IDENTITYIQ-ENGINEER Practice Questions

The statement is true. The SailPoint IdentityIQ reporting user interface is designed to separate report definitions from their generated outputs. The 'Reports' tab, often referred to as the Report Library, contains all the available report templates that a user has permission to view and run. Conversely, the 'My Reports' tab serves as a personal repository for the current user, listing the completed instances (the generated results) of reports they have previously executed. This organization provides a clear distinction between available report types and their specific, historical outputs.

B. No: This option is incorrect as the statement accurately describes the standard, out-of-the-box functionality and layout of the reporting interface in SailPoint IdentityIQ.

1. SailPoint IdentityIQ 8.2 - Reports Guide, Page 6, "Reports Tab": "The Report Library page lists all of the reports available to you. From this page you can run reports and view their descriptions."

2. SailPoint IdentityIQ 8.2 - Reports Guide, Page 6, "My Reports Tab": "The My Reports page lists all of the reports you have run. From this page you can view, download, and delete your reports."

3. SailPoint IdentityIQ 8.3 - Administration Guide, Page 435, "Reports and Analytics": "The Report Library page lists all of the reports available to you... The My Reports page lists all of the reports you have run."

The statement is true. The "Create" Identity Provisioning Policy is a core component of the identity creation process in IdentityIQ. It is specifically triggered during an Identity Refresh (aggregation) task when an account from an authoritative source does not correlate to an existing Identity. The policy then runs to populate the attributes of the newly created Identity Cube. This ensures that new identities are immediately populated with correct, derived, or default values as defined by the organization's business logic, enforcing data consistency and authorization rules from the outset.

B. No: This is incorrect. The described scenario is the primary and intended use case for the "Create" Identity Provisioning Policy within the IdentityIQ framework.

1. SailPoint IdentityIQ 8.2 Administration Guide, "Identity Mappings", Page 115: "Identity mappings are applied during aggregation to create and update Identity Cubes... When a new identity is created from an authoritative account, the Create map is used to populate the attributes of the new Identity Cube."

2. SailPoint University, "IdentityIQ Administration" Courseware, Module: "Identity and Account Aggregation": The course materials detail the Identity Refresh process, explaining that when an authoritative application is scanned and a new account is found, a new Identity Cube is created. The "Create" Identity Provisioning Policy (Identity Mapping) is explicitly applied during this step to set the initial attribute values for the new identity.

The "Comment Character" is a configuration parameter used exclusively for Delimited File (e.g., CSV) connectors in SailPoint IdentityIQ. Its purpose is to instruct the connector to ignore any rows in the source file that begin with the specified character. The SCIM 2.0 connector, however, is an API-based connector that communicates using a standardized RESTful protocol with JSON payloads. This protocol and data format do not have a concept of "comment characters" for data records. Therefore, this configuration option is not applicable or required when setting up a SCIM 2.0 application.

A. Yes: This is incorrect because the "Comment Character" setting is fundamentally incompatible with the SCIM 2.0 API protocol and is not a valid configuration option for this connector type.

1. SailPoint IdentityIQ 8.3 Connector Documentation - Delimited File (CSV): In the documentation for the Delimited File connector, the "Comment Character" is explicitly described as a configuration attribute. It states, "Character used to denote a comment in the data file. Any line that begins with this character is ignored." This confirms the setting's purpose and its association with file-based sources. (Refer to the configuration parameters section for the Delimited File connector in the official IdentityIQ Connector Documentation).

2. SailPoint IdentityIQ 8.3 Connector Documentation - SCIM 2.0: The official guide for the SCIM 2.0 connector details its required and optional configuration settings. These include parameters such as Base URL, Authentication Method (e.g., OAuth2), Client ID, and resource-specific endpoints. The "Comment Character" attribute is not listed as a valid or available configuration option for the SCIM 2.0 connector, as it is irrelevant to its API-based operation. (Refer to the "Configuration Parameters" section within the SCIM 2.0 Connector Guide).

The IdentityIQ Console (iiq console) provides a command-line interface for administration and debugging.

• connectorDebug: This command is used specifically to invoke and test the raw methods of a connector (such as iterate, authenticate, or checkStatus) against a specific Application configuration without running a full task.
• list: This is a fundamental command used to display a list of entities for a specific object class (e.g., list Identity, list Application, list Bundle).
• source: Similar to Unix shell usage, this command reads an external file containing a sequence of console commands and executes them in the current session.
• provision: This command takes a provisioning plan (typically defined in an XML file) as input, compiles it, and executes the provisioning actions against the target resources.

SailPoint IdentityIQ System Administration Guide, Section: "The IdentityIQ Console" (Console Commands Reference).

Reference Details: The help command output within the console documentation explicitly defines source as "Execute a file of commands" and list as "List objects".

SailPoint IdentityIQ Console Guide, Command Reference Table.

Reference Details: Defines connectorDebug (or connector in some versions) as the tool to "Execute a connector method on a specified application" to verify connectivity and logic.

SailPoint IdentityIQ Technical Whitepaper, "Debugging and Troubleshooting".

Reference Details: Describes using the provision command to manually test provisioning plans during development.

The goal is to ensure roles contain the correct entitlements, which means certifying the definition or composition of the roles themselves. An Application Owner Certification is designed to review who has access to a specific application, certifying the link between users and their entitlements on that application. It does not review the structure of a role, which might contain entitlements from multiple applications. The correct certification type for this goal would be a Role Composition Certification, where role owners certify the entitlements and sub-roles that make up their roles.

A. Yes: This is incorrect because an Application Owner Certification validates user access to an application, not the definition of a role.

1. SailPoint IdentityIQ 8.3 - User Guide, Chapter: Managing Certifications, Section: Certification Types: "An Application Owner Certification is a review of all entitlement holders for a specific application. The certifier is the owner of the application." This source confirms the focus is on entitlement holders (users), not role definitions.

2. SailPoint IdentityIQ 8.3 - User Guide, Chapter: Managing Certifications, Section: Certification Types: "A Role Composition Certification is a review of the composition of a role. The certifier is the owner of the role." This source explicitly defines the correct certification type for the bank's stated goal.

3. SailPoint IdentityIQ 7.1 - Certification Guide, Page 10, Section: Types of Certifications: This guide describes Application Owner Certification as a process where "the owner of an application certifies all access to that application." It contrasts this with Role Membership/Composition certifications, which review role members or the role's structure, respectively.

Scenario 1 (Entitlement SOD): This rule identifies a "toxic combination" between specific system permissions: membership in an Active Directory group (an entitlement) and a specific access right in an application (another entitlement). Since it restricts the combination of distinct entitlements, it is an Entitlement Separation of Duties (SOD) policy.

Scenario 2 (Account): This rule imposes a constraint on the account entity itself—specifically, the cardinality (quantity) of accounts a single identity is permitted to hold on a target application. Policies governing account attributes, ownership, or quantity fall under the Account policy type.

Scenario 3 (Role SOD): This rule explicitly defines mutual exclusivity between high-level business roles (VPN/Travel Role vs. Contractor Role). When a policy restricts users from holding conflicting functional roles simultaneously, it is defined as a Role Separation of Duties (SOD) policy.

SailPoint IdentityIQ Administration Guide, Section: Policies. Defines Entitlement SOD Policies as those used to "prevent users from having conflicting entitlements" and Role SOD Policies as those used to "prevent users from having conflicting roles."

SailPoint IdentityIQ Administration Guide, Section: Account Policies. States that Account Policies are used to enforce constraints on account attributes or specific account criteria (e.g., checking for multiple accounts or specific attribute states).

SailPoint IdentityIQ User Guide, Section: Define a Policy. Details the distinction between Advanced Policies (complex logic/rules) versus standard SOD configurations.

The scenario describes a "Leaver" event followed by a "Rehire" event. A "Mover" event applies to an active identity that changes roles, departments, or other key attributes while maintaining a continuous relationship with the organization. In this case, the contractor's relationship was terminated when their contract expired and accounts were disabled. The new contract initiates a rehire process, which is a type of "Joiner" event, not a "Mover" event. The break in service is the key factor that disqualifies this from being a mover lifecycle event.

A. Yes: This is incorrect because a mover event requires a continuous employment or contract status. The scenario explicitly describes a termination followed by a new contract.

1. SailPoint IdentityIQ 8.1 Lifecycle Manager Guide, "Chapter 1: Introduction to Lifecycle Manager", Page 5. The guide defines the three primary lifecycle events: Joiner (new user), Mover (changes for an existing user, e.g., transfer), and Leaver (user termination). The scenario clearly depicts a Leaver event followed by a Joiner (rehire) event.

2. SailPoint IdentityIQ Concepts Guide v7.1, "Identity Lifecycle Management", Page 4. This document explains that lifecycle management automates processes for "hiring, termination, and job changes." A mover event is categorized under "job changes" for an existing, active identity, not for an identity that was terminated and is now returning.

3. SailPoint IdentityIQ Administration Guide v8.3, "Chapter 20: Lifecycle Manager", Section: "Lifecycle Events". This section details how events are triggered based on changes in identity attributes. A mover event is triggered by a change in an attribute like department or location for a currently active identity, not by a change from an inactive to an active state after a period of separation.

The statement is correct. SailPoint IdentityIQ provides a set of 20 pre-defined extended string attributes (extended1 through extended20) in the IdentityExtended.hbm.xml file to allow for customization of the Identity object. However, due to performance considerations related to database indexing, the administrative user interface under Global Settings > Identity Attributes imposes a limit. Only 12 of these 20 available extended attributes can be designated as "searchable". While all 20 attributes can be mapped and used to store data, only the 12 marked as searchable will be indexed for efficient use in queries, filters, and reports.

B. No: This is incorrect. Official SailPoint documentation explicitly confirms the limitation that only 12 of the 20 standard extended identity attributes can be configured as searchable through the UI.

1. SailPoint IdentityIQ 8.1 Administration Guide: In the chapter "Identity and Account Attributes," the section "Configuring Identity Mappings" states, "IdentityIQ provides twenty extended identity attributes that can be mapped to application attributes. Twelve of these attributes can be designated as searchable." (This information is typically found in the introductory paragraphs of the section on Identity Attribute configuration).

2. SailPoint IdentityIQ 8.3 Administration Guide: The chapter "Identity and Account Attributes" reiterates this limitation in the section "Identity Attributes Page." It describes the user interface for mapping attributes and notes the constraint on searchable fields among the available extended attributes.

The statement is false. SailPoint IdentityIQ utilizes the Apache Velocity Template Language (VTL) for its email templates. The #if...#end construct in VTL is a block directive, not a line-based directive. This means it can conditionally render any block of content enclosed within it, regardless of whether that content is a single word, a single line, or multiple lines forming a complete paragraph or even complex HTML structures. The entire section between #if and #end is treated as a single unit for conditional inclusion.

A. Yes: This is incorrect. The fundamental behavior of the #if directive in the Velocity engine, which IdentityIQ employs, is to conditionally process blocks of content, which can and often do span multiple lines to form paragraphs.

1. SailPoint IdentityIQ Documentation: The "IdentityIQ Email Templates" guide explicitly states that IdentityIQ uses the Apache Velocity engine. The examples provided for conditional logic demonstrate wrapping multi-line content. For instance, a block to show certification details would be wrapped in an #if statement, constituting a paragraph. (Refer to any official IdentityIQ guide on email template customization, typically found on SailPoint's Compass portal).

2. Apache Velocity User Guide: As the underlying technology, its documentation is authoritative. The section on "Conditionals: #if / #elseif / #else" describes the syntax #if( [condition] ) ... #end. The "..." represents a block of VTL that is rendered if the condition is true. This block can contain any amount of text and line breaks, thus forming paragraphs. (Source: Apache Velocity Project, Velocity User Guide, Version 2.3, Section: VTL Reference - Conditionals).

To extend the IdentityIQ schema (make attributes searchable), the process follows a specific modification of the backend Object-Relational Mapping (ORM) and database structure before updating the application layer:

1. Define Mapping: First, the .hbm.xml (Hibernate) file must be manually edited to define the new database columns mapping to IdentityIQ object attributes.
2. Generate DDL: The iiq extendedSchema command is run from the console. This utility reads the modified Hibernate file and generates the necessary SQL (DDL) script to alter the database tables.
3. Apply DDL: The application server should be shut down to release database locks. The generated SQL script is then executed against the database to physically add the columns.
4. Configure Application: Finally, the server is restarted, and the ObjectConfig (via UI or XML import) is updated to register the new attributes as searchable fields within the IdentityIQ system.

SailPoint IdentityIQ Version 8.1 Documentation, "System Administrator Guide", Section: "Advanced Configuration". (Describes the maintenance of the IdentityIQ database and extended attributes).

SailPoint Compass, Technical Whitepaper: "Searching and Extended Attributes in IdentityIQ". (Details the four-step lifecycle: Edit Hibernate -> Generate Script -> Execute Script -> Update ObjectConfig).

IdentityIQ Database Best Practices Guide, Section: "Schema Extensions". (Outlines the requirement to shut down the application server prior to running DDL scripts to ensure data integrity).