Free Practice Questions for SailPoint IdentityIQ-Engineer Exam

Yes. For a Risk Policy violation, Certify is a valid action when the user handling the violation has the necessary permissions. IdentityIQ policy types can expose different response options, and the available disposition is not identical for every policy category.

Certify allows the responsible governance user to initiate certification-related review rather than simply accepting the violation or immediately remediating access. This is useful when a risk violation identifies access or identity conditions that warrant a formal review by an appropriate certifier before a final access decision is made.

This question must also be kept separate from the Account Policy propositions in the Word bank. The bank contains Account Policy propositions such as Schedule Policy Composition Certification—which it marks invalid—and Allow, which it marks valid. The policy type in the video is specifically Risk Policy , and DOMC evaluates the proposed action in that policy-type context.

Therefore, Certify is a valid option for the stated Risk Policy violation.

References/topics: IdentityIQ Engineer — Risk Policy, policy violations, Certify action, Compliance Manager, certification launch, violation disposition.

=======

Yes. This is the classic joiner lifecycle event. The person has not previously been with the company, has now been hired, and needs new access and new accounts. In IdentityIQ Lifecycle Manager terms, a joiner process usually starts from an authoritative-source change such as a new HR record. The process may create or activate the Identity Cube, assign birthright roles, request or automatically provision accounts, calculate policies, trigger approvals, and send notifications. Unlike rehire or reinstatement scenarios, there are no existing disabled accounts to restore. The access model should be built from onboarding rules, role assignment logic, provisioning policies, application create policies, and approval workflows. This is exactly why joiner workflows exist: to standardize new-person onboarding and ensure access is created consistently, securely, and audibly. References/topics: IdentityIQ Engineer — joiner lifecycle event, LCM onboarding, birthright access, account creation, provisioning policy, role assignment.

No. The proposed XML is not correct because the reference class is wrong. In IdentityIQ, rule libraries are represented through rule objects used as reusable BeanShell libraries. When a rule references a common library, the referenced object should be a Rule object, not a nonstandard sailpoint.object.RuleLibrary class. The correct pattern is to reference the library as a rule by name under the rule’s referenced-rules section. Rule libraries allow shared methods and reusable code to be included across multiple rules, which is important for reducing duplication and maintaining consistent logic. However, XML object references must use the correct IdentityIQ object class. If the class does not correspond to the persisted object type, the import or runtime resolution can fail. The concept of referencing a common rules library is valid, but this specific code is not. References/topics: IdentityIQ Engineer — Rule libraries, ReferencedRules XML, Rule object references, BeanShell code reuse, XML object configuration.

The statement that the application server must be restarted after reloading the logging file through the Debug-Logging page is incorrect. SailPoint IdentityIQ allows you to reload the logging configuration from the Debug-Logging page without restarting the application server. The Debug-Logging page provides a way to dynamically reload the logging settings, including those in the log4j file, so that changes can take effect immediately without the need for a server restart.

Therefore, the correct answer is B. No.

Yes. In IdentityIQ, a ManagedAttribute represents managed entitlement metadata associated with an application attribute/value, and it can have an Identity object assigned as its owner . Ownership is an important governance property because the entitlement owner can participate in approval routing, certifications, access-request decisions, remediation, and general accountability for the managed access.

This does not mean every ManagedAttribute is automatically owned by an Identity, nor does it mean its owner must be the same identity that owns the associated Application. Application ownership and entitlement ownership are independent governance relationships. For example, an Active Directory application may have one application owner while individual AD groups represented as ManagedAttributes have different business owners.

The wording “can have” is therefore important. IdentityIQ supports an Identity as the owner of the ManagedAttribute. Depending on configuration, ownership can be populated manually, through aggregation/customization, or through entitlement-management processes.

Do not confuse this relationship with the ManagedAttribute ' s required application context: the ManagedAttribute identifies governed access originating from an Application, while its owner identifies responsibility for that access.

References/topics: IdentityIQ Engineer — ManagedAttribute object, Entitlement Catalog, entitlement ownership, Application ownership, approval routing, entitlement certifications.

=======

The Rapid Setup user interface configuration options in IdentityIQ can be used to disable an account and remove all its entitlements on a particular application during Leaver events. Rapid Setup is designed to simplify the configuration of common identity lifecycle processes, including handling leaver (termination) events. When configuring these events, you can specify actions such as disabling accounts and removing entitlements from specific applications as part of the termination process.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Lifecycle Manager Guide (Sections on Lifecycle Event Configuration)

No. Whether an application supports password change requests through the IdentityIQ UI is not controlled by generic LCM workflow control variables. Password-change support depends on the application connector’s capabilities, password-management configuration, application settings, schema/support for password operations, policies, and QuickLink/user-interface configuration. The workflow may process or route a password-change request once launched, but it does not define which target applications support that operation. That capability must be configured at the application/connector and password-management layer. Mixing these layers would create a brittle design: workflow variables should govern execution behavior, while application configuration defines available account operations. Therefore, the proposed solution is not achievable merely by configuring out-of-the-box LCM workflow control variables. References/topics: IdentityIQ Engineer — password management, application connector capabilities, LCM workflows, QuickLink password change, account operation support.

The configuration option " Comment Character " is not required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Comment Character " option is generally used for handling comment lines in flat files or CSV file-based connectors. Since SCIM 2.0 is a RESTful API-based protocol designed for managing identities in a standardized way, this option does not apply to SCIM 2.0 integrations. Therefore, it is not a necessary configuration when working with SCIM 2.0 applications.

SailPoint IdentityIQ SCIM 2.0 Integration Guide

SailPoint IdentityIQ Application Configuration Guide (SCIM and REST API sections)

No. To permit users to unlock accounts through the Manage Accounts interface, the relevant Lifecycle Manager configuration is the Unlock Manage Account Action. Selecting a Rehire action does not configure the account-unlock operation described in the requirement.

IdentityIQ ' s Lifecycle Manager Configuration includes explicit Manage Account Actions for Delete, Disable, Enable, and Unlock . Administrators choose which of these operations users can request for themselves and, where authorization permits, for subordinates. If Unlock is deselected, that type of Manage Accounts request is unavailable.

Rehire is a lifecycle concept associated with restoring access for an identity returning to the organization; it is not the configuration switch that enables an account-unlock request. Unlock specifically addresses a target account that is locked while otherwise remaining an existing account.

This question is easy to mistake for the existing Word-bank question because the proposition is identical. However, the existing item asks about enabling an account, not unlocking one. Under the required DOMC comparison, that change in the stem makes this a distinct question.

Therefore, the proposed Rehire configuration does not meet the unlock requirement.

References/topics: IdentityIQ Engineer — Lifecycle Manager Configuration, Manage Accounts, Unlock Account, Enable Account, account actions, subordinate account management.

Yes, this is a valid action. When using the Services Standard Build (SSB) in SailPoint IdentityIQ, placing the patch jar file in the build ' s base/patch folder is a correct procedure, provided the patch version matches what the client is using. This allows the build process to incorporate the patch into the deployment, ensuring that the correct versions and fixes are applied to the IdentityIQ instance.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Patching and Version Management Guide