IdentityIQ-Associate Practice Questions

This is the primary function of the Entitlement Catalog. It translates raw, often cryptic, entitlement data aggregated from applications (e.g., Active Directory distinguished names) into human-readable display names and descriptions. This enriched data is then presented to business users in access request forms, reports, and certification campaigns to enable informed and accurate governance decisions.

B. No: This is incorrect. Providing user-friendly names for entitlements in requests, reports, and certifications is the core, defining purpose of the IdentityIQ Entitlement Catalog.

1. SailPoint IdentityIQ 8.2, User Guide, "The Entitlement Catalog," p. 121: "The Entitlement Catalog enables you to provide more user-friendly, business-oriented information about the entitlements that are discovered on your applications... This information is then displayed in certifications and in the access request interface."

2. SailPoint IdentityIQ 8.1, Technical Whitepaper: The Entitlement Catalog, Section 1.1: "The primary goal of the entitlement catalog is to associate business-friendly language and descriptions with native system entitlements."

This statement is true. Tasks are the primary mechanism in IdentityIQ for automating regularly scheduled business processes. They are used for a wide range of functions, including aggregating account data from applications, refreshing identity cubes with updated information, performing certifications, running reports, and carrying out system maintenance. These automated processes are essential for building, updating, and maintaining the data integrity within the IdentityIQ platform.

B. No: This is incorrect. The statement accurately describes the fundamental purpose of tasks within the IdentityIQ framework for automating data management and system processes.

1. SailPoint IdentityIQ 8.1 - Administration Guide, "Chapter 15: The Task Interface," Page 381: "Tasks are used to automate the processes to build, update, and maintain the information contained within IdentityIQ."

2. SailPoint IdentityIQ 8.2 - Administration Guide, "Understanding Tasks," Page 419: "Tasks are used to automate regularly scheduled business processes, such as loading data from sources, checking for policy violations, and creating and sending notifications."

The statement is true. The IdentityIQ provisioning engine is designed to handle dependencies logically. When a provisioning plan is created to modify a user's account on a target application (e.g., add an entitlement), the system first checks for the existence of that account. If the account does not exist, the provisioning plan is automatically updated to include a "create account" operation before the modification operation. This ensures that provisioning actions are executed in the correct sequence, preventing errors that would occur from attempting to modify a non-existent object. This is a fundamental aspect of the Provisioning Broker's logic.

B. No: This is incorrect. Attempting to modify a non-existent account would cause a provisioning failure. IdentityIQ's architecture is built to prevent this by ensuring account creation precedes modification.

1. SailPoint IdentityIQ 8.2, Technical Manual for Provisioning, Section 3.1: "The Provisioning Plan." The manual describes how the Provisioning Broker compiles requests and resolves dependencies, including the implicit creation of accounts before modifications are applied.

2. SailPoint IdentityIQ Connector and Integration Guide, Version 8.1, Chapter 2: "Provisioning Concepts," Paragraph: "Provisioning Plan Compilation." This section details that the plan is an ordered set of actions, and the system ensures prerequisites, like account existence, are met.

IdentityIQ “Tasks” are background or scheduled jobs (e.g., aggregation, identity refresh, policy scan). Verifying that a role contains the right entitlements is done through role certification, not via tasks.

A. Role validation is accomplished through certification modules; tasks execute automated system processes, not interactive role reviews.

1. SailPoint IdentityIQ 8.3 Administration Guide, Chap 15 “Maintaining the System with Tasks”, pp. 406-410 (task purpose list).

2. SailPoint IdentityIQ 8.3 Administration Guide, Chap 9 “Role Certifications”, p. 268.

Ensuring an account group grants appropriate access is typically handled through account-group certifications. IdentityIQ “Tasks” run automated jobs (aggregation, refresh, etc.) and are not used to confirm entitlement correctness.

A. Account-group access confirmation is achieved via certification; tasks do not provide review or approval capabilities.

1. SailPoint IdentityIQ 8.3 Administration Guide, Chap 15 “Maintaining the System with Tasks”, pp. 406-410.

2. SailPoint IdentityIQ 8.3 Administration Guide, Chap 9 “Account Group Certifications”, pp. 275-276.

In the default configuration of SailPoint IdentityIQ's Lifecycle Manager, access requests are not restricted to managers. The system is designed to support self-service, allowing end-users to browse an access catalog and request business roles and other entitlements for themselves. While managers can also be configured to request access on behalf of their direct reports, this is not the exclusive method. The default behavior is more permissive, enabling both self-service and manager-initiated requests.

A. Yes: This is incorrect. The default IdentityIQ configuration enables self-service access requests by end-users, which is a core feature of Lifecycle Manager.

1. SailPoint IdentityIQ 8.1 User's Guide, "Chapter 3: Requesting and Tracking Access," p. 17. "You can request new access for yourself or for other users for whom you have been given the authority to make requests."

2. SailPoint IdentityIQ 8.3 Administration Guide, "Chapter 11: Lifecycle Manager," Section: "Access Request Population," p. 329. Describes configurations for requesting for self vs. others, implying self-service is a standard option.

Provisioning is the process of creating, modifying, or deleting user accounts and their access entitlements on target systems. It is an action that grants, changes, or revokes access. In contrast, a certification campaign is a governance process focused on reviewing and validating existing access to ensure it is still appropriate. This review does not, by itself, constitute provisioning; it is a control mechanism that may trigger provisioning actions (like revocation) as a result.

A. This is incorrect because reviewing access is a governance and compliance function known as access certification or attestation, not the act of provisioning access.

1. SailPoint IdentityIQ 8.1, User Guide, "Glossary of Terms," p. 161. Defines "Access Certification" as "A review process in which a user's access rights are reviewed and either approved or revoked."

2. SailPoint IdentityIQ 8.1, User Guide, "Glossary of Terms," p. 165. Defines "Provisioning" as "The process of creating, maintaining, and deleting accounts and access rights for individuals in one or more systems or applications."

This definition is accurate. In Identity and Access Management (IAM) and specifically within SailPoint IdentityIQ, an entitlement represents a granular unit of access or a specific permission on a target system, which is referred to as an application. Examples include membership in an Active Directory group, a role in a database, or a permission set in a cloud application. The Entitlement Catalog in IdentityIQ is the central repository for all such discovered access rights from connected applications.

B. No: This is incorrect. "An access right on an application" is the standard and fundamental definition of an entitlement in the context of IdentityIQ.

1. SailPoint IdentityIQ 8.3, Glossary of Terms, "Entitlement" entry. The official glossary defines an entitlement as a right, privilege, or security attribute that may be granted to an identity.

2. SailPoint IdentityIQ 8.3, Administrator's Guide, "The Entitlement Catalog" section. The introductory paragraph explains that the catalog is built by collecting entitlements, described as specific access rights, from applications.

The statement is accurate. The aggregation process in IdentityIQ first attempts to correlate each account from the target application with an existing identity in the system. If this correlation process fails to find a match for a specific account, and a Creation rule has been defined and associated with that application, IdentityIQ will then execute that rule. The purpose of the Creation rule is to contain the logic that determines if a new IdentityIQ identity should be created for this previously uncorrelated account.

B: This is incorrect because the described scenario is the precise trigger for a Creation rule as defined in the IdentityIQ aggregation lifecycle.

1. SailPoint IdentityIQ 8.3 Rules and Scripts, "Rule Type: Creation." The documentation states, "A Creation rule is run when an account is found on a native application that cannot be correlated to an existing Identity."

2. SailPoint IdentityIQ 8.3 Connectors Administration Guide, "Connector Features and Best Practices," Section: "Account Aggregation." This guide explains the sequence of events during aggregation, including the invocation of creation logic after a failed correlation attempt.

The statement is true. Aggregation partitioning is a performance optimization feature in IdentityIQ designed to handle very large data sets efficiently. It works by dividing a single, large aggregation task into multiple, smaller, independent sub-tasks called partitions. These partitions can then be processed in parallel. This parallel processing can occur across multiple threads on a single IdentityIQ server or be distributed across multiple servers in a clustered environment, significantly reducing the overall time required for the aggregation to complete.

B: This is incorrect because the statement accurately describes the purpose and function of aggregation partitioning as a method for parallel and distributed processing of aggregation tasks.

1. SailPoint IdentityIQ 8.3 Performance Management Guide, "Partitioning," Section: "Overview of Partitioning," Page 11. The guide states, "Partitioning enables you to configure IdentityIQ to run tasks, such as account aggregation... in parallel across multiple threads and/or multiple hosts."

2. SailPoint IdentityIQ 8.3 Administration Guide, "Tasks," Section: "Partitioning," Page 226. It explains, "Partitioning enables you to configure IdentityIQ to run tasks in parallel across multiple threads and/or multiple hosts."