SailPoint Certified IdentityIQ Engineer

In SailPoint IdentityIQ, what is an 'Identity Cube'?

• AA hardware appliance that stores identity data on-premise
• BThe aggregated identity record for a user that contains all accounts, entitlements, roles…
• CA reporting template that displays identity compliance metrics
• DA network segmentation policy that restricts identity provider communication

What is the purpose of 'Application Onboarding' in SailPoint IdentityIQ?

• AInstalling IdentityIQ software on a new server application
• BConnecting a new authoritative or managed system to IdentityIQ so its accounts and entitl…
• CGranting a user access to a new application via the access request module
• DCreating a new role definition for application-specific entitlements

In IdentityIQ, what language is used for writing custom Rules?

• APython 3
• BBeanShell (a Java scripting language)
• CJavaScript (Node.js)
• DPowerShell

What is a 'Lifecycle Event' in SailPoint IdentityIQ?

• AA scheduled report generation triggered by calendar dates
• BA triggered business process (joiner, mover, leaver) that automatically provisions or dep…
• CA compliance policy that defines which roles trigger a Separation of Duties violation
• DA connector event raised when an application's account data schema changes

What is the difference between a 'Business Role' and an 'IT Role' in IdentityIQ?

• ABusiness Roles are created by HR; IT Roles are created by security engineers — there is n…
• BBusiness Roles define groupings of entitlements from a business function perspective and…
• CBusiness Roles are for provisioning; IT Roles are for certification campaigns only
• DBusiness Roles require manager approval; IT Roles are auto-approved

In IdentityIQ, what is 'Aggregation' and when does it occur?

• AThe process of combining multiple IdentityIQ deployment nodes for high availability
• BThe process of reading account and entitlement data from connected applications and updat…
• CThe accumulation of policy violations before they are sent in a batch notification
• DThe merging of duplicate identity records into a single identity cube

What is 'Correlation' in the context of SailPoint IdentityIQ?

• AMatching application accounts to IdentityIQ identity records based on defined rules to bu…
• BCreating relationships between roles and entitlements in the role catalog
• CAligning compliance policies to specific regulatory frameworks
• DComparing access request approvals against historical provisioning patterns

What is a 'Certification Campaign' in IdentityIQ?

• AA marketing initiative to increase IdentityIQ user adoption within the organization
• BA periodic review process where managers or application owners certify whether users' acc…
• CAn automated provisioning workflow triggered when a new application is onboarded
• DA test campaign that verifies IdentityIQ policy rules are correctly configured

In IdentityIQ, what is 'Separation of Duties' (SoD) and how is it enforced?

• ASoD ensures IT and business teams use separate IdentityIQ deployment environments
• BSoD policies define conflicting combinations of roles or entitlements that a single user…
• CSoD requires that access requests are approved by two separate managers before provisioni…
• DSoD automatically expires access after a defined time period to prevent accumulation

What is 'Provisioning' in IdentityIQ and which two primary methods does it support?

• AProvisioning is the process of deploying IdentityIQ to a new server; it supports cloud an…
• BProvisioning is creating or modifying access on target applications; it supports direct c…
• CProvisioning is the process of backing up IdentityIQ configuration; it supports local and…
• DProvisioning is user training on IdentityIQ; it supports self-service and instructor-led…

What is the IdentityIQ 'Entitlement Catalog' used for?

• AA database of CVE entries for applications managed by IdentityIQ
• BA centralized registry of all available entitlements (groups, roles, permissions) with bu…
• CA log of all provisioning actions taken by IdentityIQ connectors
• DA list of applications that are pending onboarding to IdentityIQ

In IdentityIQ, what does a 'Provisioning Plan' represent?

• AA long-term strategy document for IdentityIQ implementation
• BAn internal data object that describes the specific access changes to be made on one or m…
• CA scheduled maintenance window for IdentityIQ infrastructure upgrades
• DA pre-approved template for common access requests that bypasses approval workflows

What is the purpose of a 'Correlation Rule' in IdentityIQ?

• ADefining which entitlements are correlated with which SoD policy violations
• BDefining the logic used to match aggregated application accounts to the correct IdentityI…
• CCorrelating certification campaign results with audit log entries
• DDefining which accounts get automatic role assignments based on identity attributes

Which IdentityIQ component evaluates and compiles a provisioning plan before partitioned plans are routed to connectors or manual work item handlers?

• AThe Aggregation Engine
• BThe Provisioning Broker (using the Plan Compiler)
• CThe Certification Processor
• DThe Workflow Engine

What is a 'Workflow' in IdentityIQ and what is its primary purpose?

• AA network routing diagram showing how identity data flows between systems
• BA configurable business process that automates multi-step actions such as access request…
• CA scheduled data report that runs automatically on a defined schedule
• DA connector configuration that defines how data is read from a managed application

In a BeanShell IdentityIQ rule, what object provides access to the IdentityIQ data model and services?

• AThe `context` variable of type SailPointContext
• BThe `connector` object injected by the application framework
• CThe `sailpoint.api.Request` HTTP object
• DThe `Identity.getInstance()` static factory method

What is the 'Identity Refresh' task in IdentityIQ?

• AA task that resets all user passwords to a default value for security
• BA scheduled or on-demand process that recalculates identity attributes, re-evaluates role…
• CA task that deletes stale identity records that have not been aggregated recently
• DA network ping-check task that verifies connectivity to all connected applications

What is the purpose of an 'Authoritative Source' designation for an application in IdentityIQ?

• AThe authoritative source is the application that receives all provisioning commands first
• BThe authoritative source application provides the master identity data (e.g., HR system)…
• CThe authoritative source is the application with the highest number of accounts — it sets…
• DThe authoritative source receives certification campaigns first before other applications

In IdentityIQ, what is the 'Provisioning Transaction Log' and why is it important?

• AA blockchain-based immutable record of all provisioning actions for compliance
• BA database record tracking every provisioning operation executed by IdentityIQ including…
• CA log file containing connector connection attempts and network errors
• DA real-time dashboard showing provisioning operations currently in progress

What is the role of 'Role Mining' in SailPoint IdentityIQ?

• AAutomatically deploying role definitions to target applications during provisioning
• BAnalyzing existing access patterns in aggregated data to identify natural entitlement gro…
• CMining blockchain data to verify the integrity of role assignment records
• DA data enrichment process that adds descriptions to role catalog entries from external so…

What is the purpose of configuring 'Attribute Synchronization' on an IdentityIQ application?

• ATo sync IdentityIQ attributes with a backup database for disaster recovery
• BTo propagate changes in identity attributes from IdentityIQ back to managed application a…
• CTo synchronize IdentityIQ software patches across multiple deployment nodes
• DTo sync role definitions from IdentityIQ to the SailPoint Identity Security Cloud

In IdentityIQ, what is a 'Work Item' and how does it relate to the provisioning process?

• AA trouble ticket automatically filed in Jira when a provisioning action fails
• BA task assigned to a human for manual action, such as approving an access request, perfor…
• CA data import batch job that imports identity data from a CSV file
• DA scan of managed applications to verify their connector configuration is valid

What happens in IdentityIQ when a manager certifies (retains) access during a certification campaign and the retained entitlement is later detected as an SoD violation?

• AThe certification decision is automatically reversed and the entitlement revoked
• BIdentityIQ records the policy violation and can be configured to alert the compliance tea…
• CThe SoD policy is automatically updated to exclude that entitlement combination for that…
• DNothing happens — approved certifications override all policy violations

What is the purpose of the 'Entitlement Owner' field in the IdentityIQ Entitlement Catalog?

• AThe technical account used by IdentityIQ to authenticate to the managed application
• BThe person responsible for approving access requests and certifying the entitlement durin…
• CThe last person who used the entitlement for access, tracked for audit purposes
• DThe IdentityIQ administrator who created the entitlement catalog entry

In IdentityIQ, what is a 'Rule Library' and how does it improve rule development?

• AA Java library JAR file that must be installed in IdentityIQ's classpath for BeanShell ru…
• BA collection of reusable BeanShell functions defined in a Library Rule that can be called…
• CA catalog of third-party connector plugins available for download from SailPoint
• DThe IdentityIQ API documentation library with code examples for rule development

What is the purpose of IdentityIQ's 'Password Synchronization' feature?

• AStoring all user passwords in plain text for administrator review
• BPropagating password changes made on one system (e.g., Active Directory) to other connect…
• CAutomatically expiring passwords based on a configurable maximum age policy
• DEnforcing minimum password complexity requirements on the IdentityIQ login page only

What is the 'Unstructured Data' (now File Access Manager) integration capability in IdentityIQ used for?

• AProcessing unstructured JSON data from REST API connectors
• BExtending identity governance to file shares and document repositories to govern who can…
• CManaging unstructured log data from SIEM integrations
• DHandling identity data that does not conform to a standard schema during aggregation

In IdentityIQ, what is the 'sailpoint.xml' configuration file or IIQ XML import/export used for?

• AConfiguring the IdentityIQ web server (Apache Tomcat) settings
• BExporting and importing IdentityIQ configuration objects (rules, workflows, forms, applic…
• CStoring end-user authentication credentials for the IdentityIQ login page
• DDefining the database schema for the IdentityIQ repository

What is IdentityIQ's 'Risk Scoring' feature and what factors contribute to an identity's risk score?

• AA CVSS-based vulnerability score for the servers running IdentityIQ
• BAn aggregated score per identity based on factors like policy violations, entitlement ris…
• CA compliance score measuring how many certifications a manager has completed
• DA network risk score based on the location the user logs in from

What is the IdentityIQ 'Connector Toolbox' (formerly Connector Suite / Direct Connectors) and how does it affect application onboarding?

• AA collection of pre-built connectors for common applications (Active Directory, SAP, Sale…
• BA hardware toolkit for physically connecting identity servers
• CA debugging tool for testing BeanShell rules in isolation
• DA third-party connector marketplace where vendors publish their own IdentityIQ connectors

In IdentityIQ, what is a 'Policy Violation' and what are the remediation options?

• AA server configuration error that prevents IdentityIQ from starting
• BA detected instance where an identity's access conflicts with a defined governance policy…
• CA failed provisioning operation that requires manual IT intervention
• DA discrepancy between IdentityIQ's data and the target application's actual account data

What is the IdentityIQ 'iiq console' command-line interface used for?

• AProviding end users a command-line alternative to the IdentityIQ web interface
• BPerforming administrative tasks including importing/exporting configuration XML, running…
• CMonitoring real-time provisioning operations from the operating system
• DConfiguring the web server (Tomcat) hosting IdentityIQ

What is IdentityIQ's 'AI Services' / SailPoint AI capability and how does it enhance governance?

• AReplacing human reviewers entirely with automated AI decisions in certification campaigns
• BProviding AI-powered recommendations for certification decisions, role modeling, and acce…
• CAn AI chatbot for end users to ask questions about their access
• DAutomatically writing BeanShell rules using generative AI

What is the difference between 'Create' and 'Modify' operations in an IdentityIQ Provisioning Plan AccountRequest?

• ACreate makes a new account; Modify changes attributes or entitlements on an existing acco…
• BCreate is for AD accounts; Modify is for LDAP accounts
• CCreate runs immediately; Modify requires manager approval first
• DCreate is manual; Modify can be automated

What is the role of 'Group Aggregation' in IdentityIQ?

• AAggregating multiple IdentityIQ instances into a single management console
• BReading group/role/entitlement definitions from managed applications (like AD security gr…
• CGrouping identity refresh tasks to run simultaneously for performance
• DMerging multiple identity cubes for users who share the same account

What is the 'Certification Type' selection in IdentityIQ and which are the most common types?

• AThe file format selected for certification reports (PDF, CSV, HTML)
• BThe scope of what is reviewed: Manager Certification (all access per manager's direct rep…
• CThe cryptographic algorithm used to sign certification campaign results
• DThe level of certification required for the IdentityIQ administrator role

In IdentityIQ, what is the 'Delegation' feature in certification campaigns?

• ADelegating IdentityIQ administrative rights to another user temporarily
• BAllowing a certification reviewer to forward specific certification items to another user…
• CAutomatically delegating rejected access requests to a senior approver
• DPassing provisioning work items to a backup approver when the primary is out of office

What is the significance of the IdentityIQ 'Authoritative Application' flag when multiple applications contain the same identity attribute?

• AThe authoritative application's version of a conflicting attribute takes precedence over…
• BThe authoritative application performs all provisioning operations as the primary target
• CThe authoritative application's account is never subject to certification campaigns
• DThe authoritative application provides read-only data that cannot be changed through Iden…