IdentityIQ-Engineer Sample Questions Answers

The "Total Memory" value displayed on the JVM Memory page indicates the amount of memory currently allocated to the JVM heap. In the image provided, the "Total Memory" is shown as725.617 MB. This is the amount of memory that the JVM heap is currently using, meaning it has been allocated and is available for the JVM to use.

References:

SailPoint IdentityIQ Performance Tuning and Monitoring Guide

SailPoint IdentityIQ Administration Guide (JVM and Memory Management Sections)

Placing a QuickLink object directly on a workflow is not a valid step in the development of a custom QuickLink. QuickLinks are used to provide users with easy access to specific tasks or workflows through the IdentityIQ interface, but the QuickLink itself is not embedded within the workflow. Instead, the QuickLink is created as a separate object and associated with the desired workflow or task that it is meant to launch.

The correct approach would involve creating a QuickLink that points to the workflow and then controlling access to the QuickLink by restricting it to a specific QuickLink population (e.g., "Managers"). Therefore, the correct answer isB. No.

The statement isfalse. In SailPoint IdentityIQ, the language displayed in the user interface is not always based on the default language selected in the global settings. The language displayed in the user interface is typically determined by the user's language preference, which can be set individually for each user. If a user's preferred language is not available, then the system may fall back to the default language specified in the global settings. Thus, while the global default language serves as a fallback, the actual language displayed is often based on user-specific settings.

References:

SailPoint IdentityIQ Administration Guide (Localization and Language Settings Sections)

SailPoint IdentityIQ User Guide (User Preferences and Language Selection)

Syslog is not intended for querying or identifying specific objects, such as all Link objects from a particular application. Syslog is used to record events and log information related to system activities, errors, and operations. To identify all Link objects from a particular application, you would use IdentityIQ's internal search functionality or reports that allow you to filter and retrieve such objects. These tasks involve querying the database and application-specific data structures rather than examining log files.

References:

SailPoint IdentityIQ Administration Guide (Section on Objects and Searching)

SailPoint IdentityIQ Configuration Guide (Understanding Link Objects)

The statement that a user's access to the Identity Warehouse is controlled by the QuickLink Populations they are a member of is incorrect. QuickLink Populations in IdentityIQ are used primarily for grouping identities for specific operations, such as access reviews, certifications, or specific application provisioning, rather than directly controlling access to the Identity Warehouse.

Access to the Identity Warehouse is governed by role-based access controls (RBAC), scopes, and the user's entitlements within IdentityIQ. These determine what data and functionality a user can access, including the information in the Identity Warehouse.

Thus, the correct answer isB. No.

In SailPoint IdentityIQ, certain objects are designed to be extended by updating their corresponding Hibernate Mapping (.HBM) files. However, theWorkItemobject is not one of these extendable objects. TheWorkItemis a system object that primarily represents tasks or actions that need to be processed within the workflow. It is not intended to store client-specific data through direct modification of its .HBM file. Instead, client-specific data should be handled using other mechanisms, such as custom attributes or the extension of Identity or Account objects. Attempting to modify theWorkItemobject's HBM file could lead to unexpected behavior and is not supported by SailPoint's best practices.

References:

SailPoint IdentityIQ Customization Guide

SailPoint IdentityIQ Object Model Documentation

The provided BeanShell code snippet attempts to filter and print the names ofGroupDefinitionobjects owned by "Randy.Knight." However, the code contains a few issues that prevent it from functioning correctly as written:

Class Import: TheGroupDefinitionclass should be imported explicitly at the beginning of the script, which is missing here.

Query Execution: The use ofcontext.getObjectsByNumber(GroupDefinition.class, i)is incorrect. This method does not exist in this context. The correct approach would be to usecontext.getObjects()to retrieve the list of objects and iterate over them.

Looping Logic: The loop logic also contains a flaw. Instead of using a counter-based loop withcontext.getObjectsByNumber(), the recommended approach is to usecontext.search()to retrieve a list of filtered objects and then iterate through the results.

A corrected version of this code would look something like this:

import sailpoint.object.GroupDefinition;

import sailpoint.object.Filter;

import sailpoint.object.QueryOptions;

Filter filter = Filter.eq("owner.name", "Randy.Knight");

QueryOptions qo = new QueryOptions();

qo.addFilter(filter);

List groupDefinitions = context.getObjects(GroupDefinition.class, qo);

for (GroupDefinition group : groupDefinitions) {

System.out.println(group.getName());

}

In this corrected version:

We explicitly importGroupDefinition.

We retrieve the filtered objects withcontext.getObjects(GroupDefinition.class, qo)instead ofgetObjectsByNumber.

Thus, the original code isnot correctas written. The correct answer isB. No.

In SailPoint IdentityIQ, the specific configuration that allows a user to enable an account for themselves or a subordinate through the "Manage Accounts" option doesnotnecessarily need to be configured in Lifecycle Manager (LCM) alone. While LCM does provide extensive capabilities for account management actions like provisioning, rehire, and more, enabling an account is primarily tied to the permissions and entitlements granted to the user through their role, capabilities, and access profiles.

To address the specific functionality described:

Manage Accountsis typically a part of IdentityIQ’s broader account management capabilities, which are not exclusively tied to LCM. The ability to enable or disable accounts can be governed by rules and workflows within IdentityIQ, and these may or may not be linked directly to LCM configurations.

Rehire Action in LCM: The "Rehire" action within LCM Configuration is specific to processes related to reactivating an employee’s identity when they are rehired. This does not directly relate to enabling an account from the "Manage Accounts" screen. Rehire workflows typically involve reinstating the user’s previous access, which could include enabling accounts, but this is a broader process.

Permissions and Roles: The ability to enable accounts is often governed by the permissions assigned to a user’s role within IdentityIQ. These permissions may begranted outside of LCM configurations and handled by IdentityIQ’s access governance framework.

Workflow Configurations: Enabling or disabling an account could also be tied to specific workflows, which can be configured separately from LCM, using IdentityIQ’s workflow engine. These workflows determine the steps and approvals required to perform such actions.

References:

SailPoint IdentityIQ Configuration Guide: Account Management

SailPoint IdentityIQ Lifecycle Manager Configuration Guide

SailPoint IdentityIQ Administration Guide (Sections on Roles and Permissions, Workflow Configurations)

Yes, the typical input variables for a rule are listed in the BeanShell rule editor in IdentityIQ, based on the rule registry. When you create or edit a rule in IdentityIQ using the BeanShell editor, the available input variables that are relevant to the rule type are typically pre-defined and listed based on the rule registry. These input variables provide context and data that the rule can operate on, and their availability helps guide the rule development process.

Therefore, the correct answer isA. Yes.

When setting up a new IdentityIQ test environment, it is important to assess the needs of the customer, including whether they would benefit from using a deployment accelerator.

Deployment accelerators are pre-configured sets of rules, policies, and workflows that can significantly reduce the time and effort required to deploy IdentityIQ in a test or production environment. These accelerators are particularly useful for rapidly setting up environments that align with common industry practices or specific compliance requirements.

Asking the customer whether they need a deployment accelerator is a valid and important question during the initial setup phase, as it helps to determine the best approach to configuring the test environment efficiently. Therefore, the correct answer isA. Yes.

No, the Provisioning tab under the "Administrator Console" is not used to map the associatedWorkflowCaseto a particularProvisioning Transaction. The Provisioning tab is primarily for monitoring and managing provisioning operations, not for mapping workflow cases to transactions. Such mappings are typically handled within the workflow configuration itself, not through the Provisioning tab.

References:

SailPoint IdentityIQ Workflow Guide (Handling Workflow and Provisioning Transactions)

SailPoint IdentityIQ Administration Guide (Provisioning Tab Limitations)

Yes, setting the "Source Mappings: Application Rule" configuration on the account attribute is necessary to meet the requirements described. The use case involves flagging privileged accounts based on attributes read from different applications and using these flags in various IdentityIQ features like Advanced Analytics, rule writing, and policy enforcement. By configuring the attribute with a source mapping that uses an Application Rule, you can implement complex logic to derive the attribute's value from multiple sources, such as a financial application and a keystore application, according to the specific requirements.

Therefore, the correct answer isA. Yes.

The scenario described involves disabling an account and removing all its entitlements on a particular application during Mover events. The Rapid Setup user interface in SailPoint IdentityIQ primarily handles common configurations like enabling or disabling accounts, assigning or unassigning roles, and triggering certifications during lifecycle events.

However, the combination of disabling an account and removing all its entitlements for a Mover event typically involves more detailed configuration that goes beyond the capabilities of the Rapid Setup interface. Achieving this would generally require creating a custom workflow or a specific rule that handles both disabling the account and removing entitlements based on the Mover event triggers.

Thus, the Rapid Setup UI cannot achieve this level of detailed configuration, making the correct answerB. No.

Yes, disabling all notifications can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In SailPoint IdentityIQ, most workflows, including those in LCM, use control variables to manage various settings, such as whether notifications should be sent. By setting the appropriate control variable (e.g., disabling email notifications) within the workflow configuration, you can effectively suppress all notifications related to that workflow.

Therefore, the correct answer isA. Yes.

Yes, defining account correlation via a rule is an action that can be performed as part of configuring an application definition in SailPoint IdentityIQ. Account correlation rules are often used to determine how accounts from different sources are linked to identities within IdentityIQ. These rules allow for complex logic to be applied when matching accounts to identities, beyond simple attribute matching.

References:

SailPoint IdentityIQ Administration Guide (Section on Account Correlation)

SailPoint IdentityIQ Application Configuration Guide (Using Rules for Account Correlation)

Yes, the current version and patch level of IdentityIQ can be found through the Debug-About page. The Debug-About page in SailPoint IdentityIQ provides critical information about the system, including the software version, patch level, and other configuration details. This page is a useful resource for administrators to quickly verify the IdentityIQ version and ensure that the correct patches have been applied.

Therefore, the correct answer isA. Yes.

A Post-Iterate Rule in SailPoint IdentityIQ is a type of connector rule that is executed after each account from the source system (e.g., SQL Loader application) has been read during the aggregation process. This rule allows for additional processing or customization of the data after the account has been iterated over. According to SailPoint IdentityIQ documentation, configuring a Post-Iterate Rule enables the execution of logic after each account's data has been processed, confirming that the given statement is valid. Refer to the SailPoint IdentityIQ Connector Development Guide for detailed information on rule execution during aggregation.

The statement isincorrect. The "For Others" option in the quicklink configuration is used to allow users to perform actions on behalf of other identities (e.g., a manager performing an action for a subordinate). However, setting the quicklink to "For Others" does not make it launch a workflow immediately. To have a quicklink launch a workflow immediately when clicked, you would typically need to configure the quicklink to call the workflow directly, without requiring additional user input. "For Others" is more about the context of the action rather than triggering workflows automatically.

References:

SailPoint IdentityIQ Quicklink Development Guide

SailPoint IdentityIQ Administration Guide (Quicklink and Workflow Configuration)

Syslog cannot be used to launch a certification using the search results. Launching a certification in IdentityIQ is a process that involves interacting with the application’s certification module, where you define parameters, select users or roles, and initiate the certification campaign. This process requires using the IdentityIQ user interface or APIs, not the Syslog, which is purely for logging purposes.

References:

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ API and UI Guide

The statement isfalse. While it is true that logging and auditing require extra function calls and generate data, the suggestion that this data can be compressed to avoid storage issues and improve performance is misleading. In practice, while compression might save storage space, it does not inherently improve performance, particularly because the overhead of compression and decompression could negate the performance benefits. Effective performance management in IdentityIQ involves more nuanced approaches, such as optimizing the level of detail in logs, managing log rotation, and tuning the system for efficient I/O operations.

References:

SailPoint IdentityIQ Logging and Auditing Guide

SailPoint IdentityIQ Performance Tuning Guide

Syslog can be used to identify the details of a system error presented in the UI. When a system error occurs, IdentityIQ typically logs detailed error messages, stack traces, and other relevant information to Syslog or other logging frameworks configured in the environment. By reviewingthese logs, an administrator or engineer can identify and diagnose the specific error that was encountered in the UI.

References:

SailPoint IdentityIQ Logging and Monitoring Guide

SailPoint IdentityIQ Administration Guide (Sections on Error Handling and Troubleshooting)

In SailPoint IdentityIQ, when dealing with a policy violation of the type "Role Separation of Duties (SOD) Policy," there are specific actions that the policy violation owner can take. These options typically include:

Mitigate:Applying a mitigating control to the violation.

Remediate:Addressing the violation by removing or altering access.

Accept:Acknowledging the violation without making changes, which usually requires justification.

Forward:Assigning the violation to another individual or group for resolution.

The option "Schedule Policy Composition Certification" is not a valid action for addressing a Role SOD Policy violation directly. The concept of scheduling a certification is related to periodic review processes, not immediate policy violation handling. Certification campaigns are scheduled and executed to review roles, entitlements, or policies, but this is not an action taken in response to a specific policy violation.

Thus, "Schedule Policy Composition Certification" is not an appropriate or valid option in this context, and the correct answer isB. No.

Inserting the "Managers" QuickLink population as the dynamic scope in the QuickLink object is a valid step when creating a custom QuickLink that should only be accessible by managers. QuickLink populations are used to define which users have access to specific QuickLinks based on criteria like role, department, or other attributes. By assigning the "Managers" population, only users who are members of that population will see and be able to launch the QuickLink.

Therefore, the correct answer isA. Yes.

The statement "All Identity Mappings must use a rule to set the identity attribute" is incorrect. While source mapping rules can be used to populate identity attributes dynamically, it is not mandatory for all identity mappings to rely on a rule. Identity mappings can also be configured using direct mappings, where attributes from a source are directly mapped to IdentityIQ attributes without any rule-based logic.

Therefore, the correct answer isB. No.

Running the commandiiq extendedSchemain theIIQ_Home/WEB-INF/bindirectory iscorrectand one of the standard procedures for generating database scripts to extend Application attributes in the IdentityIQ database. This command processes the schema definitions (including any new attributes) and generates the appropriate SQL scripts to update the database schema. These scripts can then be executed against the database to apply the changes.

References:

SailPoint IdentityIQ Administration Guide (Schema Extension and Database Management Sections)

SailPoint IdentityIQ Configuration Guide (Extended Schema Management)

Running a build with the updated schema placed inside it isnotthe correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

References:

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

The statement istrue. In SailPoint IdentityIQ, it is possible to configure a role to include a set of IdentityIQ capabilities. Capabilities in IdentityIQ are permissions that grant users access to specific functionalities within the platform, such as managing identities, viewing reports, or administering roles. By associating a role with specific capabilities, you can control what actions users assigned to that role can perform within the IdentityIQ environment.

References:

SailPoint IdentityIQ Administration Guide (Role Configuration and Capabilities Section)

SailPoint IdentityIQ Configuration Guide (Sections on Roles and Capabilities)

Yes, this action can be performed as part of configuring an application definition in IdentityIQ. When defining an application, you can specify provisioning policies, including which users should be provisioned with a basic account as part of a joiner event. This is typically done by setting up account creation rules or provisioning policies that trigger when a new user (joiner) is detected, ensuring they receive the necessary basic accounts and entitlements.

Therefore, the correct answer isA. Yes.

This scenario describes an employee quitting their job and needing all of their accounts disabled, which aligns with a leaver lifecycle event rather than a mover event. A leaver event typically involves the deactivation of accounts and removal of access for users who are leaving the organization entirely, whereas a mover event involves changes to roles or access as part of an internal transition (e.g., promotion, transfer).

Therefore, the correct answer isB. No.

The primary and secondary colors in the IdentityIQ user interface are not set through the IdentityIQ Configuration > Miscellaneous page. Instead, these colors are typically configured through thestyle.cssor other custom CSS files that are part of the IdentityIQ UI customization process. Administrators can define and modify the color scheme, fonts, and other style elements by editing the relevant CSS files or using the Branding feature within IdentityIQ.

Therefore, the correct answer isB. No.

The Create Identity Provisioning Policy in SailPoint IdentityIQ is designed to apply specific provisioning rules and actions during the creation of identities, especially when aggregating data from authoritative sources. These policies ensure that newly created identities have valid and authorized attribute values based on organizational rules and compliance requirements.

During identity aggregation from an authoritative source, the provisioning policy can enforce rules such as role assignments, attribute validation, and other actions necessary to ensure that the identity is created correctly and securely.

Therefore, the correct answer isA. Yes.

Yes, the code provided in the second image is correct for including a rule library named "Common Rules Library" in a Rule. The correct syntax is to useclass="sailpoint.object.RuleLibrary"and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the "Common Rules Library."

Correct Syntax (from the second image):

References:

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

The statement that "All certifications include generation, the active period, sign-off, and the end period" istrue. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization's policies.

References:

SailPoint IdentityIQ Certification Administrator's Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)