Free SailPoint IdentityIQ-Engineer Practice Exam with Questions & Answers | Set: 2

The statement isfalse. In SailPoint IdentityIQ, there is no strict limitation on nesting sub-workflows (subprocesses) up to 3 levels. You can nest sub-workflows as deeply as required by your business logic and system design. However, it is advisable to manage the complexity of nested workflows to ensure maintainability and performance, but there is no enforced limit of 3 levels for nesting.

References:

SailPoint IdentityIQ Workflow Guide

SailPoint IdentityIQ Administration Guide (Sections on Workflow Design Best Practices)

The statement "All Identity Mappings must use a rule to set the identity attribute" is incorrect. While source mapping rules can be used to populate identity attributes dynamically, it is not mandatory for all identity mappings to rely on a rule. Identity mappings can also be configured using direct mappings, where attributes from a source are directly mapped to IdentityIQ attributes without any rule-based logic.

Therefore, the correct answer isB. No.

In SailPoint IdentityIQ, the specific configuration that allows a user to enable an account for themselves or a subordinate through the "Manage Accounts" option doesnotnecessarily need to be configured in Lifecycle Manager (LCM) alone. While LCM does provide extensive capabilities for account management actions like provisioning, rehire, and more, enabling an account is primarily tied to the permissions and entitlements granted to the user through their role, capabilities, and access profiles.

To address the specific functionality described:

Manage Accountsis typically a part of IdentityIQ’s broader account management capabilities, which are not exclusively tied to LCM. The ability to enable or disable accounts can be governed by rules and workflows within IdentityIQ, and these may or may not be linked directly to LCM configurations.

Rehire Action in LCM: The "Rehire" action within LCM Configuration is specific to processes related to reactivating an employee’s identity when they are rehired. This does not directly relate to enabling an account from the "Manage Accounts" screen. Rehire workflows typically involve reinstating the user’s previous access, which could include enabling accounts, but this is a broader process.

Permissions and Roles: The ability to enable accounts is often governed by the permissions assigned to a user’s role within IdentityIQ. These permissions may begranted outside of LCM configurations and handled by IdentityIQ’s access governance framework.

Workflow Configurations: Enabling or disabling an account could also be tied to specific workflows, which can be configured separately from LCM, using IdentityIQ’s workflow engine. These workflows determine the steps and approvals required to perform such actions.

References:

SailPoint IdentityIQ Configuration Guide: Account Management

SailPoint IdentityIQ Lifecycle Manager Configuration Guide

SailPoint IdentityIQ Administration Guide (Sections on Roles and Permissions, Workflow Configurations)

The statement that "the staging period is required" for certifications isnot true. In SailPoint IdentityIQ, the staging period is anoptionalphase during the certification campaign configuration. The staging period is used to pre-generate certifications and allow for any preparatory actions or adjustments before the certifications are officially launched and sent to reviewers. However, it is not a mandatory component for all certification campaigns.

Administrators may choose to bypass the staging period entirely depending on the specific requirements of the certification process or the urgency of the certification campaign. Therefore, while the staging period can be beneficial for managing large or complex certifications, it is not a required step.

References:

SailPoint IdentityIQ Certification Overview Guide

SailPoint IdentityIQ Administration Guide (Sections on Certification Configuration and Staging Period)

Creating a custom audit event and setting up an associated report involves steps such as defining the audit event, modifying the audit configuration, and creating a custom report using the SailPoint IdentityIQ reporting framework. Simply creating a Data Export task does not fulfill these requirements. A Data Export task is used for exporting data from IdentityIQ and is unrelated to the creation of custom audit events or custom reports. Refer to the SailPoint IdentityIQ Reporting Guide and the IdentityIQ Audit Framework documentation for more information on correctly creating and configuring custom audit events and reports.

The Rapid Setup user interface configuration options in IdentityIQ can be used to disable an account and remove all its entitlements on a particular application during Leaver events. Rapid Setup is designed to simplify the configuration of common identity lifecycle processes, including handling leaver (termination) events. When configuring these events, you can specify actions such as disabling accounts and removing entitlements from specific applications as part of the termination process.

References:

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Lifecycle Manager Guide (Sections on Lifecycle Event Configuration)

Rapid Setup application onboarding is designed to simplify the initial configuration and does not typically provide advanced configuration options like specifying an account attribute and value filter to identify secondary accounts. Such detailed configurations often require custom scripting or detailed adjustments within the standard application setup, outside of the Rapid Setup interface.

References:

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Sections on Application Onboarding and Advanced Account Mapping)

QUESTIONNO: 39

Can the following action be performed using Rapid Setup application onboarding?

Solution:Specify account correlation by mapping an identity attribute to an account attribute.

A. Yes

B. No

Answer:A

Rapid Setup does allow for specifying account correlation by mapping an identity attribute to an account attribute. This is a standard part of the onboarding process where you define how IdentityIQ should correlate accounts to identities. This basic mapping functionality is included in Rapid Setup to facilitate straightforward account correlation during application onboarding.

References:

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Mapping Sections)

The statement isfalse. In SailPoint IdentityIQ, the language displayed in the user interface is not always based on the default language selected in the global settings. The language displayed in the user interface is typically determined by the user's language preference, which can be set individually for each user. If a user's preferred language is not available, then the system may fall back to the default language specified in the global settings. Thus, while the global default language serves as a fallback, the actual language displayed is often based on user-specific settings.

References:

SailPoint IdentityIQ Administration Guide (Localization and Language Settings Sections)

SailPoint IdentityIQ User Guide (User Preferences and Language Selection)

The scenario described involves disabling an account and removing all its entitlements on a particular application during Mover events. The Rapid Setup user interface in SailPoint IdentityIQ primarily handles common configurations like enabling or disabling accounts, assigning or unassigning roles, and triggering certifications during lifecycle events.

However, the combination of disabling an account and removing all its entitlements for a Mover event typically involves more detailed configuration that goes beyond the capabilities of the Rapid Setup interface. Achieving this would generally require creating a custom workflow or a specific rule that handles both disabling the account and removing entitlements based on the Mover event triggers.

Thus, the Rapid Setup UI cannot achieve this level of detailed configuration, making the correct answerB. No.

The four minimum steps necessary to extend attributes in an IdentityIQ database after it has been created, in the correct order, are:

Update the corresponding hibernate file with the new attributes.

The Hibernate mapping file needs to be updated with the new attributes so that the SailPoint IdentityIQ application is aware of the new columns or properties in the database. This step ensures that the object-relational mapping (ORM) reflects the updated data model.

Run the command to generate the script to update the IdentityIQ database.

After updating the Hibernate file, a schema update script is generated. This script contains the necessary SQL commands to modify the database schema based on the new attributes added in the Hibernate file.

Shut down the application server and then run the generated extendedSchema script on the IdentityIQ database.

Before applying schema changes, the application server must be stopped to avoid any transactional conflicts. Afterward, the extendedSchema script is run on the database to apply the new attributes.

Start the application server and update the corresponding ObjectConfig.

Once the database schema is updated, restart the IdentityIQ application server and modify the ObjectConfig in SailPoint to register the new attributes for use within the IdentityIQ platform.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Updating the Hibernate File: This step involves modifying the Hibernate XML or annotation-based mapping files to reflect the new attributes that are being added to the database. SailPoint IdentityIQ uses Hibernate as its ORM, and any new database fields must first be defined at this layer.

Generating the Schema Update Script: SailPoint provides a command (usually via iiq console or build tools) that reads the updated Hibernate mapping and generates a database-specific script to alter the schema. This ensures that the database is modified in a way that matches the application's expectations.

Running the Schema Update Script: With the application server stopped, the schema update script is executed on the database. This step adds the new columns, indexes, or constraints that are required for the extended attributes.

Updating the ObjectConfig: Once the database is updated and the application server is running again, the ObjectConfig (typically located in the IdentityIQ admin UI) must be updated to incorporate the new fields. This step ensures that these new attributes are accessible to workflows, forms, and identity data within the system.