A bank is two years into an ongoing project to provide all access through roles. The bank is actively using roles and actively adding to their role…

The goal is to ensure roles contain the correct entitlements, which means certifying the definition or composition of the roles themselves. An Application Owner Certification is designed to review who has access to a specific application, certifying the link between users and their entitlements on that application. It does not review the structure of a role, which might contain entitlements from multiple applications. The correct certification type for this goal would be a Role Composition Certification, where role owners certify the entitlements and sub-roles that make up their roles.

A. Yes: This is incorrect because an Application Owner Certification validates user access to an application, not the definition of a role.

1. SailPoint IdentityIQ 8.3 - User Guide, Chapter: Managing Certifications, Section: Certification Types: "An Application Owner Certification is a review of all entitlement holders for a specific application. The certifier is the owner of the application." This source confirms the focus is on entitlement holders (users), not role definitions.

2. SailPoint IdentityIQ 8.3 - User Guide, Chapter: Managing Certifications, Section: Certification Types: "A Role Composition Certification is a review of the composition of a role. The certifier is the owner of the role." This source explicitly defines the correct certification type for the bank's stated goal.

3. SailPoint IdentityIQ 7.1 - Certification Guide, Page 10, Section: Types of Certifications: This guide describes Application Owner Certification as a process where "the owner of an application certifies all access to that application." It contrasts this with Role Membership/Composition certifications, which review role members or the role's structure, respectively.