Free Practice Questions for SailPoint IdentityIQ-Engineer Exam

Yes. In IdentityIQ workflow XML, subprocess calls can exchange data with the calling workflow through configured input and output variable handling. The send attribute is used to pass variables into the subprocess, while the returns attribute identifies variables that should be returned from the subprocess to the parent workflow context. This is important when a reusable subprocess performs initialization, provisioning-plan generation, identity-request creation, approval preparation, or other common logic and the parent workflow needs the resulting values. In the example, identityName and plan are sent into the subprocess, while identityRequestId and project are expected back. This is a valid workflow pattern and is one reason standard LCM subprocesses can be reused in custom workflows. The engineer must still ensure that variable names match and the subprocess actually sets the returned variables. References/topics: IdentityIQ Engineer — workflow subprocesses, send attribute, returns attribute, workflow variables, reusable LCM workflows.

No. Changing an object’s name and saving it through the Debug pages is not the correct way to create a copy. IdentityIQ objects have internal identifiers, references, metadata, and relationships that are separate from display names or object names. Renaming an object modifies the existing object; it does not create a safe duplicate. For some object types, changing the name can also break references, confuse workflows, disrupt imports, or create governance problems. A proper copy process requires exporting the object XML, removing or regenerating identifiers where appropriate, changing the name intentionally, reviewing object references, and importing it as a new object. Even then, engineers must be careful with dependent objects such as rules, workflows, forms, applications, task definitions, and policies. The Debug pages are powerful but dangerous; they are not a casual object-cloning tool. The proposed method is therefore invalid. References/topics: IdentityIQ Engineer — Debug pages, object XML, object IDs, safe object cloning, configuration migration.

In SailPoint IdentityIQ, the configuration in IdentityExtended.hbm.xml file as shown in the image indeed outlines the use of extended identity attributes. These attributes (extended1, extended2, etc.) are custom attributes that are appended to the standard identity object model to store additional identity-related data.

According to the official SailPoint IdentityIQ documentation, when defining identity mappings under Global Settings > Identity Attributes, only up to 12 additional attributes can be made searchable within the IdentityIQ system. This limitation is crucial because it directly impacts the efficiency of search operations in large environments, where making too many attributes searchable can significantly slow down performance.

Once you define these 12 searchable attributes, any additional attributes can still be added, but they will not be indexed for search operations. This means that while the data in these attributes can be used in workflows, reports, and other operations, they cannot be used in search filters in the IdentityIQ user interface.

This limitation is particularly important when planning the design of the identity schema, as it affects both performance and usability. Therefore, the statement in question is correct and accurately reflects the constraints imposed by SailPoint IdentityIQ in terms of searchable identity attributes.

No. Custom branding changes should not be assumed to update automatically during an IdentityIQ upgrade. Branding changes often involve customized UI resources, message files, images, CSS, JSPs, configuration entries, or other web-application artifacts. During an upgrade, the standard IdentityIQ application files are replaced or changed, and customizations may need to be re-applied, merged, retested, or adjusted to align with the new release. Assuming the upgrade process automatically updates every custom branding change is a bad implementation practice. Engineers should inventory all customizations before upgrade, compare them against the new release, reapply supported changes, and validate the UI after deployment. This also applies to broader customizations such as rules, workflows, Quicklinks, forms, libraries, object extensions, and localized messages. The correct upgrade discipline is controlled migration and regression testing, not blind reliance on automatic preservation. References/topics: IdentityIQ Engineer — upgrade planning, branding customization, UI resource changes, regression testing, customization inventory.

An AfterProvisioning rule in SailPoint IdentityIQ is typically used to execute custom logic after the provisioning process has been completed successfully. However, if provisioning fails, this rule will not be triggered because it is specifically designed for post-successful provisioning activities. To log an error message in the audit record when provisioning fails, a better approach would be to use a provisioning error handler or configure a specific workflow that captures errors and logs them accordingly. The AfterProvisioning rule is not the correct solution for this use case. Refer to the SailPoint IdentityIQ Provisioning and Workflow documentation for appropriate methods of handling provisioning errors and audit logging.

Yes. IdentityIQ stores email templates as IdentityIQ objects, and after installation they can be inspected through the Debug pages as EmailTemplate objects. Email templates define notification content used by workflows, certifications, lifecycle events, approvals, policy violations, provisioning processes, and other system activities. The Debug page allows administrators and engineers to view many persisted IdentityIQ object types directly, including rules, workflows, task definitions, applications, identities, configuration objects, and email templates. This is useful when troubleshooting notification behavior, checking template names, verifying variables used in template content, or confirming whether a customized template exists in the environment. However, editing production templates directly through Debug should be handled carefully and normally controlled through proper change-management practices. The proposed location is technically valid: email templates can be viewed as EmailTemplate objects through the Debug interface. References/topics: IdentityIQ Engineer — EmailTemplate objects, Debug pages, notification configuration, workflow and certification email notifications.

This is not a clean joiner lifecycle event. A joiner event normally represents a person newly entering the organization or being newly onboarded into managed access, usually requiring new identity setup, new accounts, baseline access, roles, approvals, and provisioning. The proposed scenario describes a contractor whose previous relationship ended, whose accounts were disabled, and who now has a new contract requiring previous accounts to be enabled. That is closer to a rehire/reactivation or account-enable lifecycle event than a first-time joiner. The distinction matters in IdentityIQ because a true joiner process may create accounts and assign initial access, while a rehire/reactivation process may restore, enable, or reassess previously existing accounts and access. Treating this as a joiner could create duplicate accounts or duplicate access instead of properly reactivating existing Links/accounts. References/topics: IdentityIQ Engineer — Lifecycle Manager, joiner event, rehire/reactivation, account enablement, identity lifecycle workflow design.

The provided solution does not fulfill the client ' s requirement. Setting " Who can members request for? " to " report to the requester " only limits the request scope to users who directly report to the requester, which does not account for the location attribute. The goal is to restrict requests based on the location attribute, and this specific configuration does not consider that attribute. To achieve the desired behavior, the configuration should include logic that filters users based on the same location as the requester.

The statement is false. In SailPoint IdentityIQ, syslog events can indeed be sent to Log4j. The system allows for flexible configuration where logging can be directed to multiple outputs, including both syslog and Log4j. This flexibility enables organizations to route logs according to their needs while maintaining security and compliance.

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Administration Guide (Syslog Configuration and Log4j Integration)