Free SailPoint IdentityIQ-Associate Practice Exam with Questions & Answers

Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed identifies that attribute as governance-relevant access data. This is commonly applied to attributes that contain entitlement-like values, such as groups, roles, permissions, or application access assignments. When the attribute is managed, IdentityIQ can create and maintain managed attribute records for the values discovered during aggregation, allowing those values to be represented in the entitlement catalog with business metadata such as display name, description, owner, requestability, and classification.

This managed designation supports governance processes, including certifications. In an access review, reviewers need to evaluate meaningful access items rather than raw account data. Managed entitlement values can therefore be surfaced as reviewable access so managers, application owners, or entitlement owners can approve, revoke, or otherwise act on them during certification campaigns.

This does not mean the attribute itself is simply editable in IdentityIQ; editability is controlled separately through provisioning policies, forms, workflows, and connector support. The managed flag is primarily about governing the attribute’s values as access.

Reference topics: Applications — schema attribute properties; Access Modeling — entitlement catalog; Governance — certification review items.

Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed designates that the values discovered for that attribute are treated as managed entitlement values and promoted into the Entitlement Catalog. This is typically used for attributes that represent access, such as groups, roles, permissions, profiles, or other application-specific entitlement assignments. During aggregation, IdentityIQ reads account data from the application. When a schema attribute is marked as managed, the distinct values of that attribute can become ManagedAttribute objects, allowing IdentityIQ to govern them as cataloged access items.

This catalog promotion is important because raw technical values often need business context before they can be reviewed, requested, approved, certified, or reported on. The Entitlement Catalog can store metadata such as display name, description, owner, requestability, classification, and other governance attributes. These values then become usable in access certifications, access requests, reports, policy evaluation, and role modeling.

Therefore, the statement accurately describes the managed attribute function. Reference topics: Applications — account schema attribute properties; Access Modeling — entitlement catalog; Governance — certification content and entitlement review.

Yes. Granting an IdentityIQ capability is a valid way to provide access to additional functions within SailPoint IdentityIQ, including areas such as Advanced Analytics. Capabilities are part of IdentityIQ’s internal authorization model. They determine what a logged-in user is allowed to see and perform inside the IdentityIQ interface, such as administration, reporting, certification administration, role management, policy management, or advanced search and analysis functions.

Advanced Analytics searches are IdentityIQ functions, not external application permissions. Therefore, access to those search types is governed by IdentityIQ security controls, including capabilities, rights, and in some deployments, scoping. This is different from granting access on a connected application, which would be handled through accounts, entitlements, roles, access requests, and provisioning.

The key distinction is that capabilities grant authority inside IdentityIQ itself. They do not directly modify a user’s access on a target system. Providing access to different types of Advanced Analytics searches is therefore an appropriate reason to assign an IdentityIQ capability.

Reference topics: Identity Modeling — how IdentityIQ access is granted to users; Foundational Concepts — common IdentityIQ objects and components; Governance — analytics and access visibility.

Yes. In SailPoint IdentityIQ, correlation logic can be specified for authoritative applications. An authoritative application is commonly used as a trusted source for identity data, such as HR or another system of record. During aggregation, IdentityIQ reads account or source records from the application and uses correlation logic to determine whether each record should be linked to an existing IdentityCube or used in identity creation and update processing.

Correlation logic may be configured using account attributes, identity attributes, or correlation rules. For example, an authoritative source may correlate records by employee ID, user name, email address, or another unique identifier. This ensures that incoming authoritative data updates the correct identity instead of creating duplicates or leaving records uncorrelated.

The authoritative nature of the application does not eliminate the need for correlation. It defines the trust level and identity-data role of the source, while correlation defines how records from that source are matched to identities in IdentityIQ.

Reference topics: Applications, authoritative applications, correlation options, account aggregation, IdentityCube creation, identity attribute mapping, and uncorrelated account resolution.

Yes. In SailPoint IdentityIQ, birthright roles represent access that is automatically granted based on identity context, such as job function, department, location, lifecycle state, or organizational assignment. A mover lifecycle event occurs when an identity undergoes a material change, such as transfer to a new department, change in manager, change in location, or change in business role eligibility. Because these changes can alter what baseline access the identity should have, birthright role assignment may be processed as part of the mover event.

The mover event can launch a configured business process that evaluates the identity’s updated attributes and initiates access changes, including assignment of new birthright roles or removal of access no longer appropriate. This differs from requestable roles, where a user or manager explicitly asks for access through Lifecycle Manager. Birthright access is driven by identity state and business rules.

Therefore, the statement is accurate. Mover lifecycle processing can be used to keep baseline role-based access aligned with the user’s changed business position. Reference topics: Access Modeling, birthright roles, role assignment, Identity Refresh, Lifecycle Events, mover processes, and Provisioning.

Defining corporate reporting hierarchies is not a primary purpose of Identity Governance and Administration. In SailPoint IdentityIQ, reporting hierarchy data is typically consumed from an authoritative source, such as an HR system, rather than created as the central objective of IGA. IdentityIQ may use manager relationships for identity correlation, access reviews, approval routing, escalation, lifecycle processing, and certification ownership, but the system’s purpose is not to design or maintain the enterprise organizational chart.

IGA focuses on identity security outcomes: determining who users are, what access they have, whether that access is appropriate, how access was granted, and how inappropriate or risky access should be remediated. Manager and reporting-line data supports these controls, but it is supporting identity context, not the governance objective itself.

For example, a manager attribute may be used during Identity Refresh, certification generation, or access request approval. However, the business function of defining the reporting hierarchy normally remains with HR or organizational management systems.

Reference topics: Foundational Concepts — purpose of identity security; Identity Modeling — manager correlation and IdentityCube attributes; Governance — certification ownership and approval routing.

No. This definition describes a rule more closely than an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the centralized identity model that represents a person or non-person identity inside IdentityIQ. It contains consolidated identity information such as identity attributes, correlated application accounts, assigned and detected roles, entitlements, manager relationship, lifecycle state, policy violations, certifications, and other governance-relevant data.

A “snippet of code containing custom business logic” refers to a BeanShell rule. Rules are executable logic used to customize IdentityIQ behavior in areas such as aggregation, correlation, provisioning, policy evaluation, workflow processing, and identity attribute transformation. They are configuration objects containing code, while Identity Cubes are data/model objects representing identities and their access.

Therefore, the statement is inaccurate because an Identity Cube is not custom code. It is the core identity record used by IdentityIQ for governance, access modeling, policy detection, requests, certifications, and provisioning decisions.

Reference topics: Identity Modeling, IdentityCube contents, identity attributes, correlated accounts, roles and entitlements, BeanShell rules, Foundational Concepts, and IdentityIQ object model.

The statement is false. The Edit Identity QuickLink is not intended merely to view identity details; its purpose is to initiate an identity modification request. In IdentityIQ, QuickLinks are request-entry mechanisms that expose controlled actions to users based on QuickLink Population rules, capabilities, request configuration, and target permissions. The Edit Identity QuickLink allows an authorized user to update configured identity attributes, typically through a form-driven request process that may include validation, approval, audit tracking, and workflow execution.

Viewing identity details is a separate functional concept. Identity information is normally reviewed through identity search, identity warehouse views, certification access review context, or identity detail pages, where the user can inspect IdentityCube data such as attributes, accounts, roles, entitlements, manager, and policy violations. Edit Identity may display current values so the requester understands what is being changed, but display is contextual, not the primary function.

Therefore, “It is used to view details about an identity” describes a view-oriented function, not the Edit Identity QuickLink. Reference topics: User-Driven Requests, QuickLink Populations, create/edit/self-service identity requests, Identity Modeling, and IdentityCube usage.

The statement is false. The Identity Refresh task does not execute aggregation rules configured on an application definition. Aggregation rules are part of the application aggregation process, where IdentityIQ connects to a source system, reads account or group data, applies connector and application-level processing, and stores account links, entitlement values, and related data in the IdentityIQ repository.

The Identity Refresh task operates after data is already present in IdentityIQ. Its function is to update IdentityCubes and recalculate identity-level governance information. Depending on selected options, Identity Refresh may update identity attributes, refresh role assignments, detect assigned or detected roles, evaluate policies, process lifecycle events, refresh manager relationships, or recalculate risk and access-related identity state.

Application aggregation and identity refresh are separate task functions. Aggregation obtains and normalizes data from applications; Identity Refresh interprets and recalculates identity governance state using that aggregated data. Therefore, rules tied specifically to aggregation on the application definition are execute during aggregation, not during Identity Refresh.

Reference topics: Identity Modeling — Identity Refresh task options; Applications — aggregation rules and application definitions; Foundational Concepts — tasks and workflows.

The statement is false. The Identity Refresh task is used to update and recalculate identity-related data in IdentityIQ, not to manage open work item reminders. Its purpose is to refresh IdentityCubes after aggregation or identity data changes. Depending on selected task options, Identity Refresh can recalculate identity attributes, apply correlation-related updates, refresh role assignments and detections, evaluate policies, process lifecycle events, update risk-related data, and ensure that the identity model reflects the current state of authoritative and application data.

Open work items belong to IdentityIQ’s workflow and governance execution layer. Reminders, escalations, expirations, and related work item follow-up behavior are handled through work item configuration, workflow behavior, certification configuration, and maintenance-style processing rather than the Identity Refresh task. Although Identity Refresh may trigger downstream actions such as lifecycle events or policy evaluation, it is not the task responsible for notifying users about pending approvals or review items.

Therefore, sending reminders for open work items is outside the purpose of Identity Refresh. Reference topics: Identity Modeling — common Identity Refresh options; Foundational Concepts — tasks versus workflows; Governance — work items, certifications, reminders, and escalation behavior.