Free SailPoint IdentityIQ-Engineer Practice Exam with Questions & Answers

A Workgroup in SailPoint IdentityIQ is a collection of users or identities grouped together for the purpose of task assignment, workflow approvals, or certifications. Workgroups are not typically used for automatically creating multiple groups based on the values of a single identity attribute. To achieve automatic grouping based on identity attributes, you would need to use dynamic roles or possibly rule-based population. These methods allow for creating roles or groups dynamically by evaluating identity attributes and assigning memberships accordingly.

SailPoint IdentityIQ Administration Guide (Sections on Workgroups and Dynamic Roles)

SailPoint IdentityIQ Configuration Guide (Role Management)

Specifying account correlation using a rule cannot be performed using the Rapid Setup application onboarding process. Rapid Setup is designed for straightforward and simplified onboarding processes with a focus on quick configuration, typically using predefined templates and options. However, advanced configurations like custom account correlation rules require more detailed setup, typically done outside of the Rapid Setup UI, involving scripting or detailed configuration within the application definition.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Application Onboarding Sections)

Yes. CertificationItem is one of the IdentityIQ object areas that can be extended to store client-specific data through the supported extended-object/Hibernate mapping approach. The purpose of updating a corresponding .hbm file is to introduce persistent custom columns or mapped properties into the IdentityIQ database model. For certification use cases, client-specific data may need to be stored with review items, such as additional context, classification values, remediation metadata, or custom review attributes. The extension process must not stop at editing the mapping file. The Word bank’s schema-extension process describes the broader pattern: update the Hibernate mapping, generate the schema update script, apply the script to the IdentityIQ database while the application server is stopped, then start the application server and update the corresponding ObjectConfig. Therefore, CertificationItem is a valid object for this proposed extension approach, provided the engineer follows the full supported schema-extension process. References/topics: IdentityIQ Engineer — object extension, CertificationItem, Hibernate mapping, extended schema, ObjectConfig.

The statement " The rule type must be IdentityAttribute " is correct. In SailPoint IdentityIQ, when writing a rule that is intended to map or manipulate identity attributes during the aggregation process, the rule type should be set to " IdentityAttribute " . This ensures that the rule is recognized and executed in the appropriate context for managing identity attributes.

Therefore, the correct answer is A. Yes.

No. Changing an object’s name and saving it through the Debug pages is not the correct way to create a copy. IdentityIQ objects have internal identifiers, references, metadata, and relationships that are separate from display names or object names. Renaming an object modifies the existing object; it does not create a safe duplicate. For some object types, changing the name can also break references, confuse workflows, disrupt imports, or create governance problems. A proper copy process requires exporting the object XML, removing or regenerating identifiers where appropriate, changing the name intentionally, reviewing object references, and importing it as a new object. Even then, engineers must be careful with dependent objects such as rules, workflows, forms, applications, task definitions, and policies. The Debug pages are powerful but dangerous; they are not a casual object-cloning tool. The proposed method is therefore invalid. References/topics: IdentityIQ Engineer — Debug pages, object XML, object IDs, safe object cloning, configuration migration.

An AfterProvisioning rule in SailPoint IdentityIQ is typically used to execute custom logic after the provisioning process has been completed successfully. However, if provisioning fails, this rule will not be triggered because it is specifically designed for post-successful provisioning activities. To log an error message in the audit record when provisioning fails, a better approach would be to use a provisioning error handler or configure a specific workflow that captures errors and logs them accordingly. The AfterProvisioning rule is not the correct solution for this use case. Refer to the SailPoint IdentityIQ Provisioning and Workflow documentation for appropriate methods of handling provisioning errors and audit logging.

Yes, " Business Role " is a default role type available in SailPoint IdentityIQ that a manager can request during the access request process. Business Roles typically represent a collection of entitlements or access rights that align with specific job functions or responsibilities within an organization. Managers can use this role type to extend or modify the access granted to an employee.

SailPoint IdentityIQ Role Management Guide

SailPoint IdentityIQ Administration Guide (Sections on Role Types and Access Request)

This is not a joiner lifecycle event. The person already existed in the organization and previously had accounts. The scenario says their access was disabled and now needs to be reinstated, which is a rehire or reactivation process. In IdentityIQ, that is fundamentally different from onboarding a brand-new employee. A joiner process generally provisions new access and new accounts for a person who is newly hired or newly introduced to the identity-governance system. A rehire or reinstatement process should evaluate prior access, reactivate appropriate accounts, restore or recalculate roles, and avoid re-enabling access that is no longer valid. The phrase “previous accounts enabled” is the key clue: existing accounts are being reactivated, not newly created. Therefore, this proposed scenario should not be classified as a joiner lifecycle event. References/topics: IdentityIQ Engineer — joiner/mover/leaver model, rehire processing, account reactivation, LCM workflow routing, disabled account enablement.

The correct order for performing an initial installation of SailPoint IdentityIQ is:

Ensure all of the application servers are stopped.

Stopping all application servers is crucial to prevent any conflicts or transactional interference during the installation process.

Un-jar the IdentityIQ WAR file in the desired directory of each application server.

Extract the IdentityIQ WAR file in the appropriate location for the application server. This step deploys the IdentityIQ application code.

Configure iiq.properties file with database credentials and datasource.

The iiq.properties file must be updated with correct database credentials and datasource configurations to establish a connection to the IdentityIQ database.

Create the IdentityIQ database.

A new IdentityIQ database must be created for the system. This is the foundation where all IdentityIQ data will be stored.

Generate database schema to include custom attributes by executing ' iiq schema ' .

Use the iiq schema command to generate the necessary database schema. This includes tables, constraints, and other structural components for IdentityIQ.

Initialize default IdentityIQ system objects from ' iiq console ' using the ' import ' command.

Import default system objects like roles, policies, and configuration settings using the IdentityIQ console’s import feature. This sets up the base configuration.

Start all of the application servers.

Once everything is configured, start the application servers to make the IdentityIQ application available.

Apply the latest patch.

Finally, apply any patches to ensure the system is up to date with the latest security and feature enhancements.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Stopping all application servers is necessary to avoid file locks and ensure the WAR deployment and database setup processes can proceed smoothly.

Un-jarring the WAR file deploys IdentityIQ into the server directory structure, making its code accessible for execution.

Configuring the iiq.properties file connects IdentityIQ to the database, establishing where it will read and write data.

Creating the database is fundamental, as the IdentityIQ system relies on a structured data environment.

Generating the database schema via iiq schema builds out the tables and structures necessary for storing identity, access, and policy data.

Initializing system objects sets up core elements of IdentityIQ (like roles, capabilities, and system configurations) required for its operation.

Starting the application servers activates the IdentityIQ environment, allowing the system to begin processing requests.

Applying the latest patch ensures that the installation is up-to-date with all bug fixes, enhancements, and security updates from SailPoint.

SailPoint IdentityIQ Installation Guide (steps on fresh installation and post-installation configurations).

The purpose of an IdentityIQ certification is not to attest to a user ' s integrity. Certifications in IdentityIQ are designed to review and verify user access rights to ensure they are appropriate based on roles, policies, and organizational rules. The focus is on access management rather than personal qualities like integrity.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview