source mapping rules to populate identity attributes, the rule itself does not need to persist the identity attribute to the database. In SailPoint IdentityIQ, once the value for an identity attribute has been calculated by a source mapping rule, IdentityIQ automatically handles the persistence of this attribute to the database as part of the aggregation or provisioning process. The developer does not need to explicitly persist the attribute; this is managed by the system.

SailPoint IdentityIQ Source Mapping Guide

SailPoint IdentityIQ Administration Guide (Aggregation and Attribute Mapping Sections)

This implementation is correct in structure. The code first resolves the Application object named MagicBox, then creates an IdentityService, then calls service.getLinks(identity, application) to retrieve the account links for that identity on the application. Because the requirement is to return all account names, using getLinks and iterating over the returned List < Link > is the right pattern. Each Link represents an account on an application, and getNativeIdentity() returns the account’s native identifier, which is the account name or unique account key from the target application. The null check prevents a null-pointer issue if no links are returned. In a production-quality version, an engineer might also handle a missing application object and ensure Java collection imports are available, but those do not invalidate the core implementation pattern shown. Compared with the flawed single-link version, this solution correctly handles multiple accounts. References/topics: IdentityIQ Engineer — IdentityService API, Application object lookup, Link collection retrieval, nativeIdentity, BeanShell utility methods.

A Role Composition Certification is specifically designed to ensure that roles are composed correctly by reviewing the entitlements and other roles they aggregate. This certification allows reviewers to verify whether the roles include the appropriate entitlements based on business needs and compliance requirements.

Given that the bank ' s objective is to ensure that all roles include the correct entitlements, a Role Composition Certification is the most appropriate tool to achieve this goal. It allows for the comprehensive review and validation of roles and their associated entitlements, ensuring alignment with the overall access governance strategy.

Therefore, the correct answer is A. Yes.

Inserting the " Managers " QuickLink population as the dynamic scope in the QuickLink object is a valid step when creating a custom QuickLink that should only be accessible by managers. QuickLink populations are used to define which users have access to specific QuickLinks based on criteria like role, department, or other attributes. By assigning the " Managers " population, only users who are members of that population will see and be able to launch the QuickLink.

Therefore, the correct answer is A. Yes.

The correct order for performing an initial installation of SailPoint IdentityIQ is:

Ensure all of the application servers are stopped.

Stopping all application servers is crucial to prevent any conflicts or transactional interference during the installation process.

Un-jar the IdentityIQ WAR file in the desired directory of each application server.

Extract the IdentityIQ WAR file in the appropriate location for the application server. This step deploys the IdentityIQ application code.

Configure iiq.properties file with database credentials and datasource.

The iiq.properties file must be updated with correct database credentials and datasource configurations to establish a connection to the IdentityIQ database.

Create the IdentityIQ database.

A new IdentityIQ database must be created for the system. This is the foundation where all IdentityIQ data will be stored.

Generate database schema to include custom attributes by executing ' iiq schema ' .

Use the iiq schema command to generate the necessary database schema. This includes tables, constraints, and other structural components for IdentityIQ.

Initialize default IdentityIQ system objects from ' iiq console ' using the ' import ' command.

Import default system objects like roles, policies, and configuration settings using the IdentityIQ console’s import feature. This sets up the base configuration.

Start all of the application servers.

Once everything is configured, start the application servers to make the IdentityIQ application available.

Apply the latest patch.

Finally, apply any patches to ensure the system is up to date with the latest security and feature enhancements.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Stopping all application servers is necessary to avoid file locks and ensure the WAR deployment and database setup processes can proceed smoothly.

Un-jarring the WAR file deploys IdentityIQ into the server directory structure, making its code accessible for execution.

Configuring the iiq.properties file connects IdentityIQ to the database, establishing where it will read and write data.

Creating the database is fundamental, as the IdentityIQ system relies on a structured data environment.

Generating the database schema via iiq schema builds out the tables and structures necessary for storing identity, access, and policy data.

Initializing system objects sets up core elements of IdentityIQ (like roles, capabilities, and system configurations) required for its operation.

Starting the application servers activates the IdentityIQ environment, allowing the system to begin processing requests.

Applying the latest patch ensures that the installation is up-to-date with all bug fixes, enhancements, and security updates from SailPoint.

SailPoint IdentityIQ Installation Guide (steps on fresh installation and post-installation configurations).

The statement that " All certifications include generation, the active period, sign-off, and the end period " is true. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization ' s policies.

SailPoint IdentityIQ Certification Administrator ' s Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)

Creating a custom audit event and setting up an associated report involves steps such as defining the audit event, modifying the audit configuration, and creating a custom report using the SailPoint IdentityIQ reporting framework. Simply creating a Data Export task does not fulfill these requirements. A Data Export task is used for exporting data from IdentityIQ and is unrelated to the creation of custom audit events or custom reports. Refer to the SailPoint IdentityIQ Reporting Guide and the IdentityIQ Audit Framework documentation for more information on correctly creating and configuring custom audit events and reports.

Yes, this action can be performed as part of configuring an application definition in IdentityIQ. When defining an application, you can specify provisioning policies, including which users should be provisioned with a basic account as part of a joiner event. This is typically done by setting up account creation rules or provisioning policies that trigger when a new user (joiner) is detected, ensuring they receive the necessary basic accounts and entitlements.

Therefore, the correct answer is A. Yes.

The statement is false. In SailPoint IdentityIQ, the language displayed in the user interface is not always based on the default language selected in the global settings. The language displayed in the user interface is typically determined by the user ' s language preference, which can be set individually for each user. If a user ' s preferred language is not available, then the system may fall back to the default language specified in the global settings. Thus, while the global default language serves as a fallback, the actual language displayed is often based on user-specific settings.

SailPoint IdentityIQ Administration Guide (Localization and Language Settings Sections)

SailPoint IdentityIQ User Guide (User Preferences and Language Selection)

Defining an application is not a default functionality of the Lifecycle Manager (LCM) module. Application definitions are typically part of the core IdentityIQ platform and are managed through the IdentityIQ Administration module, not Lifecycle Manager. LCM is primarily focused on managing identity lifecycle events, such as onboarding (Joiner), role changes (Mover), and offboarding (Leaver).

Therefore, the correct answer is B. No.

The statement suggests moving the XML file into IIQ_HOME/WEB-INF/database as part of the process to import SailPoint XML file objects into IdentityIQ. However, this is not a valid step for importing XML objects.

The correct procedure to import SailPoint XML objects typically involves the following steps:

Use the iiq console command-line tool provided by SailPoint to import the XML file.

The command typically looks like: iiq console import < filename > .xml.

The XML file does not need to be moved to any specific directory like WEB-INF/database for the import process.

Moving the XML file into the WEB-INF/database directory does not align with the documented process and does not facilitate the import. The correct answer is B. No.

Specifying account correlation using a rule cannot be performed using the Rapid Setup application onboarding process. Rapid Setup is designed for straightforward and simplified onboarding processes with a focus on quick configuration, typically using predefined templates and options. However, advanced configurations like custom account correlation rules require more detailed setup, typically done outside of the Rapid Setup UI, involving scripting or detailed configuration within the application definition.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Application Onboarding Sections)

The statement that a BeanShell rule in IdentityIQ must always return an object derived from the abstract class sailpoint.object.SailPointObject is incorrect. While many rules in IdentityIQ may return objects that derive from SailPointObject, it is not a strict requirement. Rules can return various types of objects depending on their purpose and context. For example, a rule might return a String, Boolean, Map, or even null, depending on what the rule is designed to accomplish.

Therefore, the correct answer is B. No.

Yes. In IdentityIQ workflow XML, subprocess calls can exchange data with the calling workflow through configured input and output variable handling. The send attribute is used to pass variables into the subprocess, while the returns attribute identifies variables that should be returned from the subprocess to the parent workflow context. This is important when a reusable subprocess performs initialization, provisioning-plan generation, identity-request creation, approval preparation, or other common logic and the parent workflow needs the resulting values. In the example, identityName and plan are sent into the subprocess, while identityRequestId and project are expected back. This is a valid workflow pattern and is one reason standard LCM subprocesses can be reused in custom workflows. The engineer must still ensure that variable names match and the subprocess actually sets the returned variables. References/topics: IdentityIQ Engineer — workflow subprocesses, send attribute, returns attribute, workflow variables, reusable LCM workflows.

An Account Group Membership Certification is designed to certify group memberships within accounts, typically focusing on the validation of access within specific account groups (e.g., Active Directory groups).

This type of certification does not directly address the accuracy of role composition or the correctness of entitlements assigned within roles. Since the bank ' s goal is to ensure that all roles include the correct entitlements, an Account Group Membership Certification is not suitable for this purpose.

Thus, the correct answer is B. No.

This is a valid process. The requirement has two parts: detect a specific Division transition and confirm that the identity is a manager. A rule-based lifecycle event trigger is appropriate when the condition is more complex than a simple single-attribute check. The rule can inspect the previous and new values of the Division attribute and return true only when the value changes from IT to Senior IT. It can also evaluate the identity’s managerStatus value on the Identity Cube to confirm that the user is a manager. Returning true from the rule allows IdentityIQ to launch the associated workflow only for identities that satisfy both conditions. This approach avoids the flaw of triggering on the wrong attribute and gives the engineer precise control over the lifecycle event condition. The key is that the rule must be written against the correct before-and-after identity data available during refresh or lifecycle-event evaluation. References/topics: IdentityIQ Engineer — rule-based lifecycle triggers, identity attribute changes, Identity Cube attributes, workflow launch rules, mover-event logic.

Not all Application objects in SailPoint IdentityIQ must have an Identity object as the owner. While it is common practice to assign an owner to an Application object for governance and administration purposes, it is not a strict requirement. Applications can exist without a direct association to an Identity object. The ownership concept in IdentityIQ is more of a best practice for accountability rather than a mandatory attribute. Refer to the SailPoint IdentityIQ Application Definition Guide for more information on the configuration and management of Application objects.

Syslog is not intended for querying or identifying specific objects, such as all Link objects from a particular application. Syslog is used to record events and log information related to system activities, errors, and operations. To identify all Link objects from a particular application, you would use IdentityIQ ' s internal search functionality or reports that allow you to filter and retrieve such objects. These tasks involve querying the database and application-specific data structures rather than examining log files.

SailPoint IdentityIQ Administration Guide (Section on Objects and Searching)

SailPoint IdentityIQ Configuration Guide (Understanding Link Objects)

Yes. IdentityIQ role configuration can support conditional role requestability and assignment logic. A role does not have to be universally requestable for every identity. Engineers can restrict role availability through role configuration, assignment logic, population rules, request controls, or related role requirements depending on the implementation design. The proposed solution describes a role that can only be requested if the target user already has a related role. That is a valid access-governance pattern because role models often contain dependency relationships, prerequisites, or related-role structures. For example, a business role may make another IT role or application role meaningful only when the identity already satisfies a prerequisite access condition. This type of restriction prevents users from requesting access that is inappropriate outside a defined role relationship. The important engineering point is that IdentityIQ roles are not just static entitlement containers; they can include assignment rules, profiles, permitted/requestable behavior, and relationships that influence when they are visible or eligible during access requests. References/topics: IdentityIQ Engineer — role model design, requestable roles, role relationships, assignment rules, access-request governance.

Yes, the statement is true. In SailPoint IdentityIQ, the built-in auditing options are indeed immutable, meaning they are always recorded and cannot be disabled or altered. This ensures that critical actions and changes are always logged for compliance and security purposes. However, custom audit configurations, such as additional custom audit fields or logs, can be turned on or off based on specific organizational requirements.

SailPoint IdentityIQ Audit Guide

SailPoint IdentityIQ Administration Guide (Sections on Auditing and Compliance)

No. Whether an application supports password change requests through the IdentityIQ UI is not controlled by generic LCM workflow control variables. Password-change support depends on the application connector’s capabilities, password-management configuration, application settings, schema/support for password operations, policies, and QuickLink/user-interface configuration. The workflow may process or route a password-change request once launched, but it does not define which target applications support that operation. That capability must be configured at the application/connector and password-management layer. Mixing these layers would create a brittle design: workflow variables should govern execution behavior, while application configuration defines available account operations. Therefore, the proposed solution is not achievable merely by configuring out-of-the-box LCM workflow control variables. References/topics: IdentityIQ Engineer — password management, application connector capabilities, LCM workflows, QuickLink password change, account operation support.

Yes. The Run Rule capability in the IdentityIQ debug/admin tooling is useful for executing BeanShell rule logic and viewing the result, especially during development or troubleshooting. When an engineer writes a simple rule that returns a value, the Run Rule feature can be used to validate the logic and observe the returned output. This is useful for quick testing of rules that evaluate identity attributes, build strings, test object lookups, or verify small pieces of BeanShell logic before embedding the rule into a workflow, lifecycle event, policy, certification configuration, or application configuration. However, this feature must be used carefully because rule execution can interact with real IdentityIQ objects depending on the code. The benefit described in the proposed solution is narrow and valid: displaying the return value of simple code is a legitimate use case. It is not the same as saying the feature should be used for unrestricted database manipulation. References/topics: IdentityIQ Engineer — Debug pages, Run Rule, BeanShell rules, rule testing, troubleshooting.

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.

Syslog cannot be used to launch a certification using the search results. Launching a certification in IdentityIQ is a process that involves interacting with the application’s certification module, where you define parameters, select users or roles, and initiate the certification campaign. This process requires using the IdentityIQ user interface or APIs, not the Syslog, which is purely for logging purposes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ API and UI Guide

This statement is incorrect. IdentityIQ supports extended identity attributes, but searchable extended attributes are not unlimited. Searchable identity attributes require database-backed indexed placeholder properties defined in the extended Hibernate mapping and exposed through Identity Attribute configuration. The Word bank already states the correct limitation: when defining identity mappings under Global Settings > Identity Attributes, only 12 additional searchable attributes can be defined; additional identity attributes and mappings may exist, but they cannot all be searchable. The proposed solution says an unlimited number of additional searchable placeholder extended attributes can be added beyond the 10 shown, which contradicts the searchable-attribute limitation. Engineers must plan identity schema extensions carefully because searchable attributes affect database schema, indexing, performance, and UI search behavior. Adding unlimited searchable placeholders would create maintainability and performance problems and is not supported as a general installation design. References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended identity attributes, searchable attributes, identity mappings, schema planning.

A Post-Iterate Rule in SailPoint IdentityIQ is a type of connector rule that is executed after each account from the source system (e.g., SQL Loader application) has been read during the aggregation process. This rule allows for additional processing or customization of the data after the account has been iterated over. According to SailPoint IdentityIQ documentation, configuring a Post-Iterate Rule enables the execution of logic after each account ' s data has been processed, confirming that the given statement is valid. Refer to the SailPoint IdentityIQ Connector Development Guide for detailed information on rule execution during aggregation.

Yes, setting the " Source Mappings: Application Rule " configuration on the account attribute is necessary to meet the requirements described. The use case involves flagging privileged accounts based on attributes read from different applications and using these flags in various IdentityIQ features like Advanced Analytics, rule writing, and policy enforcement. By configuring the attribute with a source mapping that uses an Application Rule, you can implement complex logic to derive the attribute ' s value from multiple sources, such as a financial application and a keystore application, according to the specific requirements.

Therefore, the correct answer is A. Yes.

Yes. IdentityIQ stores email templates as IdentityIQ objects, and after installation they can be inspected through the Debug pages as EmailTemplate objects. Email templates define notification content used by workflows, certifications, lifecycle events, approvals, policy violations, provisioning processes, and other system activities. The Debug page allows administrators and engineers to view many persisted IdentityIQ object types directly, including rules, workflows, task definitions, applications, identities, configuration objects, and email templates. This is useful when troubleshooting notification behavior, checking template names, verifying variables used in template content, or confirming whether a customized template exists in the environment. However, editing production templates directly through Debug should be handled carefully and normally controlled through proper change-management practices. The proposed location is technically valid: email templates can be viewed as EmailTemplate objects through the Debug interface. References/topics: IdentityIQ Engineer — EmailTemplate objects, Debug pages, notification configuration, workflow and certification email notifications.

Creating and loading a Custom Audit Report TaskDefinition XML and corresponding Custom Audit Report Form XML is indeed part of the process for setting up a custom audit report in SailPoint IdentityIQ. The TaskDefinition XML defines the report task, and the Form XML defines the user interface for running the report. These steps are essential to creating a custom audit report, and the solution correctly outlines a valid approach. Refer to the SailPoint IdentityIQ Reporting Guide, particularly the section on creating custom reports and forms, for more detailed instructions.

The statement is false. In SailPoint IdentityIQ, while message files may indeed be added to support additional languages, the out-of-the-box supplied message files can also be modified. Administrators can customize these message files to adapt the text in the user interface to better suit the organization’s needs. This includes modifying existing translations or adding custom messages to meet specific requirements.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Configuration Guide (Customization of Message Files)

No. The Environment tab in the IdentityIQ Administrator Console is not used to start or stop a particular application server. Starting and stopping an application server is an infrastructure-level operation handled by the application-server platform, operating system service manager, container orchestration layer, or hosting environment. IdentityIQ can display environment and runtime information, but it does not replace WebLogic, Tomcat, JBoss/WildFly, systemd, Windows Services, Kubernetes, or other server-control mechanisms. This distinction matters because engineers must not assume IdentityIQ UI controls can manage the underlying Java application server lifecycle. The Environment area is for visibility and administrative inspection, not for controlling server process state. To restart or stop a node, the engineer must use the proper server administration tool and follow clustered-environment procedures to avoid disrupting tasks, workflow execution, aggregation, provisioning, or user sessions. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, application server administration, clustered deployment operations, runtime monitoring.

The provided BeanShell code snippet attempts to filter and print the names of GroupDefinition objects owned by " Randy.Knight. " However, the code contains a few issues that prevent it from functioning correctly as written:

Class Import: The GroupDefinition class should be imported explicitly at the beginning of the script, which is missing here.

Query Execution: The use of context.getObjectsByNumber(GroupDefinition.class, i) is incorrect. This method does not exist in this context. The correct approach would be to use context.getObjects() to retrieve the list of objects and iterate over them.

Looping Logic: The loop logic also contains a flaw. Instead of using a counter-based loop with context.getObjectsByNumber(), the recommended approach is to use context.search() to retrieve a list of filtered objects and then iterate through the results.

A corrected version of this code would look something like this:

import sailpoint.object.GroupDefinition;

import sailpoint.object.Filter;

import sailpoint.object.QueryOptions;

Filter filter = Filter.eq( " owner.name " , " Randy.Knight " );

QueryOptions qo = new QueryOptions();

qo.addFilter(filter);

List < GroupDefinition > groupDefinitions = context.getObjects(GroupDefinition.class, qo);

for (GroupDefinition group : groupDefinitions) {

System.out.println(group.getName());

}

In this corrected version:

We explicitly import GroupDefinition.

We retrieve the filtered objects with context.getObjects(GroupDefinition.class, qo) instead of getObjectsByNumber.

Thus, the original code is not correct as written. The correct answer is B. No.

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

The statement is false. While it is true that logging and auditing require extra function calls and generate data, the suggestion that this data can be compressed to avoid storage issues and improve performance is misleading. In practice, while compression might save storage space, it does not inherently improve performance, particularly because the overhead of compression and decompression could negate the performance benefits. Effective performance management in IdentityIQ involves more nuanced approaches, such as optimizing the level of detail in logs, managing log rotation, and tuning the system for efficient I/O operations.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Performance Tuning Guide

Yes, this is an example of a mover lifecycle event. A mover lifecycle event typically occurs when an individual ' s role or employment status within the organization changes, requiring updates to their accounts and access rights. In this scenario, a contractor whose accounts were previously disabled due to contract expiration needs those accounts re-enabled upon securing a new contract. This reactivation and adjustment of access rights based on a change in employment status fits the definition of a mover event.

Therefore, the correct answer is A. Yes.

Yes, this is indeed one of the primary purposes of an IdentityIQ certification. Certifications are conducted to attest to a user ' s system access, ensuring that each user has appropriate and justified access rights to applications, data, and systems within the organization. This is central to IdentityIQ’s access governance and compliance processes.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

In SailPoint IdentityIQ, a Workgroup can indeed be used to provide a group of users with specific capabilities. Workgroups are collections of users that can be assigned roles, tasks, and permissions. By associating capabilities with a Workgroup, all members of that Workgroup will inherit the capabilities defined.

This feature is commonly used to manage teams or departments that need to share specific privileges, such as the ability to approve access requests or manage certifications. Configuring capabilities for a Workgroup is a standard practice within IdentityIQ to simplify permission management and ensure consistent access control across the group.

Therefore, the correct answer is A. Yes.

When setting up a new IdentityIQ test environment, it is important to assess the needs of the customer, including whether they would benefit from using a deployment accelerator.

Deployment accelerators are pre-configured sets of rules, policies, and workflows that can significantly reduce the time and effort required to deploy IdentityIQ in a test or production environment. These accelerators are particularly useful for rapidly setting up environments that align with common industry practices or specific compliance requirements.

Asking the customer whether they need a deployment accelerator is a valid and important question during the initial setup phase, as it helps to determine the best approach to configuring the test environment efficiently. Therefore, the correct answer is A. Yes.

Yes. Attesting assignment of roles to users is a valid purpose of an IdentityIQ certification. Role-based governance depends not only on whether roles contain the correct entitlements, but also on whether the correct users hold those roles. A certification can ask reviewers to validate role membership, confirm that role assignments are appropriate for job function, and revoke or remediate role assignments that are no longer justified. This is especially important in environments where role assignment rules, business roles, or automated provisioning logic are used. If the rule assigns a role to the wrong population, users may inherit incorrect access even if the role composition itself is technically correct. Certification provides a formal review and sign-off process, creating accountability and audit evidence. Therefore, attesting role assignment to users is squarely within IdentityIQ certification functionality. References/topics: IdentityIQ Engineer — role membership certification, access review, role assignment attestation, certification sign-off, remediation decisions.

The purpose of an IdentityIQ certification is not to attest to a user ' s integrity. Certifications in IdentityIQ are designed to review and verify user access rights to ensure they are appropriate based on roles, policies, and organizational rules. The focus is on access management rather than personal qualities like integrity.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

The statement is false. In SailPoint IdentityIQ, syslog events can indeed be sent to Log4j. The system allows for flexible configuration where logging can be directed to multiple outputs, including both syslog and Log4j. This flexibility enables organizations to route logs according to their needs while maintaining security and compliance.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Administration Guide (Syslog Configuration and Log4j Integration)

This proposed solution is not correct. In IdentityIQ, features and functional access are controlled primarily through capabilities, not scopes. Capabilities determine whether a user can perform administrative or functional actions such as managing identities, accessing reports, configuring applications, launching tasks, or using privileged pages. Scopes, by contrast, are generally used to restrict which objects or data a user can see or act upon. For example, a scoped administrator may only be able to view or administer identities, applications, or work items within an assigned organizational boundary. That is object/data visibility control, not feature enablement. Saying that scopes control “the features that are used” confuses two different authorization layers. The correct IdentityIQ distinction is: capabilities control functional permissions, while scopes constrain object access boundaries. References/topics: IdentityIQ Engineer — authentication, authorization, capabilities, scopes, delegated administration.

Yes. IdentityIQ Identity Provisioning Policies define the fields and validation behavior used when identities are created or updated through supported identity-management flows. When an explicit Update Identity Provisioning Policy is not configured, IdentityIQ can fall back to the Create Identity Provisioning Policy for Edit Identity operations. This fallback allows environments to avoid duplicating identity-field configuration when the create and update forms require the same data model or validation logic. The engineer still needs to design this carefully: create and update operations are not always identical. Create flows may require fields that should not be editable later, while update flows may expose fields that are irrelevant at creation. If the organization needs separate behavior for editing identities, an Update Identity Provisioning Policy should be defined. But the proposed statement is true as a product behavior: the Create Identity policy can be used when no Update Identity policy exists. References/topics: IdentityIQ Engineer — Identity Provisioning Policies, Create Identity, Edit Identity, Update Identity policy, field validation and allowed values.

Yes. CertificationItem is one of the IdentityIQ object areas that can be extended to store client-specific data through the supported extended-object/Hibernate mapping approach. The purpose of updating a corresponding .hbm file is to introduce persistent custom columns or mapped properties into the IdentityIQ database model. For certification use cases, client-specific data may need to be stored with review items, such as additional context, classification values, remediation metadata, or custom review attributes. The extension process must not stop at editing the mapping file. The Word bank’s schema-extension process describes the broader pattern: update the Hibernate mapping, generate the schema update script, apply the script to the IdentityIQ database while the application server is stopped, then start the application server and update the corresponding ObjectConfig. Therefore, CertificationItem is a valid object for this proposed extension approach, provided the engineer follows the full supported schema-extension process. References/topics: IdentityIQ Engineer — object extension, CertificationItem, Hibernate mapping, extended schema, ObjectConfig.