Free SailPoint IdentityIQ-Associate Practice Exam with Questions & Answers | Set: 2

Marking an account schema attribute as managed does not mean the attribute can be edited in IdentityIQ. In IdentityIQ application schema configuration, a managed attribute is one whose values are promoted into IdentityIQ as governable access objects, commonly represented in the entitlement catalog. This allows IdentityIQ to attach governance metadata to the discovered values, such as display name, description, owner, requestability, classification, and review-related context.

Editability is controlled through different mechanisms, including provisioning policies, forms, workflows, connector capabilities, and provisioning plan operations. An attribute may be managed for governance purposes without being directly editable by a user in IdentityIQ. Conversely, an attribute may be populated during provisioning if the application connector and provisioning policy support it, but that is separate from the schema’s managed designation.

The managed setting is therefore about governance, cataloging, and access modeling, not direct modification. It enables IdentityIQ to treat values of that schema attribute as objects that can be reviewed, requested, certified, described, and owned.

Reference topics: Applications — account schema attributes and their functions; Access Modeling — entitlement catalog; Governance — certifications; Provisioning — provisioning policies and attribute handling.

The statement is false. The Identity Refresh task does not use application definitions to determine how to connect to native target systems. That function belongs to application aggregation and connector-based operations. In IdentityIQ, an application definition contains the connector configuration, schemas, correlation settings, aggregation options, and provisioning-related settings required for IdentityIQ to communicate with a managed system.

The Identity Refresh task operates primarily on identity data already present inside IdentityIQ. It updates IdentityCubes by recalculating identity attributes, refreshing role assignments and detections, evaluating policies, processing lifecycle events, updating manager relationships, and applying selected identity model calculations. It is typically run after aggregation or configuration changes so that identity-level governance data reflects current account and entitlement information.

Therefore, connecting to native systems is not the purpose of Identity Refresh. IdentityIQ connects to native systems through aggregation tasks or provisioning operations that reference the application definitions and connectors. Identity Refresh consumes the resulting identity, account, entitlement, and application link data within the IdentityIQ repository.

Reference topics: Identity Modeling — Identity Refresh options; Applications — application definitions and connector settings; Foundational Concepts — tasks versus workflows; Provisioning — connector-based fulfillment.

No. BeanShell rules are not required to implement aggregation in SailPoint IdentityIQ. Aggregation is a standard IdentityIQ function performed through an application definition, connector configuration, schema definition, correlation settings, and aggregation task execution. Many common connectors can aggregate accounts and groups without any custom rule because the connector and schema configuration provide the required instructions for reading objects from the source system.

Rules are used when additional customization is needed. For example, an aggregation rule may transform incoming attribute values, filter records, normalize data, customize correlation behavior, or handle source-specific logic that cannot be expressed through standard configuration. However, this makes rules optional extension points, not mandatory components of aggregation.

A properly configured application can aggregate accounts using its connector settings, account schema, group schema, and aggregation task options alone. Rules should be introduced only when the standard connector behavior and configuration do not satisfy the implementation requirements.

Reference topics: Applications, aggregation tasks, connector configuration, account schema, group schema, correlation options, application rules, connector rules, and IdentityIQ extensibility through BeanShell rules.

No. In IdentityIQ, a birthright role is intended to represent access that is automatically assigned to identities based on defined business criteria, such as lifecycle state, department, location, job function, or other identity attributes. The purpose of a birthright role is automatic access assignment, not user-driven request selection. Rapid Setup can help configure common access-modeling and application-onboarding elements more efficiently, including birthright access patterns, but the birthright concept remains assignment-based rather than request-based.

Requestable access is handled through the access request model, where users select roles, entitlements, or other access items made available through request configuration and QuickLinks. Birthright access is different because it is granted when an identity satisfies the role assignment criteria and is recalculated through identity refresh and role evaluation. Making birthright roles requestable would undermine their purpose as standard baseline access automatically derived from identity data.

Therefore, the statement is inaccurate. Rapid Setup birthright roles are used for automated assignment and baseline access, not as requestable access items. Reference topics: Applications, Rapid Setup, Access Modeling, birthright roles, role assignment, identity refresh, and User-Driven Requests.

Recording which data a user downloads is not a core purpose of Identity Governance and Administration in SailPoint IdentityIQ. IGA is concerned with governing identities, accounts, access, entitlements, roles, policy violations, certifications, access requests, and provisioning. Its central objective is to answer questions such as who a user is, what access they have, whether that access is appropriate, who approved it, and whether access complies with defined business and security policies.

Tracking the specific files, records, or data objects downloaded by a user is typically associated with data activity monitoring, data loss prevention, security information and event management, or user behavior analytics. IdentityIQ may integrate with other systems and can govern access to applications or repositories that contain sensitive data, but it does not primarily function as a tool for recording every data download event.

In IdentityIQ terms, the governance focus is identity security: access visibility, access certification, policy enforcement, role modeling, lifecycle management, and provisioning controls. Reference topics: Foundational Concepts, purpose of identity security, common IdentityIQ terms, governance model, certifications, policies, and provisioning.

The statement is true. In SailPoint IdentityIQ, account attributes are defined on the application’s account schema. The application definition tells IdentityIQ how to represent accounts from a connected source, and the account schema specifies which attributes exist on those accounts. Examples may include account ID, display name, email, status, department, groups, roles, permissions, or other source-specific fields returned by the connector during aggregation.

This is distinct from identity attributes, which are stored on the IdentityCube and represent normalized identity-level data used across IdentityIQ. Account attributes belong to application account links, while identity attributes belong to the identity model. During aggregation, IdentityIQ reads account data according to the application schema and stores the discovered values as account/link attributes. Some account schema attributes may also be marked as managed when their values represent entitlement-like access that should be governed through the Entitlement Catalog.

Therefore, account attributes are correctly defined in the application account schema. Reference topics: Applications — application definitions, account schema attributes, schema attribute properties; Identity Modeling — identity attributes versus account attributes; Access Modeling — managed attributes and entitlement catalog.

The statement is true. In SailPoint IdentityIQ, the Identity Refresh task is used to recalculate and update identity-level data stored on IdentityCubes. One of its core functions is refreshing identity attributes, which are the normalized identity fields IdentityIQ uses for governance, correlation, lifecycle processing, certifications, policy evaluation, role assignment, and reporting. These attributes may originate from authoritative sources, account links, rules, mappings, or configured identity attribute definitions.

When the Identity Refresh task runs with the appropriate options selected, IdentityIQ evaluates the configured identity attribute mappings and updates the IdentityCube accordingly. This ensures that changes from authoritative data or aggregated account information are reflected at the identity level. For example, department, manager, location, job title, status, or lifecycle state may be recalculated and stored on the IdentityCube for downstream governance processes.

This task is different from aggregation. Aggregation collects account and entitlement data from applications, while Identity Refresh updates IdentityIQ’s internal identity model using the data already stored in the repository.

Reference topics: Identity Modeling — IdentityCubes, identity attributes, manager correlation, and common Identity Refresh task options.

Yes. Rapid Setup in SailPoint IdentityIQ is designed to accelerate application onboarding by creating and configuring the application definitions required for IdentityIQ to manage data from connected systems. An application definition is the IdentityIQ object that represents an external source or target system and stores the connector selection, connectivity settings, schema information, aggregation behavior, correlation configuration, and related governance options.

Rapid Setup reduces the amount of manual configuration normally required when defining applications. Instead of building every application definition entirely through the standard detailed configuration screens, Rapid Setup guides the administrator through a simplified setup path and creates the required IdentityIQ application objects from that configuration. Those application definitions can then be used for aggregation, correlation, entitlement discovery, access modeling, and downstream governance processes.

This does not mean Rapid Setup eliminates the need for validation. Administrators must still verify schemas, correlation rules, entitlement treatment, and provisioning behavior. However, the statement is accurate because creating application definitions is a core function of Rapid Setup.

Reference topics: Applications, Rapid Setup, application definitions, connector configuration, schema configuration, aggregation, correlation, and entitlement discovery.

Yes. In SailPoint IdentityIQ, the Active period is the main review window of a certification campaign. During this period, assigned certifiers review the certification items and make access decisions such as approve, revoke, delegate, allow exception, or otherwise act according to the certification configuration. This is the required operational phase in which reviewers complete their access review responsibilities before the certification moves into later lifecycle stages.

The Active period is distinct from other certification timing or processing stages. For example, generation prepares the certification contents, while challenge and remediation periods may occur after reviewer decisions depending on campaign configuration. The Active period specifically represents the time when certification decisions are expected to be made by the responsible reviewers.

Therefore, the definition is accurate because it correctly identifies the Active period as the required review period for certification decision-making. Reference topics: Governance, access reviews, certification lifecycle, Active period, certification decisions, certifier work items, challenge period, remediation, and certification sign-off.

The statement is false. IdentityIQ does not apply a universal rule that removes uncorrelated IdentityCubes after 30 days. Uncorrelated accounts or uncorrelated identity records result from aggregation and correlation processing when IdentityIQ cannot confidently associate an account from an application with an existing IdentityCube. These records remain available for administrative review and remediation until they are resolved through correlation logic, manual correlation, re-aggregation, identity refresh activity, or configured cleanup processes.

The key point is that retention and removal behavior is configuration-driven, not controlled by a fixed 30-day product rule. Administrators may use tasks, aggregation settings, pruning behavior, or lifecycle processes to clean up stale identity or account data, but such actions depend on implementation choices and task configuration. IdentityIQ preserves uncorrelated data because it may represent a real account requiring governance, certification, policy evaluation, or investigation.

Therefore, the assertion that uncorrelated IdentityCubes are automatically removed after 30 days is incorrect. Reference topics: Applications, uncorrelated account resolution, correlation configuration, aggregation results, IdentityCube association, identity refresh, and administrative cleanup tasks.