Free Practice Questions for SailPoint IdentityIQ-Engineer Exam

Yes, the text on the login page of IdentityIQ is set through message keys in the message catalog. The message catalog in IdentityIQ contains localized text strings that are used throughout the user interface, including on the login page. By modifying the appropriate message keys in the catalog, you can customize the text that appears on the login page to match the organization ' s branding or messaging requirements.

Therefore, the correct answer is A. Yes.

Based on the goals and scheduling parameters provided, the tasks should be scheduled in the following order to achieve efficient processing for a 24-hour period:

1st Check Expired Work Items (12:00 AM)

This task runs at midnight to check for expired work items. It’s important to run this first to clean up any pending tasks from the previous day.

1st Perform Identity Request Maintenance (2:00 AM)

This maintenance task is scheduled at 2:00 AM, a time when the system is least likely to be under load.

1st Aggregate Employee Authoritative Application (5:00 AM)

The aggregation for the Employee Authoritative application starts early in the day, at 5:00 AM.

1st Aggregate Contractor Authoritative Application (5:10 AM)

The Contractor Authoritative application aggregation is scheduled 10 minutes after the Employee aggregation, as per the goals.

1st Identity Refresh (5:20 AM)

Active Directory aggregation runs next at 5:20 AM.

2nd Aggregate Employee Authoritative Application (12:00 PM)

The second run for the Employee Authoritative application happens at noon.

2nd Aggregate Contractor Authoritative Application (12:10 PM)

At 12:10 PM, the Contractor Authoritative application runs again for its second aggregation.

2nd Identity Refresh (12:20 PM)

The second aggregation for Active Directory happens at 12:20 PM.

1st Aggregate Finance Authoritative Application (8:00 PM)

The Finance application aggregation is scheduled for 8:00 PM, which aligns with the goal of processing it in the evening.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Check Expired Work Items (12:00 AM)

This task is run first to ensure any expired or pending work items from the previous day are cleared out and do not interfere with the new day’s tasks. Running it at midnight ensures that any workflows or approvals with expirations are processed efficiently.

Identity Request Maintenance (2:00 AM)

This is a maintenance task that keeps the system running smoothly by managing identity requests. Scheduling it at 2:00 AM minimizes interference with other key business tasks since it ' s an off-peak hour.

Authoritative Application Aggregations (Employee/Contractor/Active Directory)

The authoritative applications (Employee, Contractor, Active Directory) need to be processed twice a day: once early in the morning and once at noon. Each aggregation must follow the specified order, as it ensures that the data flow is properly managed from the more critical Employee applications to the less frequent Contractor and Active Directory ones.

Finance Application (8:00 PM)

The Finance application is aggregated once a day, in the evening, after other high-priority applications have been processed. This ensures that financial data is up to date for reporting and compliance purposes, without overlapping with the core workday processes.

SailPoint IdentityIQ Scheduler Documentation (section on task scheduling and run-time configuration).

The scenario described involves disabling an account and removing all its entitlements on a particular application during Mover events. The Rapid Setup user interface in SailPoint IdentityIQ primarily handles common configurations like enabling or disabling accounts, assigning or unassigning roles, and triggering certifications during lifecycle events.

However, the combination of disabling an account and removing all its entitlements for a Mover event typically involves more detailed configuration that goes beyond the capabilities of the Rapid Setup interface. Achieving this would generally require creating a custom workflow or a specific rule that handles both disabling the account and removing entitlements based on the Mover event triggers.

Thus, the Rapid Setup UI cannot achieve this level of detailed configuration, making the correct answer B. No.

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

This proposed solution is incorrect because it confuses generating a schema script with applying a generated schema script. To generate the database script for extended attributes, the engineer must update the relevant Hibernate mapping files and then run the appropriate IdentityIQ schema-generation command, commonly from the IIQ_HOME/WEB-INF/bin area, so IdentityIQ can produce the database-specific SQL needed for the extension. Running the extendedSchema script on the database is an execution/apply step, not the generation step. In other words, the generated SQL script is run after it has already been produced. For ManagedAttribute or other object extensions, the sequence matters: define the extension in the mapping/configuration layer, generate the script, stop application services as needed, apply the script to the database, then ensure IdentityIQ object configuration reflects the new attribute. The proposed solution skips the generation step entirely. References/topics: IdentityIQ Engineer — Hibernate extension files, extended schema generation, ManagedAttribute extension, database schema update process.

In SailPoint IdentityIQ, certain objects are designed to be extended by updating their corresponding Hibernate Mapping (.HBM) files. However, the WorkItem object is not one of these extendable objects. The WorkItem is a system object that primarily represents tasks or actions that need to be processed within the workflow. It is not intended to store client-specific data through direct modification of its .HBM file. Instead, client-specific data should be handled using other mechanisms, such as custom attributes or the extension of Identity or Account objects. Attempting to modify the WorkItem object ' s HBM file could lead to unexpected behavior and is not supported by SailPoint ' s best practices.

A Post-Iterate Rule in SailPoint IdentityIQ is a type of connector rule that is executed after each account from the source system (e.g., SQL Loader application) has been read during the aggregation process. This rule allows for additional processing or customization of the data after the account has been iterated over. According to SailPoint IdentityIQ documentation, configuring a Post-Iterate Rule enables the execution of logic after each account ' s data has been processed, confirming that the given statement is valid. Refer to the SailPoint IdentityIQ Connector Development Guide for detailed information on rule execution during aggregation.

Yes. Hierarchy is a valid relationship concept for IdentityIQ roles when a role model has a multiple-level structure. IdentityIQ roles are not limited to flat entitlement collections. Role models can be built with layered relationships, where higher-level roles represent broader business access and lower-level roles represent more technical or application-specific access. This is common in mature role-based access control designs: a business role may include IT roles, which in turn may include entitlements or application roles. A hierarchical structure allows organizations to express access in business terms while still mapping that access down to technical resources. The important engineering point is that the role model must be carefully designed to avoid circular dependencies, overbroad inheritance, and difficult certification outcomes. Hierarchical role relationships support maintainable access modeling when used properly, especially in enterprises that are actively using role-based provisioning and role reviews. References/topics: IdentityIQ Engineer — role hierarchy, role relationships, Bundle object, business roles, IT roles, role-based access model.

No. A Bundle represents a role in IdentityIQ, and a Bundle profile is part of role definition logic, not something that must be associated directly to an Identity object. Profiles are used to describe conditions, constraints, or entitlement/application criteria associated with a role. Identities may be assigned roles, detected as matching roles, or evaluated against role profiles, but the Bundle profile itself is not required to be associated to a specific Identity object. This distinction is important because IdentityIQ’s role model is object-based: roles exist independently from the identities that hold them. A profile defines what the role means or how it is detected; identity role membership is a separate relationship. Saying that a Bundle profile must be associated with an Identity object incorrectly collapses role definition and identity assignment into one concept. References/topics: IdentityIQ Engineer — Bundle object, role profiles, role detection, role assignment, Identity object relationships.

This implementation is not correct. The requirement is to return all account names for an identity on the application MagicBox, but the code retrieves only a single Link by calling service.getLink(identity, " MagicBox " ). Even worse, the while (link != null) loop never changes the link variable, so if a link is found, the loop becomes infinite and repeatedly adds the same native identity. A correct implementation must retrieve the application object, obtain all matching Link objects for the identity and application, iterate over that list, and add each link’s native identity once. There is also no visible import for ArrayList or List, although BeanShell environments may sometimes tolerate imports differently. The fatal issue remains the flawed loop and single-link retrieval. IdentityIQ account data is represented by Link objects, and multiple accounts may exist for the same identity on the same application depending on connector and policy design. References/topics: IdentityIQ Engineer — IdentityService, Link objects, native identity, BeanShell API usage, account lookup logic.