Free SailPoint IdentityIQ-Engineer Practice Exam with Questions & Answers

Yes. The requirement explicitly says the value must be listed as an entitlement on Identity Cubes. In IdentityIQ attribute configuration, marking an attribute as an entitlement-type attribute is what allows the value to be treated and displayed in entitlement/access contexts rather than merely as ordinary profile data. The rest of the requirements describe source mappings and usability: Workday is authoritative, Contractor file is fallback, the value should be usable in rules, and it should appear as an Advanced Analytics option. Those needs may require additional configuration such as source mappings, searchable/indexed behavior, and edit-mode considerations. However, the specific proposed option is “Entitlement,” and that maps directly to Usage 4. Without setting the attribute appropriately, the value may exist on the identity but not appear as an entitlement on the Identity Cube. Therefore, this configuration option is needed. References/topics: IdentityIQ Engineer — identity attribute configuration, entitlement flag, Identity Cube display, Advanced Analytics, source mappings.

Yes. IdentityIQ roles can be configured to include permissions as part of the access represented by the role. A role is fundamentally a logical collection of access that can include application entitlements and permission-based profile definitions. SailPoint describes roles as collections of permissions that group underlying system access into meaningful business or technical units.

Within a role profile, IdentityIQ supports Attribute Permissions in addition to attribute rules. Permissions define rights against targets on an application. An engineer can select rights such as create, read, update, delete, or execute and associate those rights with the appropriate target. These permission definitions become part of the role profile and therefore form part of the access granted through the role.

This should not be confused with IdentityIQ administrative SPRight objects. Application-level permissions contained in a role profile are governed access on target systems, whereas SPRights control functionality inside IdentityIQ itself. IdentityIQ roles can also grant capabilities and scopes when that feature is enabled.

Therefore, configuring a role to contain a set of permissions is a valid role configuration.

References/topics: IdentityIQ Engineer — Role Modeling, role profiles, attribute permissions, entitlements, targets and rights.

=======

Yes. In the IdentityIQ branding guidance relevant to this certification material, retaining the SailPoint copyright notice is identified as a minimum SailPoint branding requirement . Customers can make substantial user-interface customizations—such as modifying logos, CSS styling, message text, colors, and selected page elements—but the supported branding guidance does not mean all SailPoint product identification may simply be removed.

The copyright notice is treated separately from cosmetic branding elements. The established IdentityIQ branding convention requires the copyright notice to remain in the page HTML and to be displayed throughout the IdentityIQ interface. A related requirement applies when the SailPoint name or logo is removed from the header: product attribution such as “Powered by SailPoint IdentityIQ” must be retained in the copyright footer. The existing question bank also contains that separate product-attribution proposition and marks it as valid.

Accordingly, customization is permitted, but the stated minimum copyright attribution requirement remains valid.

References/topics: IdentityIQ Engineer — UI customization, minimum SailPoint branding requirements, copyright footer, SailPoint product attribution, upgrade-safe branding.

=======

In SailPoint IdentityIQ, a Workgroup can indeed be used to provide a group of users with specific capabilities. Workgroups are collections of users that can be assigned roles, tasks, and permissions. By associating capabilities with a Workgroup, all members of that Workgroup will inherit the capabilities defined.

This feature is commonly used to manage teams or departments that need to share specific privileges, such as the ability to approve access requests or manage certifications. Configuring capabilities for a Workgroup is a standard practice within IdentityIQ to simplify permission management and ensure consistent access control across the group.

Therefore, the correct answer is A. Yes.

No. The Provisioning area of the Administrator Console is focused on provisioning transactions , not on providing the current connector/application connection-health status for the associated target application.

A provisioning transaction can provide information about the access request and its processing state—for example whether provisioning is pending, completed, failed, or otherwise awaiting processing. Engineers can use transaction information to investigate provisioning behavior and determine which application and operations are involved. That is not equivalent to displaying whether the underlying application connector is presently connected or healthy.

Application connectivity is investigated through application configuration/testing and the relevant application or connector diagnostic mechanisms. A transaction can fail because of connectivity, authentication, connector configuration, target-system errors, invalid data, workflow problems, or many other causes. Consequently, the transaction state cannot simply be interpreted as the application ' s connection status.

The distinction is tested directly by this DOMC proposition: provisioning transaction monitoring and application connectivity monitoring are separate administrative functions.

References/topics: IdentityIQ Engineer — Administrator Console, Provisioning Transactions, Application connectivity testing, connector troubleshooting, provisioning status.

=======

No. Out-of-the-box LCM workflow control variables govern the runtime behavior of an LCM process , not the population of users authorized to launch the entry point. Control variables can influence processing such as approvals, notifications, policy checking, provisioning behavior, background/foreground execution, templates, and other workflow decisions.

Determining who can launch an LCM operation belongs at the authorization and QuickLink layer. IdentityIQ commonly controls QuickLink availability through QuickLink populations, capabilities, dynamic scopes, and related visibility or access configuration. Once an authorized user launches the operation, the associated LCM workflow executes using its configured control variables.

This architectural distinction matters. A workflow variable can change what happens after invocation, but it should not be confused with the security mechanism that decides whether a particular identity is permitted to invoke that functionality in the first place.

The question bank itself distinguishes this design layer in related LCM propositions: workflow variables control execution behavior, while application or UI eligibility is configured elsewhere.

References/topics: IdentityIQ Engineer — LCM workflow control variables, QuickLinks, QuickLink populations, capabilities, workflow authorization, dynamic scopes.

=======

Export CSV / Import CSV is not a valid action for a policy violation owner when acting on an individual Account Policy violation. In IdentityIQ, a policy violation owner is expected to resolve or manage the violation through violation-handling actions such as allowing, mitigating, remediating, forwarding, or otherwise taking governance action depending on configured permissions and workflow. Exporting or importing CSV files is an administrative or bulk-data activity, not a violation-disposition action. An Account Policy violation normally relates to a condition such as a user having more accounts than permitted on an application or system. The Word bank describes Account policies as policies that limit the number of accounts users may have on a given system. Acting on that violation requires a compliance decision or remediation path, not a CSV operation. Therefore, this proposed solution is not a valid policy-violation owner action. References/topics: IdentityIQ Engineer — Compliance Manager, policy violations, Account Policy, violation remediation, policy owner actions.

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

Yes. The Run Rule facility is useful for isolated BeanShell experimentation and debugging. An engineer can retrieve or construct an IdentityIQ object, invoke methods or modify values in the rule, convert or return the resulting object/XML representation, and inspect the output to understand how the operation affected the object ' s structure.

The critical distinction is between testing object manipulation and displaying the resulting representation versus using Run Rule as a general-purpose persistence tool. The existing Word bank correctly rejects the broader statement that Run Rule ' s benefit is creating, modifying, or deleting SailPoint database objects. It separately recognizes displaying the return value of simple code as a valid Run Rule benefit.

The video proposition is aligned with the second use case. Printing an object ' s XML after invoking methods on it gives the engineer a controlled way to inspect changes and understand SailPoint object behavior while developing or troubleshooting BeanShell logic.

Production caution remains necessary because arbitrary rules can call persistence APIs and cause side effects.

References/topics: IdentityIQ Engineer — Debug-Object, Run Rule, BeanShell testing, SailPointObject XML, object manipulation, return values.

=======

Schedule Policy Composition Certification is not a valid action for handling an individual Account Policy violation. A policy violation owner acts on a violation by making a decision about that violation: allow it, remediate it, mitigate it, or route it according to configured compliance processes. A Policy Composition Certification is a separate governance activity used to review the construction or definition of policies; it is not an immediate action available on a single violation record. The proposed solution also mismatches the policy type. The stem concerns an Account Policy violation, which typically relates to account-count or account-condition rules, not policy-composition review. The Word bank separately identifies Account policies as limiting the number of accounts a user can have on a system. Scheduling a certification might help long-term governance hygiene, but it does not dispose of the current policy violation. References/topics: IdentityIQ Engineer — Account Policy violations, violation owner actions, certification types, policy composition certification, compliance remediation workflow.