Free SailPoint IdentityIQ-Engineer Practice Exam with Questions & Answers | Set: 5

No. The proposition incorrectly equates account ownership with the accounts personally held by the reviewer. Those are different relationships.

In ownership-based governance, the relevant question is which accounts or governed objects the reviewer is responsible for, not which target-system accounts belong to the reviewer ' s own identity. IdentityIQ explicitly supports ownership relationships independently from account possession. For example, account ownership can be assigned to another Identity, and targeted certifications can use an Owner filter to select accounts owned by specified identities.

Likewise, IdentityIQ ' s certification architecture generally routes reviews according to governance responsibility: an Application Owner reviews access to applications for which that person is responsible, an Entitlement Owner reviews identities holding entitlements the reviewer owns, and account-group reviews are driven by ownership of the corresponding governed objects. The reviewer need not personally possess that access.

Therefore, an ownership-based account certification is not limited to accounts that the certifier personally “holds.” Its purpose is to review accounts for which that identity has ownership/responsibility according to IdentityIQ ' s governance model.

References/topics: IdentityIQ Engineer — account ownership, certification ownership, targeted certification Owner filter, Application Owner certification, governance responsibility.

=======

Yes, the typical input variables for a rule are listed in the BeanShell rule editor in IdentityIQ, based on the rule registry. When you create or edit a rule in IdentityIQ using the BeanShell editor, the available input variables that are relevant to the rule type are typically pre-defined and listed based on the rule registry. These input variables provide context and data that the rule can operate on, and their availability helps guide the rule development process.

Therefore, the correct answer is A. Yes.

A Role Composition Certification is specifically designed to ensure that roles are composed correctly by reviewing the entitlements and other roles they aggregate. This certification allows reviewers to verify whether the roles include the appropriate entitlements based on business needs and compliance requirements.

Given that the bank ' s objective is to ensure that all roles include the correct entitlements, a Role Composition Certification is the most appropriate tool to achieve this goal. It allows for the comprehensive review and validation of roles and their associated entitlements, ensuring alignment with the overall access governance strategy.

Therefore, the correct answer is A. Yes.

Yes. Configuring a role to contain a set of entitlements is fundamental to IdentityIQ role modeling. IdentityIQ defines a role as a collection of access that enables an identity to perform a business or technical function. For IT-oriented roles in particular, entitlement profiles define the access that is provisioned when the role is assigned. An entitlement can represent a specific value of an account attribute, such as membership in an Active Directory group, or a permission on a target application.

The Role Editor includes an Entitlements section in which engineers can create profiles and associate multiple entitlements with the role. SailPoint documentation specifically states that a profile is a set of entitlements on an application and that the engineer can specify as many entitlements as required for a role. This allows complex access requirements to be packaged into a governed reusable role rather than individually assigning each entitlement to every identity.

Therefore, the proposed solution is valid.

References/topics: IdentityIQ Engineer — Role Editor, IT Roles, entitlement profiles, role provisioning, role-based access model.

=======

Changing the Email Notification Type to POP3 under Global Settings > Configure IdentityIQ Settings > Mail Settings is not a correct procedure for testing generated emails in a non-production system. POP3 is an email retrieval protocol, not a method for sending or redirecting email notifications from IdentityIQ. IdentityIQ requires an SMTP server to send emails, and POP3 is typically used by email clients to retrieve emails from a server, not by a server to send emails.

For testing purposes in a non-production environment, you would typically configure the SMTP server settings to either redirect emails to a specific testing mailbox or use a " Redirect to File " option, if available, to capture emails locally.

Thus, the correct answer is B. No.

Yes. A String attribute type is appropriate for an account attribute whose value must be derived from application account data such as a privileged attribute and a responsibility-code attribute and subsequently consumed by IdentityIQ analytics, rules, and policy logic.

The source requirements indicate that IdentityIQ needs a persistable account-level value that can represent the result obtained or calculated from those source attributes. A String provides a suitable representation for values such as classification codes, privileged-state labels, responsibility codes, or normalized flag values and can be compared by BeanShell rules, search filters, and policy constraints.

This configuration does not by itself satisfy the entire requirement. Source mapping/calculation must also be configured correctly. The Word bank already contains this same stem with Source Mappings: Application Rule and recognizes that source-processing configuration as necessary, while separately evaluating Edit Mode: Read Only.

DOMC evaluates each proposition independently: the fact that other configuration settings are also necessary does not make Attribute Type: string invalid.

References/topics: IdentityIQ Engineer — account attributes, attribute data types, application-rule source mapping, Advanced Analytics, rules, policy attributes.

This implementation is not correct. The requirement is to return all account names for an identity on the application MagicBox, but the code retrieves only a single Link by calling service.getLink(identity, " MagicBox " ). Even worse, the while (link != null) loop never changes the link variable, so if a link is found, the loop becomes infinite and repeatedly adds the same native identity. A correct implementation must retrieve the application object, obtain all matching Link objects for the identity and application, iterate over that list, and add each link’s native identity once. There is also no visible import for ArrayList or List, although BeanShell environments may sometimes tolerate imports differently. The fatal issue remains the flawed loop and single-link retrieval. IdentityIQ account data is represented by Link objects, and multiple accounts may exist for the same identity on the same application depending on connector and policy design. References/topics: IdentityIQ Engineer — IdentityService, Link objects, native identity, BeanShell API usage, account lookup logic.

An Application Owner Certification is primarily used to certify entitlements and roles associated with specific applications. It involves application owners reviewing access within their applications, which is useful for ensuring that access aligns with the intended security policies for that application.

However, in the context of ensuring that roles include the correct entitlements across the entire role model, a more suitable certification type would be a Role Composition Certification. This type specifically focuses on validating the composition of roles, including the entitlements they aggregate.

Therefore, an Application Owner Certification will not fully achieve the goal of ensuring all roles include the correct entitlements. The correct answer is B. No.

In SailPoint IdentityIQ, the specific configuration that allows a user to enable an account for themselves or a subordinate through the " Manage Accounts " option does not necessarily need to be configured in Lifecycle Manager (LCM) alone. While LCM does provide extensive capabilities for account management actions like provisioning, rehire, and more, enabling an account is primarily tied to the permissions and entitlements granted to the user through their role, capabilities, and access profiles.

To address the specific functionality described:

Manage Accounts is typically a part of IdentityIQ’s broader account management capabilities, which are not exclusively tied to LCM. The ability to enable or disable accounts can be governed by rules and workflows within IdentityIQ, and these may or may not be linked directly to LCM configurations.

Rehire Action in LCM: The " Rehire " action within LCM Configuration is specific to processes related to reactivating an employee’s identity when they are rehired. This does not directly relate to enabling an account from the " Manage Accounts " screen. Rehire workflows typically involve reinstating the user’s previous access, which could include enabling accounts, but this is a broader process.

Permissions and Roles: The ability to enable accounts is often governed by the permissions assigned to a user’s role within IdentityIQ. These permissions may be granted outside of LCM configurations and handled by IdentityIQ’s access governance framework.

Workflow Configurations: Enabling or disabling an account could also be tied to specific workflows, which can be configured separately from LCM, using IdentityIQ’s workflow engine. These workflows determine the steps and approvals required to perform such actions.

SailPoint IdentityIQ Configuration Guide: Account Management

SailPoint IdentityIQ Lifecycle Manager Configuration Guide

SailPoint IdentityIQ Administration Guide (Sections on Roles and Permissions, Workflow Configurations)

Defining an application is not a default functionality of the Lifecycle Manager (LCM) module. Application definitions are typically part of the core IdentityIQ platform and are managed through the IdentityIQ Administration module, not Lifecycle Manager. LCM is primarily focused on managing identity lifecycle events, such as onboarding (Joiner), role changes (Mover), and offboarding (Leaver).

Therefore, the correct answer is B. No.