Pass the SailPoint Identity Security Engineer IdentityIQ-Engineer Questions and answers with CertsForce

No. The Provisioning area of the Administrator Console is focused on provisioning transactions , not on providing the current connector/application connection-health status for the associated target application.

A provisioning transaction can provide information about the access request and its processing state—for example whether provisioning is pending, completed, failed, or otherwise awaiting processing. Engineers can use transaction information to investigate provisioning behavior and determine which application and operations are involved. That is not equivalent to displaying whether the underlying application connector is presently connected or healthy.

Application connectivity is investigated through application configuration/testing and the relevant application or connector diagnostic mechanisms. A transaction can fail because of connectivity, authentication, connector configuration, target-system errors, invalid data, workflow problems, or many other causes. Consequently, the transaction state cannot simply be interpreted as the application ' s connection status.

The distinction is tested directly by this DOMC proposition: provisioning transaction monitoring and application connectivity monitoring are separate administrative functions.

References/topics: IdentityIQ Engineer — Administrator Console, Provisioning Transactions, Application connectivity testing, connector troubleshooting, provisioning status.

=======

Yes. For a Risk Policy violation, Certify is a valid action when the user handling the violation has the necessary permissions. IdentityIQ policy types can expose different response options, and the available disposition is not identical for every policy category.

Certify allows the responsible governance user to initiate certification-related review rather than simply accepting the violation or immediately remediating access. This is useful when a risk violation identifies access or identity conditions that warrant a formal review by an appropriate certifier before a final access decision is made.

This question must also be kept separate from the Account Policy propositions in the Word bank. The bank contains Account Policy propositions such as Schedule Policy Composition Certification—which it marks invalid—and Allow, which it marks valid. The policy type in the video is specifically Risk Policy , and DOMC evaluates the proposed action in that policy-type context.

Therefore, Certify is a valid option for the stated Risk Policy violation.

References/topics: IdentityIQ Engineer — Risk Policy, policy violations, Certify action, Compliance Manager, certification launch, violation disposition.

=======

No. Identity search is designed to search Identity objects and identity-related attributes, not to count certification campaigns or certification items in a specific lifecycle phase. “Revocation phase” belongs to the certification/remediation process, not the Identity object itself. To identify the number of certifications currently in revocation, an engineer should use certification search, certification reports, task/report output, or direct certification-related reporting depending on implementation permissions. Using Identity search would return identities, not certification phase counts. Even if an identity is involved in a revocation action, the certification’s phase/status is not the primary searchable object in Identity search. This is similar to the Word bank’s distinction that Syslog search is for log events and not for unrelated governance object queries. The proposed use case is therefore outside the Identity search type’s purpose. References/topics: IdentityIQ Engineer — Identity search, certification lifecycle, revocation phase, certification reporting, Advanced Analytics.

Here’s how the SailPoint IdentityIQ console commands correspond to their respective functions:

connectorDebug: debug the connector to identify issues in the connector.

source: authenticate to IdentityIQ as another user.

list: list objects.

provision: evaluate and execute a provisioning plan.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

connectorDebug:

SailPoint IdentityIQ Console Guide (section on connector troubleshooting).

source:

This command allows you to authenticate as another user within the IdentityIQ system. It ' s useful for testing user-specific actions or behaviors without logging out and back in.Reference: SailPoint IdentityIQ Admin Guide (section on user authentication and delegation).

list:

This function returns a list of objects or entities within the system. In IdentityIQ, objects could include applications, roles, policies, and more.Reference: SailPoint IdentityIQ Console Reference Guide (list and query commands).

provision:

The provision command evaluates and executes a provisioning plan. This is the actual process that implements changes in user access across connected systems based on the identity lifecycle event.Reference: SailPoint IdentityIQ Provisioning Guide (execution of provisioning plans).

By matching these commands to their respective functions, the detailed functionalities of IdentityIQ’s console tools are properly understood for administrative and troubleshooting purposes.

No. The proposed XML is not correct because the reference class is wrong. In IdentityIQ, rule libraries are represented through rule objects used as reusable BeanShell libraries. When a rule references a common library, the referenced object should be a Rule object, not a nonstandard sailpoint.object.RuleLibrary class. The correct pattern is to reference the library as a rule by name under the rule’s referenced-rules section. Rule libraries allow shared methods and reusable code to be included across multiple rules, which is important for reducing duplication and maintaining consistent logic. However, XML object references must use the correct IdentityIQ object class. If the class does not correspond to the persisted object type, the import or runtime resolution can fail. The concept of referencing a common rules library is valid, but this specific code is not. References/topics: IdentityIQ Engineer — Rule libraries, ReferencedRules XML, Rule object references, BeanShell code reuse, XML object configuration.

The " Name " configuration option is required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Name " field is a mandatory identifier for the application within IdentityIQ. This name is used throughout the system to reference the application and is critical for configuration, management, and integration processes. Without specifying a name, IdentityIQ cannot properly identify and interact with the SCIM 2.0 application.

SailPoint IdentityIQ SCIM 2.0 Application Configuration Guide

SailPoint IdentityIQ Administration Guide (Application Setup and Naming Conventions)

No. IdentityIQ upgrades do not automatically rewrite customer-developed Java or BeanShell code when APIs or methods become deprecated. Deprecation indicates that an API is obsolete, replaced, or scheduled for eventual removal; it does not provide automatic source-code migration.

Before an upgrade, an engineer must inventory custom rules, workflow scripts, plugins, libraries, connector customizations, Java classes, and other code that calls IdentityIQ APIs. Release notes, upgrade documentation, and API changes must then be reviewed to identify deprecated or removed methods. References to affected methods must be manually evaluated and, where necessary, refactored to use the supported replacement API. The resulting customizations must be compiled or executed and regression-tested against the target IdentityIQ release.

This matters particularly for BeanShell because many errors are discovered at runtime rather than during a traditional compilation phase. Assuming automatic conversion could therefore result in broken workflows, aggregation rules, provisioning logic, or plugins after the upgrade.

Therefore, custom method references are the implementation team ' s responsibility and are not automatically updated by the IdentityIQ upgrade.

References/topics: IdentityIQ Engineer — upgrade planning, API compatibility, deprecated methods, BeanShell customization, custom Java code, regression testing.

=======

This statement is false. BeanShell rules in IdentityIQ do not universally have to produce a meaningful output. A rule’s expected return behavior depends on the rule type and the context in which the rule is executed. Some rules are designed to return a Boolean, String, Map, ProvisioningPlan, Identity, or another object. Other rules perform side effects, such as modifying a plan, transforming values, logging, altering an object, or executing validation logic, and may return null or no useful result. The Word bank contains a related but different rule-output concept: a BeanShell rule does not always need to return an object derived from sailpoint.object.SailPointObject; it may return several other object types or null. The proposed statement is even broader and still incorrect because IdentityIQ rule output is rule-type dependent, not mandatory in a generic sense. References/topics: IdentityIQ Engineer — BeanShell rules, rule registry, return values, rule execution context, input/output contracts.

Yes. Every configured IdentityIQ application requires a Name because the Application object must have a unique logical identifier within IdentityIQ. The Name is not an Active Directory-specific connector parameter such as a domain controller, service account, or forest; it is a fundamental property of the IdentityIQ Application object itself.

IdentityIQ uses the application name throughout the platform when referencing the configured source or target. Application definitions, aggregation tasks, provisioning plans, rules, certifications, policies, reports, ManagedAttributes, Link objects, and workflow logic can all rely on the application identity. Without a usable application name, IdentityIQ could not reliably distinguish one configured Application object from another.

SailPoint ' s application configuration procedure therefore begins with the Details page and requires the engineer to enter the application Name before configuring connector-specific settings. The application type then determines the additional Active Directory configuration fields that become available.

Thus, regardless of the fact that this application uses the Active Directory connector, Name remains a required configuration option.

References/topics: IdentityIQ Engineer — Application object, Application Definition, Name, connector configuration, Active Directory application onboarding.

=======

Yes. IdentityIQ roles can be configured to include permissions as part of the access represented by the role. A role is fundamentally a logical collection of access that can include application entitlements and permission-based profile definitions. SailPoint describes roles as collections of permissions that group underlying system access into meaningful business or technical units.

Within a role profile, IdentityIQ supports Attribute Permissions in addition to attribute rules. Permissions define rights against targets on an application. An engineer can select rights such as create, read, update, delete, or execute and associate those rights with the appropriate target. These permission definitions become part of the role profile and therefore form part of the access granted through the role.

This should not be confused with IdentityIQ administrative SPRight objects. Application-level permissions contained in a role profile are governed access on target systems, whereas SPRights control functionality inside IdentityIQ itself. IdentityIQ roles can also grant capabilities and scopes when that feature is enabled.

Therefore, configuring a role to contain a set of permissions is a valid role configuration.

References/topics: IdentityIQ Engineer — Role Modeling, role profiles, attribute permissions, entitlements, targets and rights.

=======