IdentityNow-Engineer Sample Questions Answers

SailPoint IdentityNow API documentation is indeed located at https://docs.sailpoint.com . This official documentation site contains all the information developers need to interact with IdentityNow through APIs. It includes guidelines on how to authenticate, make requests, and use the API endpoints to automate and integrate with other systems.

Key Reference from SailPoint Documentation:

SailPoint API Documentation: The site docs.sailpoint.com hosts the official API documentation for SailPoint IdentityNow, covering all aspects of using IdentityNow's APIs.

Yes, using the Build Map is appropriate for modifying map data of an account for a JDBC or Delimited File source. The Build Map allows you to define how data from a source system (like JDBC or a Delimited File) is transformed and mapped into IdentityNow's data model. This step is crucial when creating or modifying mappings between source fields and IdentityNow identity attributes, ensuring accurate data representation.

Modifying map data is essential for handling specific transformations or adjustments when synchronizing data from these sources to ensure that identity data is complete and correct.

References:

SailPoint IdentityNow Source Configuration and Build Map Documentation.

SailPoint JDBC and Delimited File Source Configuration Guides.

Yes, the search syntax @accounts( source.name:"AD" AND state:"disabled" ) is correct for finding identities with disabled AD accounts. In this case, the query filters accounts based on the state being "disabled," which is valid and effective for identifying disabled accounts.

Key Reference from SailPoint Documentation:

Search by Account State: Using state:"disabled" is an accurate way to search for disabled accounts in SailPoint IdentityNow.

Yes, this statement is correct. When setting up a Virtual Appliance (VA) cluster, SailPoint does indeed create an asymmetric key pair based on a user-provided passphrase. This key pair is used for secure communication between the Virtual Appliance and the IdentityNow tenant. The asymmetric encryption model uses a public-private key pair where the private key is stored securely within the VA, and the public key is shared with the IdentityNow tenant to establish a secure, encrypted communication channel. This setup ensures that data exchanged between the VA and the IdentityNow tenant remains protected.

References:

SailPoint IdentityNow Virtual Appliance Security Guide.

SailPoint IdentityNow Asymmetric Encryption and Key Management Documentation.

Yes, downloading the Identity Exceptions report from the identity profile page is a reasonable and recommended action when troubleshooting incomplete identities on an authoritative source. This report provides detailed information about any issues or exceptions encountered during identity aggregation, such as missing required attributes or mapping errors. Analyzing this report can help identify the root cause of incomplete identity records and assist in resolving those issues.

References:

SailPoint IdentityNow Identity Profile Configuration and Troubleshooting Guide.

SailPoint IdentityNow Exception Handling and Reporting Documentation.

Yes, loading entitlement descriptions is considered a best practice before generating the campaign preview for a manager certification campaign. Providing clear and concise entitlement descriptions ensures that managers reviewing access during the certification process have a full understanding of what each entitlement or role entails. This helps in making informed decisions regarding whether an individual’s access should be approved or revoked.

Without proper descriptions, the campaign participants might have difficulty evaluating access, which can lead to inefficiencies or errors in the certification process.

References:

SailPoint IdentityNow Certification Campaign Best Practices.

SailPoint IdentityNow Campaign Preparation Guidelines.

No, when deploying the Virtual Appliance (VA) using the AWS deployment option, the IdentityNow engineer does not need to convert the VA image. SailPoint provides an AWS-compatible Amazon Machine Image (AMI) that can be directly used to deploy the VA in AWS without any additional conversion steps. The AMI is shared with the customer’s AWS account, allowing for a streamlined deployment process.

Key Reference from SailPoint Documentation:

VA Deployment in AWS: SailPoint provides a ready-to-use AMI for AWS deployments, and no image conversion is necessary for this deployment method.

No, the statement "This item is complete" is vague and does not represent any actionable configuration when implementing a JDBC connector. An IdentityNow engineer needs to focus on specific technical configurations like setting up schemas, defining SQL queries, mapping attributes, and ensuring the correct service account permissions. Simply stating "This item is complete" is not a valid step in the implementation process.

References:

SailPoint IdentityNow JDBC Connector Implementation Checklist.

SailPoint IdentityNow Configuration and Implementation Documentation.

Yes, custom connector configurations in SailPoint IdentityNow can have account correlation settings defined. Account correlation is used to link accounts from different sources to the correct identity in IdentityNow. When configuring a custom connector, it is possible to define how accounts from the connected system are correlated to existing identities based on attributes like usernames or other unique identifiers.

Key Reference from SailPoint Documentation:

Custom Connector Configuration: SailPoint allows for the definition of account correlation settings in custom connectors to ensure proper linking of external accounts to internal identities.

In this use case, provisioning is initiated, but the source has provisioning disabled, meaning automated provisioning cannot proceed. The process described is accurate: when provisioning is assigned to a source where provisioning is disabled, IdentityNow does not execute the provisioning through its automated system. Instead, a manual task is generated for a human to complete the provisioning process. This manual intervention ensures that the necessary access changes can still occur, albeit through human oversight rather than an automated connector.

This scenario aligns with how IdentityNow handles sources that are flagged as non-provisionable. The provisioning logic is still calculated within the system, but actual implementation requires manual steps when the source is configured in this way.

References:

SailPoint IdentityNow Provisioning Architecture.

SailPoint IdentityNow Manual Provisioning Workflow Documentation.

Yes, password interception is available for the Active Directory (AD) source in SailPoint IdentityNow. Password interception allows IdentityNow to capture password changes made on the AD source so that it can synchronize the new passwords across other connected systems and applications. This feature ensures password consistency and compliance across the organization’s identity infrastructure.

Key Reference from SailPoint Documentation:

Password Interceptor for AD: SailPoint supports password interception for Active Directory, enabling the platform to capture and synchronize password changes from AD to other systems in real time.

No, the Virtual Appliances (VAs) should not reside in A, which represents the SailPoint cloud environment. VAs are typically deployed in the on-premises network to interface directly with internal resources like Active Directory, databases, and applications. The cloud environment is where IdentityNow services are hosted, but the VAs need to be positioned closer to on-premise resources to manage identity synchronization and provisioning tasks.

Key Reference from SailPoint Documentation:

VA Placement Recommendations: Virtual Appliances are deployed in the on-premise network rather than the cloud, to ensure they have direct and secure access to internal resources.

The configuration provided is not valid due to an error in the server specification for Domain B. The server for Domain B (domainb.com) is incorrectly set to server.domaina.com, which is not correct. Each domain in the Active Directory (AD) forest should have its own respective server. For Domain B, the correct server should be something like server.domainb.com, assuming that there are distinct domain controllers for each domain.

Additionally, the search DN for Domain A appears to be valid as it correctly filters for employees with (employeeType=employee). The search DN for Domain B seems to be partially correct, as it targets the OU=Contingent Workers, but the issue lies with the incorrect server assignment.

Key Reference from SailPoint Documentation:

Active Directory Configuration: Each domain in a forest should be connected to its respective server, and incorrect server assignments between domains can cause LDAP search and synchronization issues. Proper domain controller assignment for both domaina.com and domainb.com is required.

Yes, this correctly describes Manager Correlation in SailPoint IdentityNow. Manager Correlation is the process of linking the manager of a given identity based on the value of an attribute in an account or identity profile, such as an employee's manager attribute. This allows the system to automatically identify and associate the correct manager for an identity, which can be important for tasks like access approvals and certification reviews.

Key Reference from SailPoint Documentation:

Manager Correlation Process: Manager correlation involves linking an identity to its manager based on specific attributes in the identity or account, such as the managerId or similar fields.

Yes, checking that the port values configured on the source in SailPoint IdentityNow are correct and accessible is an essential troubleshooting step. A timeout error can occur if the virtual appliance (VA) cannot reach the source due to incorrect port configuration or network issues blocking communication. Verifying the correct port numbers and ensuring that the necessary ports are open on both the VA and the source's firewall is critical.

Key Reference from SailPoint Documentation:

Port Configuration for Source Connectivity: Ensuring that the proper port values are configured and accessible is one of the primary troubleshooting steps when facing timeout errors in IdentityNow.

No, this statement is incorrect. While IdentityNow does use TLS (Transport Layer Security) for securing data in transit, TLS is not a hashing algorithm; it is a protocol used for encryption to ensure secure communication over networks. Additionally, IdentityNow uses hashing algorithms for securely storing passwords and answers to security questions (e.g., SHA-256 or bcrypt), but it does not use TLS for hashing these values. Hashing algorithms are one-way functions that help store sensitive data securely by converting them into irreversible fixed-length representations.

TLS protects data during transmission by encrypting it, while hashing is used for securing stored data such as passwords.

References:

SailPoint IdentityNow Encryption and Security Practices Documentation.

SailPoint IdentityNow Password Hashing and Encryption Mechanisms Guide.

No, reconfiguration within IdentityNow is not required to connect to the disaster recovery (DR) VAs, which makes this scenario not a disadvantage. When properly configured, all VAs (including DR VAs) in a cluster are part of the same logical unit, meaning that failover to the DR VAs should happen seamlessly without manual intervention or significant reconfiguration. IdentityNow handles the failover automatically, directing traffic to the DR VAs when primary VAs become unavailable.

While there might be some overhead in a manual failover scenario for certain configurations, the use of a single VA cluster helps mitigate this by ensuring the system can failover without needing complex reconfigurations for every source.

References:

SailPoint IdentityNow Virtual Appliance Failover and Disaster Recovery Configuration.

SailPoint IdentityNow High Availability Architecture Guide.

No, an access profile does not directly reference roles to provide access. Instead, access profiles are collections of entitlements or permissions that are bundled together to simplify access provisioning. Access profiles can be associated with roles, but they do not reference roles directly. Roles in IdentityNow define broader sets of permissions, which may include access profiles, but access profiles themselves are not tied directly to roles.

References:

SailPoint IdentityNow Access Profiles Documentation.

SailPoint IdentityNow Roles and Access Profiles Configuration Guide.

No, microservice architecture does not inherently make identities take up less space in the cloud. Microservices are primarily focused on improving scalability, resilience, and modularity by breaking down an application into smaller, independent services. While this architecture may optimize resource usage and improve performance, it does not specifically reduce the storage space required for identities or data. Data storage concerns are more related to optimization techniques like data deduplication or compression rather than the architecture style itself.

References:

SailPoint IdentityNow Microservices Architecture Guide.

SailPoint IdentityNow Cloud Storage and Data Management Documentation.

No, selecting a checkbox to use the database admin as the service account is not a recommended or required configuration when implementing a source that uses a JDBC connector. Typically, for security and least privilege, a dedicated service account with only the necessary permissions to read and manage identities within the database is used. Granting database administrator (DBA) privileges to the service account introduces unnecessary security risks and is against best practices.

References:

SailPoint IdentityNow JDBC Connector Configuration Guide.

SailPoint IdentityNow Best Practices for Service Accounts Documentation.

https://identityNowacme.com is not typically considered a vanity URL. While it includes the "identityNow" term, it does not appear to follow the format of a vanity URL, which generally includes a company-specific subdomain (like my) and a custom domain (example.com). In this case, the URL is more generic and lacks the branding or simplicity typically associated with vanity URLs.

Key Reference from SailPoint Documentation:

Vanity URL Structure in IdentityNow: Vanity URLs typically feature a customized subdomain that reflects the organization’s branding, and identityNowacme.com does not fit this pattern.

Yes, the Virtual Appliances (VAs) should reside in C, which represents the on-premise network. In this scenario, the engineer has an Active Directory, a database server, and cloud applications. The VA needs to reside inside the internal on-premises network (C) to securely communicate with the Active Directory and database server. The VA will manage the secure connection to these internal resources and can also interact with cloud applications via SailPoint IdentityNow.

Key Reference from SailPoint Documentation:

VA Deployment in On-Prem Network: SailPoint advises deploying Virtual Appliances within the internal on-premises network where they can securely access identity sources like Active Directory and internal databases.

No, this example does not accurately describe an IdentityNow data flow. The step where the domain controller sends a list of accounts directly to the virtual appliance is incorrect. Instead, during manual aggregation, the virtual appliance is responsible for initiating the connection to the domain controller (or other authoritative source), retrieving account data, and then sending the results to the IdentityNow tenant. Sensitive information is masked before sending the data from the virtual appliance to the IdentityNow tenant, but the domain controller does not interact directly with the IdentityNow tenant.

References:

SailPoint IdentityNow Aggregation Process Documentation.

SailPoint IdentityNow Virtual Appliance Data Flow Guide.

Live access reviews, which involve reviewing and certifying user access to various resources, should be performed in a production environment. This is because access reviews are directly related to active identities and entitlements in a live system, ensuring compliance and security in real-time operations.

Key Reference from SailPoint Documentation:

Access Reviews in Production: SailPoint recommends conducting live access reviews in production environments to ensure that the access being reviewed reflects the actual, current access of users in the system.

Yes, an access profile can be acknowledged during certifications. During access certification campaigns, reviewers can review access profiles as part of the items that need to be certified. They can either approve or revoke access to the access profiles, just like they would with individual entitlements. This ensures that users' access to these bundled entitlements is regularly reviewed and compliant with organizational policies.

References:

SailPoint IdentityNow Certification Campaigns Guide.

SailPoint IdentityNow Access Profile Certification Documentation.

SailPoint IdentityNow allows HTML editing of email templates to customize the look, feel, and content of notifications. Administrators can modify email templates using HTML to include company branding, custom messages, and specific formatting based on their organization's communication needs.

SailPoint provides out-of-the-box email templates for common scenarios such as access requests, password resets, or provisioning notifications. Administrators can enhance these templates using HTML and inline CSS to personalize the messages for their users.

Key Reference from SailPoint Documentation:

Email Template Customization in IdentityNow: SailPoint supports the editing of email templates via HTML to meet specific organizational requirements. Administrators can navigate to the email templates section within the admin interface and update the HTML content as needed.

No, when deploying the Virtual Appliance (VA) in Azure, the IdentityNow engineer does not necessarily need to use the Azure CLI to deploy the VA image. While using the Azure CLI is one option, SailPoint provides multiple ways to deploy the VA in Azure, including using the Azure portal or ARM (Azure Resource Manager) templates. The process does not mandate using the CLI specifically.

Key Reference from SailPoint Documentation:

Azure VA Deployment Methods: SailPoint supports multiple methods for deploying the VA in Azure, including through the Azure portal or ARM templates, without requiring the CLI.

Yes, SailPoint uses a proprietary fairness algorithm to manage and distribute workloads in its multi-tenant environment. This algorithm ensures that resources are allocated fairly among tenants, preventing any single tenant from consuming excessive resources at the expense of others. It helps maintain system performance and stability, balancing the processing load and providing equitable access to shared infrastructure in a multi-tenant setup.

References:

SailPoint IdentityNow Multi-Tenant Architecture Documentation.

SailPoint IdentityNow Resource Allocation and Fairness Algorithm Guide.

Yes, verifying that the Virtual Appliance (VA) has connectivity to the internet is a critical step when troubleshooting a "failed" status in IdentityNow. The VA requires internet connectivity to communicate with SailPoint IdentityNow’s cloud services for synchronization, updates, and other key functions. If the VA is unable to reach the internet, it can lead to a failed status. Logging in to the VA’s console to test network connectivity (e.g., using ping or curl commands) is an important step in diagnosing the issue.

Key Reference from SailPoint Documentation:

VA Internet Connectivity Troubleshooting: SailPoint recommends checking the network connectivity as one of the first steps when the VA shows a failed status.