IdentityIQ-Engineer Questions and Answers

Yes. If a user already has an account on an application and needs the ability to request an additional/new account through Manage User Access, the relevant LCM/QuickLink configuration must permit requesting new accounts. The proposed setting, “Allow requesting new accounts,” is specifically aligned with that requirement. Manage User Access and Manage Accounts behavior is controlled through Lifecycle Manager quicklink and population configuration, which determines what actions are visible and available to eligible users. Without enabling new-account requests for the appropriate QuickLink population, the user may only be able to manage existing account access or request entitlements for current accounts, not initiate a new account request on that application. This setting must also align with the application’s provisioning support and account creation policy. The configuration grants the UI/request capability; successful fulfillment still depends on application schema, create policy, approvals, and provisioning workflow. References/topics: IdentityIQ Engineer — LCM, Manage User Access, Manage Accounts QuickLink, QuickLink population, new account request, provisioning policy.

No. A workflow does not require a step specifically named " end " in order to finish correctly. IdentityIQ workflows end based on transition flow and workflow execution semantics, not because a magic step name exists. Many workflows include an end or stop step by convention because it improves readability and gives designers a clear terminal destination, but the name itself is not mandatory. A workflow may complete when there are no further transitions, when it reaches a terminal workflow structure, or when the process returns/finishes according to the configured step behavior. Confusing a naming convention with a workflow-engine requirement is dangerous because it leads to rigid, incorrect workflow design. Engineers should focus on proper transitions, variables, step actions, approval/form handling, and termination behavior. If a project standard uses a step called end, that is a local design convention, not a product requirement. References/topics: IdentityIQ Engineer — workflow step design, terminal steps, workflow transitions, Business Process Editor, workflow XML conventions.

A Post-Iterate Rule in SailPoint IdentityIQ is a type of connector rule that is executed after each account from the source system (e.g., SQL Loader application) has been read during the aggregation process. This rule allows for additional processing or customization of the data after the account has been iterated over. According to SailPoint IdentityIQ documentation, configuring a Post-Iterate Rule enables the execution of logic after each account ' s data has been processed, confirming that the given statement is valid. Refer to the SailPoint IdentityIQ Connector Development Guide for detailed information on rule execution during aggregation.

The Rapid Setup user interface in SailPoint IdentityIQ is designed to simplify and streamline common configuration tasks, particularly during the initial setup of IdentityIQ environments. However, it has certain limitations in terms of granularity and customization.

In this case, the requirement is to disable an account on a particular application for one set of users and delete the account for another set of users during administrative terminations. The Rapid Setup interface does not provide options to differentiate between user groups for different actions (disable vs. delete) within the same termination event.

This level of specificity—applying different actions based on user group membership—would require a more advanced setup, possibly involving custom rules or workflows rather than using the Rapid Setup options. Therefore, the correct answer is B. No.

Rapid Setup does allow for specifying account correlation by mapping an identity attribute to an account attribute. This is a standard part of the onboarding process where you define how IdentityIQ should correlate accounts to identities. This basic mapping functionality is included in Rapid Setup to facilitate straightforward account correlation during application onboarding.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Mapping Sections)

The statement that " An Application object is not required to aggregate external user account information into IdentityIQ " is false. In SailPoint IdentityIQ, an Application object is essential for aggregating (importing) external user account information. The Application object defines the connection settings, schema, and mapping that enable IdentityIQ to connect to external systems and retrieve identity data. Without an Application object, IdentityIQ would not have the necessary configuration to establish a connection and aggregate user data from external sources.

SailPoint IdentityIQ Administration Guide (Section on Applications and Aggregation)

SailPoint IdentityIQ Integration and Configuration Guide

Yes, this action can be performed as part of configuring an application definition in IdentityIQ. When defining an application, you can specify provisioning policies, including which users should be provisioned with a basic account as part of a joiner event. This is typically done by setting up account creation rules or provisioning policies that trigger when a new user (joiner) is detected, ensuring they receive the necessary basic accounts and entitlements.

Therefore, the correct answer is A. Yes.

Filter String is not required when setting up every IdentityIQ application. A filter string is a connector-specific or configuration-specific option used in some application definitions to limit which accounts, groups, or objects are included during aggregation or connector operations. For example, LDAP-style connectors may use filters to restrict returned accounts, and other connector types may expose filter-like options depending on the source system. That does not make Filter String a universal mandatory field. IdentityIQ applications require core configuration such as application name, connector/type selection, schema information, and account identity handling, but not every application needs a filter. Some applications aggregate all accounts from the configured source, while others use connector-specific search, API, file, or database settings. Treating Filter String as universally required would be wrong because it depends on connector type and business filtering requirements. References/topics: IdentityIQ Engineer — application definition, connector configuration, aggregation filtering, required versus optional application settings.

Yes. IdentityIQ’s Lifecycle Manager workflows are built from reusable workflow components and subprocesses. Many standard LCM subprocesses can be called from custom workflows, provided the engineer understands the expected input variables, return variables, and control flags. This is a preferred engineering pattern because it avoids rewriting complex provisioning, approval, identity request, policy-checking, or notification logic from scratch. Input variables can alter behavior such as approval routing, provisioning mode, policy checking, notification behavior, target identity, requester, plan handling, and subprocess execution path. However, reuse requires discipline: the custom workflow must pass the correct variables, preserve expected types, and handle returned values correctly. Blindly calling an LCM subprocess without matching its contract can produce broken approvals or provisioning behavior. The proposed statement is therefore true because standard LCM subprocesses are intentionally reusable when controlled through documented workflow variables. References/topics: IdentityIQ Engineer — LCM workflows, subprocess reuse, workflow input variables, provisioning workflows, custom workflow development.

The statement is true. In the SailPoint IdentityIQ Reporting user interface, report templates are located on the " Reports " tab. These templates define the structure and parameters of reports but do not contain actual report data. Instances of reports, which are the actual generated reports containing data based on the templates, are located on the " My Reports " tab. The " My Reports " tab is used for viewing and managing reports that have been generated for a specific user.

SailPoint IdentityIQ Reporting Guide

SailPoint IdentityIQ Administration Guide (Section on Reporting Interface)

Yes, the code provided in the second image is correct for including a rule library named " Common Rules Library " in a Rule. The correct syntax is to use class= " sailpoint.object.RuleLibrary " and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the " Common Rules Library. "

Correct Syntax (from the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

This is a valid implementation pattern. The workflow requirement has three routing outcomes, and the proposed solution expresses them as three explicit transition elements. The first transition routes to Stop when the approval flag is false, which corresponds to the Reject or back action. The second transition routes to Audit when the comment variable is not null or empty, using sailpoint.tools.Util.isNotNullOrEmpty(comment). That satisfies the condition that the Approve action was used and the returned form field has a value. The final transition to Provision has no condition, making it the default fallback when the prior transition conditions are not satisfied. This is the correct style for workflow routing because the destination steps are explicitly declared through the to attribute, and the conditional routing is attached to each transition rather than relying on an invalid free-form return block. References/topics: IdentityIQ Engineer — workflow transitions, when conditions, script expressions, form approval routing, default workflow transition behavior.

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

This implementation is not correct. The requirement is to return all account names for an identity on the application MagicBox, but the code retrieves only a single Link by calling service.getLink(identity, " MagicBox " ). Even worse, the while (link != null) loop never changes the link variable, so if a link is found, the loop becomes infinite and repeatedly adds the same native identity. A correct implementation must retrieve the application object, obtain all matching Link objects for the identity and application, iterate over that list, and add each link’s native identity once. There is also no visible import for ArrayList or List, although BeanShell environments may sometimes tolerate imports differently. The fatal issue remains the flawed loop and single-link retrieval. IdentityIQ account data is represented by Link objects, and multiple accounts may exist for the same identity on the same application depending on connector and policy design. References/topics: IdentityIQ Engineer — IdentityService, Link objects, native identity, BeanShell API usage, account lookup logic.

An AfterProvisioning rule in SailPoint IdentityIQ is typically used to execute custom logic after the provisioning process has been completed successfully. However, if provisioning fails, this rule will not be triggered because it is specifically designed for post-successful provisioning activities. To log an error message in the audit record when provisioning fails, a better approach would be to use a provisioning error handler or configure a specific workflow that captures errors and logs them accordingly. The AfterProvisioning rule is not the correct solution for this use case. Refer to the SailPoint IdentityIQ Provisioning and Workflow documentation for appropriate methods of handling provisioning errors and audit logging.

The best policy types for defining each access policy are as follows:

Users cannot be members of the AccountsPayable group in AD and have the CreateVendor access right in the Vendor System application at the same time.Answer: Entitlement SOD

This policy deals with conflicting access rights at the entitlement level (i.e., group membership and specific access rights). " Entitlement Separation of Duties " (SOD) ensures that users don ' t have access to conflicting entitlements.

Users can have two accounts on a given system, but no more.Answer: Account

This policy pertains to the number of accounts a user can have on a system. The " Account " policy type manages restrictions on how many accounts users can possess.

Users who have either the VPN role or the Travel role cannot also be in the Contractor role.Answer: Role SOD

This policy involves conflicting roles. " Role Separation of Duties " (Role SOD) ensures that users cannot have conflicting roles, such as VPN and Contractor, or Travel and Contractor.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Entitlement SOD: This policy prevents users from having conflicting access rights. In this case, being in the AccountsPayable group while also having access to create vendors creates a potential conflict. IdentityIQ uses Entitlement SOD to handle these scenarios by preventing such combinations of entitlements.

Account: This type of policy limits the number of accounts users can have on a given system. By setting up an Account policy, IdentityIQ ensures that a user cannot exceed the set number of accounts (e.g., two accounts on a system).

Role SOD: When dealing with conflicting roles (such as VPN or Travel role conflicting with a Contractor role), Role SOD policies ensure that users do not end up in roles that violate governance or security policies. This type of policy ensures role-based access conflicts are mitigated in IdentityIQ.

SailPoint IdentityIQ Compliance Manager Guide (section on defining and managing Separation of Duties (SOD) policies).

Syslog can be used to identify the details of a system error presented in the UI. When a system error occurs, IdentityIQ typically logs detailed error messages, stack traces, and other relevant information to Syslog or other logging frameworks configured in the environment. By reviewing these logs, an administrator or engineer can identify and diagnose the specific error that was encountered in the UI.

SailPoint IdentityIQ Logging and Monitoring Guide

SailPoint IdentityIQ Administration Guide (Sections on Error Handling and Troubleshooting)

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in the provisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.

Yes, the Provisioning tab under the " Administrator Console " can be used to manually retry provisioning attempts for pending transactions. This feature allows administrators to retry failed provisioning operations or manually trigger provisioning actions that are in a pending state, providing greater control over the provisioning process.

SailPoint IdentityIQ Administration Guide (Provisioning Management and Manual Retry)

SailPoint IdentityIQ Provisioning Guide

Yes. The IdentityIQ version is essential information when setting up a new sandbox environment. Version affects installation steps, supported Java versions, supported application servers, database compatibility, connector behavior, patch requirements, schema scripts, upgrade paths, and available product features. A sandbox is usually intended to mirror or safely test changes for another environment, so the engineer must know which IdentityIQ version the sandbox should run. Without the version, the engineer could deploy the wrong WAR file, apply incompatible patches, use the wrong schema scripts, or test behavior that does not match production. Version also matters for customizations such as rules, workflows, Quicklinks, UI branding, extended attributes, and connector configuration because APIs and supported patterns can differ between releases. Therefore, IdentityIQ version is not optional background information; it is a core environment-planning input. References/topics: IdentityIQ Engineer — sandbox setup, installation planning, version compatibility, patching, environment parity.

No, the code snippet provided in the image is incorrect for including a rule library named " Common Rules Library " in a Rule. The correct syntax should reference the sailpoint.object.RuleLibrary class if the intent is to include a Rule Library, as seen in the second image. The first image incorrectly references the sailpoint.object.Rule class, which is not suitable for a rule library inclusion.

Correct Syntax (as shown in the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

No. Custom branding changes should not be assumed to update automatically during an IdentityIQ upgrade. Branding changes often involve customized UI resources, message files, images, CSS, JSPs, configuration entries, or other web-application artifacts. During an upgrade, the standard IdentityIQ application files are replaced or changed, and customizations may need to be re-applied, merged, retested, or adjusted to align with the new release. Assuming the upgrade process automatically updates every custom branding change is a bad implementation practice. Engineers should inventory all customizations before upgrade, compare them against the new release, reapply supported changes, and validate the UI after deployment. This also applies to broader customizations such as rules, workflows, Quicklinks, forms, libraries, object extensions, and localized messages. The correct upgrade discipline is controlled migration and regression testing, not blind reliance on automatic preservation. References/topics: IdentityIQ Engineer — upgrade planning, branding customization, UI resource changes, regression testing, customization inventory.

Creating and loading a Custom Audit Report TaskDefinition XML and corresponding Custom Audit Report Form XML is indeed part of the process for setting up a custom audit report in SailPoint IdentityIQ. The TaskDefinition XML defines the report task, and the Form XML defines the user interface for running the report. These steps are essential to creating a custom audit report, and the solution correctly outlines a valid approach. Refer to the SailPoint IdentityIQ Reporting Guide, particularly the section on creating custom reports and forms, for more detailed instructions.

The scenario described involves disabling an account and removing all its entitlements on a particular application during Mover events. The Rapid Setup user interface in SailPoint IdentityIQ primarily handles common configurations like enabling or disabling accounts, assigning or unassigning roles, and triggering certifications during lifecycle events.

However, the combination of disabling an account and removing all its entitlements for a Mover event typically involves more detailed configuration that goes beyond the capabilities of the Rapid Setup interface. Achieving this would generally require creating a custom workflow or a specific rule that handles both disabling the account and removing entitlements based on the Mover event triggers.

Thus, the Rapid Setup UI cannot achieve this level of detailed configuration, making the correct answer B. No.

Yes. IdentityIQ provides audit configuration capabilities through the user interface so administrators can manage much of the platform’s audit behavior without directly editing XML for every standard case. Audit configuration is used to control which events or actions are captured, allowing organizations to record relevant administrative, governance, provisioning, workflow, and compliance activity. This is important because excessive auditing can create unnecessary database volume and noise, while insufficient auditing can leave gaps in troubleshooting and compliance evidence. For standard audit controls, the Audit Configuration page is the normal administrative place to manage audit behavior. However, this does not mean every custom audit requirement can be completed only through the UI. Custom audit actions, custom reports, or custom rule/workflow audit writes may still require XML or BeanShell work. The statement says the majority of auditing is managed through the UI page, which is valid for standard IdentityIQ auditing operations. References/topics: IdentityIQ Engineer — Audit Configuration, audit events, audit actions, compliance evidence, custom audit extension.

Export CSV / Import CSV is not a valid action for a policy violation owner when acting on an individual Account Policy violation. In IdentityIQ, a policy violation owner is expected to resolve or manage the violation through violation-handling actions such as allowing, mitigating, remediating, forwarding, or otherwise taking governance action depending on configured permissions and workflow. Exporting or importing CSV files is an administrative or bulk-data activity, not a violation-disposition action. An Account Policy violation normally relates to a condition such as a user having more accounts than permitted on an application or system. The Word bank describes Account policies as policies that limit the number of accounts users may have on a given system. Acting on that violation requires a compliance decision or remediation path, not a CSV operation. Therefore, this proposed solution is not a valid policy-violation owner action. References/topics: IdentityIQ Engineer — Compliance Manager, policy violations, Account Policy, violation remediation, policy owner actions.

The statement that a BeanShell rule in IdentityIQ must always return an object derived from the abstract class sailpoint.object.SailPointObject is incorrect. While many rules in IdentityIQ may return objects that derive from SailPointObject, it is not a strict requirement. Rules can return various types of objects depending on their purpose and context. For example, a rule might return a String, Boolean, Map, or even null, depending on what the rule is designed to accomplish.

Therefore, the correct answer is B. No.

The correct sequence of steps to turn on Certifications logging at the severity log level of trace is as follows:

Edit the file: [IdentityIQ installation] > WEB-INF > classes > log4j.properties.

This step involves accessing the configuration file where logging parameters are managed. The log4j.properties file is crucial for adjusting logging settings such as the log level for specific modules in SailPoint IdentityIQ.

Uncomment the out-of-the-box logger #log4j.logger.sailpoint.api.Certification=info.

This step enables the logger for Certification by removing the comment from the respective line in the log4j.properties file. This makes the logger active for the certification process.

Change the log level to trace and save.

After uncommenting the logger, change the log level from info to trace. The trace level provides the most detailed logging, capturing comprehensive information about the certification process for troubleshooting.

Restart the application server.

Restarting the application server is necessary for the changes in the log4j.properties file to take effect. SailPoint IdentityIQ reads the updated configuration during the startup process.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Editing the log4j.properties file is a standard practice in SailPoint IdentityIQ for configuring logging. This file, located in the WEB-INF/classes directory, controls how and what IdentityIQ logs for different components.

Uncommenting the specific logger is needed to ensure that the system is logging the events related to certification. The commented line #log4j.logger.sailpoint.api.Certification=info can be found in the default configuration and needs to be activated for proper logging.

Setting the log level to trace is crucial because trace provides the most detailed logging, which is essential for deep debugging or tracking granular details about the certifications in IdentityIQ.

Restarting the server ensures that the changes to the logging configuration are applied, as the settings in log4j.properties are only read during the startup phase.

SailPoint IdentityIQ Log Management and Troubleshooting Guide (section on adjusting log levels and configurations).

The statement is false. In SailPoint IdentityIQ, the language displayed in the user interface is not always based on the default language selected in the global settings. The language displayed in the user interface is typically determined by the user ' s language preference, which can be set individually for each user. If a user ' s preferred language is not available, then the system may fall back to the default language specified in the global settings. Thus, while the global default language serves as a fallback, the actual language displayed is often based on user-specific settings.

SailPoint IdentityIQ Administration Guide (Localization and Language Settings Sections)

SailPoint IdentityIQ User Guide (User Preferences and Language Selection)

The statement that workflows can be run directly from the Debug-Object page is incorrect. The Debug-Object page in SailPoint IdentityIQ is primarily used for inspecting and interacting with objects within the system, such as viewing their attributes, relationships, and states. However, running workflows is typically done through the IdentityIQ interface under the appropriate sections for workflow management or through the IdentityIQ Console, not directly from the Debug-Object page.

Therefore, the correct answer is B. No.

Not all ManagedAttribute objects associated with an Identity are visible on the ' Attributes ' tab within the ' View Identity ' QuickLink. The ' Attributes ' tab typically displays attributes that are specifically configured to be shown in the identity view, which might include certain managed attributes depending on how the system is configured. ManagedAttributes can represent various aspects like roles, entitlements, or even custom attributes, and their visibility on the UI depends on how the IdentityIQ instance is configured. To manage and configure visibility of attributes, consult the SailPoint IdentityIQ User Interface Customization Guide and Managed Attributes documentation.

Top of Form

Bottom of Form

Yes, disabling all notifications can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In SailPoint IdentityIQ, most workflows, including those in LCM, use control variables to manage various settings, such as whether notifications should be sent. By setting the appropriate control variable (e.g., disabling email notifications) within the workflow configuration, you can effectively suppress all notifications related to that workflow.

Therefore, the correct answer is A. Yes.

No, the Provisioning tab under the " Administrator Console " is not used to map the associated WorkflowCase to a particular Provisioning Transaction. The Provisioning tab is primarily for monitoring and managing provisioning operations, not for mapping workflow cases to transactions. Such mappings are typically handled within the workflow configuration itself, not through the Provisioning tab.

SailPoint IdentityIQ Workflow Guide (Handling Workflow and Provisioning Transactions)

SailPoint IdentityIQ Administration Guide (Provisioning Tab Limitations)

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

Yes. IdentityIQ supports certain UI branding customizations, but product attribution requirements still matter. If a customer removes SailPoint branding from a prominent UI location such as the header bar, the product attribution should still be preserved elsewhere, such as in the copyright footer with wording like “Powered by SailPoint IdentityIQ.” This reflects the distinction between cosmetic branding changes and removal of required product identification. From an engineering standpoint, UI customization should be implemented carefully so it survives upgrades as much as possible and does not violate branding, licensing, or support expectations. Teams should also document all branding changes because customized UI files are commonly impacted during upgrades and patching. The proposed statement is valid because it preserves SailPoint product attribution while allowing the customer to modify the visible header branding. References/topics: IdentityIQ Engineer — UI customization, branding requirements, copyright footer, upgrade-safe customization, customer-specific UI changes.

Yes, this is a valid step. When developing a custom quicklink in SailPoint IdentityIQ, it is important to specify the workflow that the quicklink should launch. This is done by entering the name of the workflow in the quicklink object configuration. This allows the quicklink to trigger the desired workflow when selected by a user, such as a manager, who has access to that quicklink.

SailPoint IdentityIQ Quicklink Development Guide

SailPoint IdentityIQ Administration Guide (Custom Quicklinks and Workflow Integration)

This scenario describes an employee quitting their job and needing all of their accounts disabled, which aligns with a leaver lifecycle event rather than a mover event. A leaver event typically involves the deactivation of accounts and removal of access for users who are leaving the organization entirely, whereas a mover event involves changes to roles or access as part of an internal transition (e.g., promotion, transfer).

Therefore, the correct answer is B. No.

No, this is not a valid action. When setting up or using the Services Standard Build (SSB) for a SailPoint IdentityIQ instance, the client ' s identityiq.war file should not be placed in the home directory of the build. The WAR file should be deployed to the appropriate application server ' s deployment directory, not in the home directory of the build itself. The SSB process typically involves more structured deployment processes that adhere to best practices for application deployment.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Deployment Best Practices

This proposed solution is not correct. In IdentityIQ, features and functional access are controlled primarily through capabilities, not scopes. Capabilities determine whether a user can perform administrative or functional actions such as managing identities, accessing reports, configuring applications, launching tasks, or using privileged pages. Scopes, by contrast, are generally used to restrict which objects or data a user can see or act upon. For example, a scoped administrator may only be able to view or administer identities, applications, or work items within an assigned organizational boundary. That is object/data visibility control, not feature enablement. Saying that scopes control “the features that are used” confuses two different authorization layers. The correct IdentityIQ distinction is: capabilities control functional permissions, while scopes constrain object access boundaries. References/topics: IdentityIQ Engineer — authentication, authorization, capabilities, scopes, delegated administration.

Defining an application is not a default functionality of the Lifecycle Manager (LCM) module. Application definitions are typically part of the core IdentityIQ platform and are managed through the IdentityIQ Administration module, not Lifecycle Manager. LCM is primarily focused on managing identity lifecycle events, such as onboarding (Joiner), role changes (Mover), and offboarding (Leaver).

Therefore, the correct answer is B. No.

Reassigning all object ownership to a user’s manager during Leaver and Termination events is a complex process that typically involves custom logic or workflows to ensure that all owned objects (like access, certifications, roles, etc.) are correctly reassigned.

The Rapid Setup interface is primarily designed for standard lifecycle management tasks, such as role assignments, account enabling/disabling, and certifications. It does not inherently support the automatic reassignment of object ownership based on lifecycle events such as Leaver and Termination events.

This kind of reassignment would typically require a custom rule or workflow to track and reassign all owned objects, which falls outside the scope of what Rapid Setup can handle directly. Therefore, the correct answer is B. No.

Yes. The Environment area under the Administrator Console is intended for administrative visibility into the running IdentityIQ environment, including product/environment details and installed components or extensions where exposed by the platform. Viewing the status or presence of installed SailPoint modules/extensions is consistent with environment inspection. This is very different from controlling the application server itself. The engineer can use IdentityIQ administrative pages to understand what is installed, enabled, or available in the current deployment, which helps during troubleshooting, patch verification, upgrade planning, and support analysis. In multi-node deployments, this kind of environment visibility is useful because module or extension inconsistencies can cause unpredictable behavior. However, viewing status does not imply the Environment tab can install, uninstall, start, or stop all components. The proposed action is read/inspection-oriented, so it fits the purpose of the tab. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, installed modules, extensions, environment validation, upgrade/troubleshooting checks.

In SailPoint IdentityIQ, what users can see and do is indeed partly controlled by their authorized scope. Authorized scopes define the range of objects (such as identities, roles, applications) that a user has access to. Scopes can be applied to limit access based on specific criteria, ensuring that users only interact with the data and functionalities relevant to their role or responsibility within the organization.

For example, a user with access to a specific scope may only view or manage identities within a certain department or geographical location, depending on how the scope is configured.

Therefore, the correct answer is A. Yes.

Yes. The requirement explicitly says the value must be listed as an entitlement on Identity Cubes. In IdentityIQ attribute configuration, marking an attribute as an entitlement-type attribute is what allows the value to be treated and displayed in entitlement/access contexts rather than merely as ordinary profile data. The rest of the requirements describe source mappings and usability: Workday is authoritative, Contractor file is fallback, the value should be usable in rules, and it should appear as an Advanced Analytics option. Those needs may require additional configuration such as source mappings, searchable/indexed behavior, and edit-mode considerations. However, the specific proposed option is “Entitlement,” and that maps directly to Usage 4. Without setting the attribute appropriately, the value may exist on the identity but not appear as an entitlement on the Identity Cube. Therefore, this configuration option is needed. References/topics: IdentityIQ Engineer — identity attribute configuration, entitlement flag, Identity Cube display, Advanced Analytics, source mappings.

Setting the configuration option " Edit Mode: Read Only " on the account attribute would not meet the requirements as specified. The requirement to " Calculate from: Keystore application, responsibility-code attribute " implies that the attribute needs to be dynamically calculated or updated based on another attribute. If the attribute is set to " Read Only, " it cannot be modified, which would prevent it from being calculated or updated as needed. Therefore, " Edit Mode: Read Only " should not be used in this scenario.

SailPoint IdentityIQ Administration Guide (Sections on Account Attributes and Attribute Calculation)

SailPoint IdentityIQ Configuration Guide (Field Properties and Edit Modes)

This is a valid process. The requirement has two parts: detect a specific Division transition and confirm that the identity is a manager. A rule-based lifecycle event trigger is appropriate when the condition is more complex than a simple single-attribute check. The rule can inspect the previous and new values of the Division attribute and return true only when the value changes from IT to Senior IT. It can also evaluate the identity’s managerStatus value on the Identity Cube to confirm that the user is a manager. Returning true from the rule allows IdentityIQ to launch the associated workflow only for identities that satisfy both conditions. This approach avoids the flaw of triggering on the wrong attribute and gives the engineer precise control over the lifecycle event condition. The key is that the rule must be written against the correct before-and-after identity data available during refresh or lifecycle-event evaluation. References/topics: IdentityIQ Engineer — rule-based lifecycle triggers, identity attribute changes, Identity Cube attributes, workflow launch rules, mover-event logic.

This proposed solution is not valid as written. The stem says the engineer needs to create a custom audit event and set up an associated report. The proposed XML fragment is an ObjectAttribute definition for an attribute named userType; it is not an AuditAction definition. An ObjectAttribute entry is used in object configuration contexts to describe an attribute’s display, edit behavior, extended number, name, and type. That does not define a new audit action/event in the AuditConfig object. A proper audit event definition would use an AuditAction element or equivalent AuditConfig configuration identifying the audit action name, display name, and enabled state. Because the XML fragment shown does not create a custom audit action, it cannot satisfy the required step. This is exactly the kind of syntax-level distinction an IdentityIQ engineer must catch: correct object type and correct XML element matter. References/topics: IdentityIQ Engineer — AuditConfig XML, AuditAction definition, ObjectAttribute configuration, custom audit event setup.

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.

Yes. IdentityIQ reports are closely tied to the platform’s task framework. Out-of-the-box report templates are represented as task/report definitions, and these definitions describe how the report is executed, what arguments or filters it accepts, and how the resulting report instance is generated. In IdentityIQ, scheduled and executable background operations commonly use TaskDefinition objects, and reporting is implemented through this same general task infrastructure. A report definition is not the same thing as a generated report result. The TaskDefinition defines the report template or executable report behavior, while a run of that report creates task/report result data. This distinction matters because an engineer may inspect, export, import, customize, or troubleshoot report definitions through IdentityIQ objects. The proposed statement is therefore valid for out-of-the-box reports as report definitions/templates. References/topics: IdentityIQ Engineer — reporting framework, TaskDefinition objects, report templates, task execution, generated report results.

Yes. IdentityIQ stores email templates as IdentityIQ objects, and after installation they can be inspected through the Debug pages as EmailTemplate objects. Email templates define notification content used by workflows, certifications, lifecycle events, approvals, policy violations, provisioning processes, and other system activities. The Debug page allows administrators and engineers to view many persisted IdentityIQ object types directly, including rules, workflows, task definitions, applications, identities, configuration objects, and email templates. This is useful when troubleshooting notification behavior, checking template names, verifying variables used in template content, or confirming whether a customized template exists in the environment. However, editing production templates directly through Debug should be handled carefully and normally controlled through proper change-management practices. The proposed location is technically valid: email templates can be viewed as EmailTemplate objects through the Debug interface. References/topics: IdentityIQ Engineer — EmailTemplate objects, Debug pages, notification configuration, workflow and certification email notifications.

Yes. Rapid Setup application onboarding can be used for common onboarding configuration, including account classification logic such as identifying service accounts based on an account attribute and value. Service accounts often need to be distinguished from normal human accounts because they may have different ownership, certification, correlation, requestability, password, and governance treatment. A typical configuration uses an account schema attribute and a value or pattern to flag accounts that should be treated as service accounts. This fits Rapid Setup’s purpose: allowing engineers to configure standard onboarding behavior without writing custom connector logic for every common case. The capability is still limited compared with full custom rules or advanced application configuration. If the service-account identification logic requires complex multi-attribute conditions, external lookups, or custom transformations, a rule or deeper application configuration may be needed. But the proposed action itself is a valid Rapid Setup onboarding configuration. References/topics: IdentityIQ Engineer — Rapid Setup, application onboarding, account classification, service accounts, account attribute filters.

Yes. In IdentityIQ workflow processing, a wait step is not simply a client-side pause or a frozen browser session. The workflow case is persisted and resumed after the wait condition has elapsed and the maintenance process revives eligible workflow cases. A wait= " 1 " attribute represents a minimum wait period, and the workflow does not necessarily resume at the exact instant the wait expires. It resumes when IdentityIQ’s background maintenance processing detects that the wait period is over and advances the workflow. That is why the wording says “at least one minute” and “on the next run of the Perform Maintenance Task.” This distinction matters operationally: workflow timing depends on both the configured wait value and the maintenance task schedule. Engineers should not use wait steps when exact real-time execution is required. References/topics: IdentityIQ Engineer — workflow wait attribute, persisted workflow cases, Perform Maintenance task, background workflow resumption, workflow step behavior.

Placing a QuickLink object directly on a workflow is not a valid step in the development of a custom QuickLink. QuickLinks are used to provide users with easy access to specific tasks or workflows through the IdentityIQ interface, but the QuickLink itself is not embedded within the workflow. Instead, the QuickLink is created as a separate object and associated with the desired workflow or task that it is meant to launch.

The correct approach would involve creating a QuickLink that points to the workflow and then controlling access to the QuickLink by restricting it to a specific QuickLink population (e.g., " Managers " ). Therefore, the correct answer is B. No.

Yes, this is an example of a mover lifecycle event. A mover lifecycle event typically occurs when an individual ' s role or employment status within the organization changes, requiring updates to their accounts and access rights. In this scenario, a contractor whose accounts were previously disabled due to contract expiration needs those accounts re-enabled upon securing a new contract. This reactivation and adjustment of access rights based on a change in employment status fits the definition of a mover event.

Therefore, the correct answer is A. Yes.