Free Practice Questions for SailPoint IdentityIQ-Engineer Exam

Yes, the text on the login page of IdentityIQ is set through message keys in the message catalog. The message catalog in IdentityIQ contains localized text strings that are used throughout the user interface, including on the login page. By modifying the appropriate message keys in thecatalog, you can customize the text that appears on the login page to match the organization's branding or messaging requirements.

Therefore, the correct answer isA. Yes.

In SailPoint IdentityIQ, what users can see and do is indeed partly controlled by their authorized scope. Authorized scopes define the range of objects (such as identities, roles, applications) that a user has access to. Scopes can be applied to limit access based on specific criteria, ensuring that users only interact with the data and functionalities relevant to their role or responsibility within the organization.

For example, a user with access to a specific scope may only view or manage identities within a certain department or geographical location, depending on how the scope is configured.

Therefore, the correct answer isA. Yes.

This statement is incorrect. In SailPoint IdentityIQ email templates, entire blocks of text, including whole paragraphs, can indeed be conditionally included or omitted using the appropriate templating syntax such as#if,#else, and#end. The templating engine in IdentityIQ, which typically uses Apache Velocity, supports complex conditional logic that can control large sections of the email content, not just individual lines.

References:

SailPoint IdentityIQ Email Templates Guide

Apache Velocity Templating Guide for SailPoint IdentityIQ

Not all Application objects in SailPoint IdentityIQ must have an Identity object as the owner. While it is common practice to assign an owner to an Application object for governance and administration purposes, it is not a strict requirement. Applications can exist without a direct association to an Identity object. The ownership concept in IdentityIQ is more of a best practice for accountability rather than a mandatory attribute. Refer to the SailPoint IdentityIQ Application Definition Guide for more information on the configuration and management of Application objects.

The statement that "the staging period is required" for certifications isnot true. In SailPoint IdentityIQ, the staging period is anoptionalphase during the certification campaign configuration. The staging period is used to pre-generate certifications and allow for any preparatory actions or adjustments before the certifications are officially launched and sent to reviewers. However, it is not a mandatory component for all certification campaigns.

Administrators may choose to bypass the staging period entirely depending on the specific requirements of the certification process or the urgency of the certification campaign. Therefore, while the staging period can be beneficial for managing large or complex certifications, it is not a required step.

References:

SailPoint IdentityIQ Certification Overview Guide

SailPoint IdentityIQ Administration Guide (Sections on Certification Configuration and Staging Period)

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in theprovisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.

The statement that a BeanShell rule in IdentityIQ must always return an object derived from the abstract classsailpoint.object.SailPointObjectis incorrect. While many rules in IdentityIQ may return objects that derive fromSailPointObject, it is not a strict requirement. Rules can return various types of objects depending on their purpose and context. For example, a rule might return aString,Boolean,Map, or evennull, depending on what the rule is designed to accomplish.

Therefore, the correct answer isB. No.

In SailPoint IdentityIQ, the specific configuration that allows a user to enable an account for themselves or a subordinate through the "Manage Accounts" option doesnotnecessarily need to be configured in Lifecycle Manager (LCM) alone. While LCM does provide extensive capabilities for account management actions like provisioning, rehire, and more, enabling an account is primarily tied to the permissions and entitlements granted to the user through their role, capabilities, and access profiles.

To address the specific functionality described:

Manage Accountsis typically a part of IdentityIQ’s broader account management capabilities, which are not exclusively tied to LCM. The ability to enable or disable accounts can be governed by rules and workflows within IdentityIQ, and these may or may not be linked directly to LCM configurations.

Rehire Action in LCM: The "Rehire" action within LCM Configuration is specific to processes related to reactivating an employee’s identity when they are rehired. This does not directly relate to enabling an account from the "Manage Accounts" screen. Rehire workflows typically involve reinstating the user’s previous access, which could include enabling accounts, but this is a broader process.

Permissions and Roles: The ability to enable accounts is often governed by the permissions assigned to a user’s role within IdentityIQ. These permissions may begranted outside of LCM configurations and handled by IdentityIQ’s access governance framework.

Workflow Configurations: Enabling or disabling an account could also be tied to specific workflows, which can be configured separately from LCM, using IdentityIQ’s workflow engine. These workflows determine the steps and approvals required to perform such actions.

References:

SailPoint IdentityIQ Configuration Guide: Account Management

SailPoint IdentityIQ Lifecycle Manager Configuration Guide

SailPoint IdentityIQ Administration Guide (Sections on Roles and Permissions, Workflow Configurations)

The best policy types for defining each access policy are as follows:

Users cannot be members of the AccountsPayable group in AD and have the CreateVendor access right in the Vendor System application at the same time.Answer:Entitlement SOD

This policy deals with conflicting access rights at the entitlement level (i.e., group membership and specific access rights). "Entitlement Separation of Duties" (SOD) ensures that users don't have access to conflicting entitlements.

Users can have two accounts on a given system, but no more.Answer:Account

This policy pertains to the number of accounts a user can have on a system. The "Account" policy type manages restrictions on how many accounts users can possess.

Users who have either the VPN role or the Travel role cannot also be in the Contractor role.Answer:Role SOD

This policy involves conflicting roles. "Role Separation of Duties" (Role SOD) ensures that users cannot have conflicting roles, such as VPN and Contractor, or Travel and Contractor.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Entitlement SOD: This policy prevents users from having conflicting access rights. In this case, being in the AccountsPayable group while also having access to create vendors creates a potential conflict. IdentityIQ uses Entitlement SOD to handle these scenarios by preventing such combinations of entitlements.

Account: This type of policy limits the number of accounts users can have on a given system. By setting up an Account policy, IdentityIQ ensures that a user cannot exceed the set number of accounts (e.g., two accounts on a system).

Role SOD: When dealing with conflicting roles (such as VPN or Travel role conflicting with a Contractor role), Role SOD policies ensure that users do not end up in roles that violate governance or security policies. This type of policy ensures role-based access conflicts are mitigated in IdentityIQ.