Free SailPoint IdentityIQ-Engineer Practice Exam with Questions & Answers | Set: 5

The statement that the Debug-Logging page does not have to be reloaded when the log4j file is altered while the application server is running is incorrect. In SailPoint IdentityIQ, if you modify the log4j configuration file while the application is running, you generally need to reload the Debug-Logging page to reflect those changes. Without reloading, the page will not display the updated logging configurations, and the changes will not take effect until the application server or the logging system within the server acknowledges those changes.

Therefore, the correct answer is B. No.

No. ManagedAttribute objects represent managed entitlement or account-group values from applications. They are not generally viewed on the Policy tab of the View Identity QuickLink. The Policy tab is used for policy-related information such as policy violations or compliance policy context, not for listing all entitlements associated with the identity. A user’s entitlements and accounts are normally viewed through identity access/account-related tabs or identity cube access views, depending on UI configuration. This proposed statement confuses ManagedAttribute entitlement data with policy-violation data. A ManagedAttribute may be involved in a policy violation, certification item, access request, or entitlement display, but that does not mean all ManagedAttribute objects associated with an Identity are visible from the Policy tab. The correct engineering distinction is: ManagedAttribute equals governed entitlement metadata; Policy tab equals policy/compliance information. References/topics: IdentityIQ Engineer — ManagedAttribute, Identity Cube, View Identity QuickLink, entitlement display, policy violations.

Owner is a required and important application configuration element in IdentityIQ. Application ownership establishes accountability for the connected system and is used across governance operations such as access reviews, application owner certifications, approval routing, policy handling, and administrative responsibility. IdentityIQ’s governance model depends heavily on ownership metadata because applications are not merely technical connector records; they are governed objects. Assigning an owner allows IdentityIQ to determine who is responsible for application access, certification decisions, and operational oversight. While some low-level object imports may technically create incomplete objects, from the application setup perspective an engineer should treat Owner as required. Without an owner, downstream governance functions become weak or ambiguous because IdentityIQ cannot reliably route application-specific reviews or approvals to the responsible business or technical authority. The proposed option is therefore valid as a required setup item. References/topics: IdentityIQ Engineer — application definition, application owner, governance accountability, certification ownership, access approval routing.

The statement " All Identity Mappings must use a rule to set the identity attribute " is incorrect. While source mapping rules can be used to populate identity attributes dynamically, it is not mandatory for all identity mappings to rely on a rule. Identity mappings can also be configured using direct mappings, where attributes from a source are directly mapped to IdentityIQ attributes without any rule-based logic.

Therefore, the correct answer is B. No.

Here’s how the SailPoint IdentityIQ console commands correspond to their respective functions:

connectorDebug: debug the connector to identify issues in the connector.

source: authenticate to IdentityIQ as another user.

list: list objects.

provision: evaluate and execute a provisioning plan.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

connectorDebug:

SailPoint IdentityIQ Console Guide (section on connector troubleshooting).

source:

This command allows you to authenticate as another user within the IdentityIQ system. It ' s useful for testing user-specific actions or behaviors without logging out and back in.Reference: SailPoint IdentityIQ Admin Guide (section on user authentication and delegation).

list:

This function returns a list of objects or entities within the system. In IdentityIQ, objects could include applications, roles, policies, and more.Reference: SailPoint IdentityIQ Console Reference Guide (list and query commands).

provision:

The provision command evaluates and executes a provisioning plan. This is the actual process that implements changes in user access across connected systems based on the identity lifecycle event.Reference: SailPoint IdentityIQ Provisioning Guide (execution of provisioning plans).

By matching these commands to their respective functions, the detailed functionalities of IdentityIQ’s console tools are properly understood for administrative and troubleshooting purposes.

Not all Application objects in SailPoint IdentityIQ must have an Identity object as the owner. While it is common practice to assign an owner to an Application object for governance and administration purposes, it is not a strict requirement. Applications can exist without a direct association to an Identity object. The ownership concept in IdentityIQ is more of a best practice for accountability rather than a mandatory attribute. Refer to the SailPoint IdentityIQ Application Definition Guide for more information on the configuration and management of Application objects.

In SailPoint IdentityIQ, the specific configuration that allows a user to enable an account for themselves or a subordinate through the " Manage Accounts " option does not necessarily need to be configured in Lifecycle Manager (LCM) alone. While LCM does provide extensive capabilities for account management actions like provisioning, rehire, and more, enabling an account is primarily tied to the permissions and entitlements granted to the user through their role, capabilities, and access profiles.

To address the specific functionality described:

Manage Accounts is typically a part of IdentityIQ’s broader account management capabilities, which are not exclusively tied to LCM. The ability to enable or disable accounts can be governed by rules and workflows within IdentityIQ, and these may or may not be linked directly to LCM configurations.

Rehire Action in LCM: The " Rehire " action within LCM Configuration is specific to processes related to reactivating an employee’s identity when they are rehired. This does not directly relate to enabling an account from the " Manage Accounts " screen. Rehire workflows typically involve reinstating the user’s previous access, which could include enabling accounts, but this is a broader process.

Permissions and Roles: The ability to enable accounts is often governed by the permissions assigned to a user’s role within IdentityIQ. These permissions may be granted outside of LCM configurations and handled by IdentityIQ’s access governance framework.

Workflow Configurations: Enabling or disabling an account could also be tied to specific workflows, which can be configured separately from LCM, using IdentityIQ’s workflow engine. These workflows determine the steps and approvals required to perform such actions.

SailPoint IdentityIQ Configuration Guide: Account Management

SailPoint IdentityIQ Lifecycle Manager Configuration Guide

SailPoint IdentityIQ Administration Guide (Sections on Roles and Permissions, Workflow Configurations)

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

The statement that " All certifications include generation, the active period, sign-off, and the end period " is true. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization ' s policies.

SailPoint IdentityIQ Certification Administrator ' s Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)

No. The Environment tab in the IdentityIQ Administrator Console is not used to start or stop a particular application server. Starting and stopping an application server is an infrastructure-level operation handled by the application-server platform, operating system service manager, container orchestration layer, or hosting environment. IdentityIQ can display environment and runtime information, but it does not replace WebLogic, Tomcat, JBoss/WildFly, systemd, Windows Services, Kubernetes, or other server-control mechanisms. This distinction matters because engineers must not assume IdentityIQ UI controls can manage the underlying Java application server lifecycle. The Environment area is for visibility and administrative inspection, not for controlling server process state. To restart or stop a node, the engineer must use the proper server administration tool and follow clustered-environment procedures to avoid disrupting tasks, workflow execution, aggregation, provisioning, or user sessions. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, application server administration, clustered deployment operations, runtime monitoring.