IdentityIQ-Associate Dumps with Practice Exam Questions Answers

The statement is true. In SailPoint IdentityIQ, group factories are used to generate identity groups dynamically based on identity attribute values or configured grouping logic. A group factory defines the rule or attribute basis for grouping identities, but the actual creation or refresh of the resulting groups occurs when the appropriate task is executed. For example, a group factory might be configured to create groups by department, location, cost center, or business unit. When the task runs, IdentityIQ evaluates identities against the factory definition and creates or updates the corresponding groups.

This differs from populations, which are typically defined sets of identities used for targeting, filtering, reporting, or governance scoping. Group factories are more generation-oriented because they can produce multiple group objects from identity data. The task execution step is important because it materializes the groups so they can be used in IdentityIQ operations.

Therefore, new groups can be created as a result of executing a task tied to group factory processing. Reference topics: Identity Modeling — groups and populations, group factories, identity grouping, and task-driven group creation.

No. The “Detect deleted accounts” aggregation task option is not used to ignore accounts that were previously deleted from IdentityIQ. Its purpose is to compare the accounts returned by the current aggregation with the accounts already stored in IdentityIQ for that application. When an account exists in IdentityIQ but is no longer found in the authoritative aggregation results from the source application, IdentityIQ can treat that account as deleted or removed from the target system.

This option helps keep IdentityIQ’s account inventory accurate by identifying stale Links that remain in IdentityIQ even though the corresponding account is no longer present on the application. It is especially important for governance accuracy because certifications, policy checks, identity warehouse views, and access reporting rely on current account and entitlement data.

The statement is incorrect because it reverses the behavior. Detecting deleted accounts is about recognizing accounts missing from the source during aggregation, not ignoring newly returned source accounts that were once deleted in IdentityIQ.

Reference topics: Applications, aggregation task options, account aggregation, deleted account detection, Link maintenance, IdentityCube account data, and application data reconciliation.

Yes. Granting an IdentityIQ capability is a valid way to provide access to additional functions within SailPoint IdentityIQ, including areas such as Advanced Analytics. Capabilities are part of IdentityIQ’s internal authorization model. They determine what a logged-in user is allowed to see and perform inside the IdentityIQ interface, such as administration, reporting, certification administration, role management, policy management, or advanced search and analysis functions.

Advanced Analytics searches are IdentityIQ functions, not external application permissions. Therefore, access to those search types is governed by IdentityIQ security controls, including capabilities, rights, and in some deployments, scoping. This is different from granting access on a connected application, which would be handled through accounts, entitlements, roles, access requests, and provisioning.

The key distinction is that capabilities grant authority inside IdentityIQ itself. They do not directly modify a user’s access on a target system. Providing access to different types of Advanced Analytics searches is therefore an appropriate reason to assign an IdentityIQ capability.

Reference topics: Identity Modeling — how IdentityIQ access is granted to users; Foundational Concepts — common IdentityIQ objects and components; Governance — analytics and access visibility.

No. IdentityIQ capabilities are used to control what a user can do inside SailPoint IdentityIQ, not to grant elevated permissions on a connected target application. A capability defines access to IdentityIQ functions such as administration, reporting, certification management, policy management, role management, access request functions, or other internal product features. Capabilities are part of IdentityIQ’s internal authorization model and determine which menus, pages, actions, and administrative operations a logged-in IdentityIQ user may perform.

Elevated permissions on a connected application must be granted through governed access, such as requesting or provisioning an account, entitlement, role, or permission on that target system. That process is handled through access requests, approval workflows, provisioning plans, connector operations, and application-specific provisioning policies. For example, adding a privileged group in Active Directory or assigning an administrative application role would be modeled as target-system access, not as an IdentityIQ capability.

Therefore, granting an IdentityIQ capability is appropriate when the user needs additional permissions within IdentityIQ itself, not when they need elevated access on an external connected application. Reference topics: Identity Modeling — how IdentityIQ access is granted to users; User-Driven Requests — access requests; Provisioning — target application access fulfillment.

Marking an account schema attribute as managed does not mean the attribute can be edited in IdentityIQ. In IdentityIQ application schema configuration, a managed attribute is one whose values are promoted into IdentityIQ as governable access objects, commonly represented in the entitlement catalog. This allows IdentityIQ to attach governance metadata to the discovered values, such as display name, description, owner, requestability, classification, and review-related context.

Editability is controlled through different mechanisms, including provisioning policies, forms, workflows, connector capabilities, and provisioning plan operations. An attribute may be managed for governance purposes without being directly editable by a user in IdentityIQ. Conversely, an attribute may be populated during provisioning if the application connector and provisioning policy support it, but that is separate from the schema’s managed designation.

The managed setting is therefore about governance, cataloging, and access modeling, not direct modification. It enables IdentityIQ to treat values of that schema attribute as objects that can be reviewed, requested, certified, described, and owned.

Reference topics: Applications — account schema attributes and their functions; Access Modeling — entitlement catalog; Governance — certifications; Provisioning — provisioning policies and attribute handling.