Free Practice Questions for SailPoint IdentityIQ-Engineer Exam

Creating and loading a Custom Audit Report TaskDefinition XML and corresponding Custom Audit Report Form XML is indeed part of the process for setting up a custom audit report in SailPoint IdentityIQ. The TaskDefinition XML defines the report task, and the Form XML defines the user interface for running the report. These steps are essential to creating a custom audit report, and the solution correctly outlines a valid approach. Refer to the SailPoint IdentityIQ Reporting Guide, particularly the section on creating custom reports and forms, for more detailed instructions.

Yes, the statement is true. In SailPoint IdentityIQ, the built-in auditing options are indeed immutable, meaning they are always recorded and cannot be disabled or altered. This ensures that critical actions and changes are always logged for compliance and security purposes. However, custom audit configurations, such as additional custom audit fields or logs, can be turned on or off based on specific organizational requirements.

SailPoint IdentityIQ Audit Guide

SailPoint IdentityIQ Administration Guide (Sections on Auditing and Compliance)

No. The proposition incorrectly equates account ownership with the accounts personally held by the reviewer. Those are different relationships.

In ownership-based governance, the relevant question is which accounts or governed objects the reviewer is responsible for, not which target-system accounts belong to the reviewer ' s own identity. IdentityIQ explicitly supports ownership relationships independently from account possession. For example, account ownership can be assigned to another Identity, and targeted certifications can use an Owner filter to select accounts owned by specified identities.

Likewise, IdentityIQ ' s certification architecture generally routes reviews according to governance responsibility: an Application Owner reviews access to applications for which that person is responsible, an Entitlement Owner reviews identities holding entitlements the reviewer owns, and account-group reviews are driven by ownership of the corresponding governed objects. The reviewer need not personally possess that access.

Therefore, an ownership-based account certification is not limited to accounts that the certifier personally “holds.” Its purpose is to review accounts for which that identity has ownership/responsibility according to IdentityIQ ' s governance model.

References/topics: IdentityIQ Engineer — account ownership, certification ownership, targeted certification Owner filter, Application Owner certification, governance responsibility.

=======

No. The Provisioning area of the Administrator Console is focused on provisioning transactions , not on providing the current connector/application connection-health status for the associated target application.

A provisioning transaction can provide information about the access request and its processing state—for example whether provisioning is pending, completed, failed, or otherwise awaiting processing. Engineers can use transaction information to investigate provisioning behavior and determine which application and operations are involved. That is not equivalent to displaying whether the underlying application connector is presently connected or healthy.

Application connectivity is investigated through application configuration/testing and the relevant application or connector diagnostic mechanisms. A transaction can fail because of connectivity, authentication, connector configuration, target-system errors, invalid data, workflow problems, or many other causes. Consequently, the transaction state cannot simply be interpreted as the application ' s connection status.

The distinction is tested directly by this DOMC proposition: provisioning transaction monitoring and application connectivity monitoring are separate administrative functions.

References/topics: IdentityIQ Engineer — Administrator Console, Provisioning Transactions, Application connectivity testing, connector troubleshooting, provisioning status.

=======

Placing a QuickLink object directly on a workflow is not a valid step in the development of a custom QuickLink. QuickLinks are used to provide users with easy access to specific tasks or workflows through the IdentityIQ interface, but the QuickLink itself is not embedded within the workflow. Instead, the QuickLink is created as a separate object and associated with the desired workflow or task that it is meant to launch.

The correct approach would involve creating a QuickLink that points to the workflow and then controlling access to the QuickLink by restricting it to a specific QuickLink population (e.g., " Managers " ). Therefore, the correct answer is B. No.

Yes. Attesting assignment of roles to users is a valid purpose of an IdentityIQ certification. Role-based governance depends not only on whether roles contain the correct entitlements, but also on whether the correct users hold those roles. A certification can ask reviewers to validate role membership, confirm that role assignments are appropriate for job function, and revoke or remediate role assignments that are no longer justified. This is especially important in environments where role assignment rules, business roles, or automated provisioning logic are used. If the rule assigns a role to the wrong population, users may inherit incorrect access even if the role composition itself is technically correct. Certification provides a formal review and sign-off process, creating accountability and audit evidence. Therefore, attesting role assignment to users is squarely within IdentityIQ certification functionality. References/topics: IdentityIQ Engineer — role membership certification, access review, role assignment attestation, certification sign-off, remediation decisions.

Yes. Policy checking behavior is one of the areas commonly controlled in LCM request workflows through workflow variables or configuration controlling policy evaluation mode. IdentityIQ can evaluate whether a requested access change would violate configured policies before the request is finalized or provisioned. Depending on configuration, the system can present policy violations to the requester, block submission, continue with warnings, or require additional approval/mitigation. The proposed behavior — checking whether an access request would violate policies and letting the requester review before submitting — aligns with interactive policy-checking behavior in LCM. This is an execution behavior of the request workflow, not an application schema setting. The engineer must still ensure policies are configured and enabled, but the workflow/control-variable layer can determine how those checks are applied during request submission. References/topics: IdentityIQ Engineer — LCM workflow control variables, policy checking, request policy violations, interactive policy review, access request governance.

The statement that workflows can be run directly from the Debug-Object page is incorrect. The Debug-Object page in SailPoint IdentityIQ is primarily used for inspecting and interacting with objects within the system, such as viewing their attributes, relationships, and states. However, running workflows is typically done through the IdentityIQ interface under the appropriate sections for workflow management or through the IdentityIQ Console, not directly from the Debug-Object page.

Therefore, the correct answer is B. No.

Yes. Hierarchy is a valid relationship concept for IdentityIQ roles when a role model has a multiple-level structure. IdentityIQ roles are not limited to flat entitlement collections. Role models can be built with layered relationships, where higher-level roles represent broader business access and lower-level roles represent more technical or application-specific access. This is common in mature role-based access control designs: a business role may include IT roles, which in turn may include entitlements or application roles. A hierarchical structure allows organizations to express access in business terms while still mapping that access down to technical resources. The important engineering point is that the role model must be carefully designed to avoid circular dependencies, overbroad inheritance, and difficult certification outcomes. Hierarchical role relationships support maintainable access modeling when used properly, especially in enterprises that are actively using role-based provisioning and role reviews. References/topics: IdentityIQ Engineer — role hierarchy, role relationships, Bundle object, business roles, IT roles, role-based access model.

This is a valid implementation pattern. The workflow requirement has three routing outcomes, and the proposed solution expresses them as three explicit transition elements. The first transition routes to Stop when the approval flag is false, which corresponds to the Reject or back action. The second transition routes to Audit when the comment variable is not null or empty, using sailpoint.tools.Util.isNotNullOrEmpty(comment). That satisfies the condition that the Approve action was used and the returned form field has a value. The final transition to Provision has no condition, making it the default fallback when the prior transition conditions are not satisfied. This is the correct style for workflow routing because the destination steps are explicitly declared through the to attribute, and the conditional routing is attached to each transition rather than relying on an invalid free-form return block. References/topics: IdentityIQ Engineer — workflow transitions, when conditions, script expressions, form approval routing, default workflow transition behavior.