Pass the SailPoint Identity Security Engineer IdentityIQ-Engineer Questions and answers with CertsForce

Yes, this action can be performed as part of configuring an application definition in IdentityIQ. When defining an application, you can specify provisioning policies, including which users should be provisioned with a basic account as part of a joiner event. This is typically done by setting up account creation rules or provisioning policies that trigger when a new user (joiner) is detected, ensuring they receive the necessary basic accounts and entitlements.

Therefore, the correct answer is A. Yes.

This is a valid step, with the typo corrected as “create the audit event.” Registering an AuditAction in AuditConfig only defines the custom event type; IdentityIQ still needs executable logic to actually write the audit event when the relevant condition occurs. That logic can be placed in a BeanShell rule, task, workflow step, or other appropriate execution point depending on the business process being audited. The code must create/populate the audit record with the configured action name and the relevant data values, such as target identity, actor, source object, application, attribute values, or other fields needed by the later report. Without this implementation logic, the custom audit action would exist but no audit records would be generated. Therefore, writing the logic to create the audit event is a legitimate step in the end-to-end process. References/topics: IdentityIQ Engineer — BeanShell audit logic, workflow audit events, custom AuditAction usage, audit data population, custom audit reporting.

The four minimum steps necessary to extend attributes in an IdentityIQ database after it has been created, in the correct order, are:

Update the corresponding hibernate file with the new attributes.

The Hibernate mapping file needs to be updated with the new attributes so that the SailPoint IdentityIQ application is aware of the new columns or properties in the database. This step ensures that the object-relational mapping (ORM) reflects the updated data model.

Run the command to generate the script to update the IdentityIQ database.

After updating the Hibernate file, a schema update script is generated. This script contains the necessary SQL commands to modify the database schema based on the new attributes added in the Hibernate file.

Shut down the application server and then run the generated extendedSchema script on the IdentityIQ database.

Before applying schema changes, the application server must be stopped to avoid any transactional conflicts. Afterward, the extendedSchema script is run on the database to apply the new attributes.

Start the application server and update the corresponding ObjectConfig.

Once the database schema is updated, restart the IdentityIQ application server and modify the ObjectConfig in SailPoint to register the new attributes for use within the IdentityIQ platform.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Updating the Hibernate File: This step involves modifying the Hibernate XML or annotation-based mapping files to reflect the new attributes that are being added to the database. SailPoint IdentityIQ uses Hibernate as its ORM, and any new database fields must first be defined at this layer.

Generating the Schema Update Script: SailPoint provides a command (usually via iiq console or build tools) that reads the updated Hibernate mapping and generates a database-specific script to alter the schema. This ensures that the database is modified in a way that matches the application ' s expectations.

Running the Schema Update Script: With the application server stopped, the schema update script is executed on the database. This step adds the new columns, indexes, or constraints that are required for the extended attributes.

Updating the ObjectConfig: Once the database is updated and the application server is running again, the ObjectConfig (typically located in the IdentityIQ admin UI) must be updated to incorporate the new fields. This step ensures that these new attributes are accessible to workflows, forms, and identity data within the system.

SailPoint IdentityIQ Installation and Configuration Guide (sections on extending the data model and schema updates).

The correct sequence of steps to turn on Certifications logging at the severity log level of trace is as follows:

Edit the file: [IdentityIQ installation] > WEB-INF > classes > log4j.properties.

This step involves accessing the configuration file where logging parameters are managed. The log4j.properties file is crucial for adjusting logging settings such as the log level for specific modules in SailPoint IdentityIQ.

Uncomment the out-of-the-box logger #log4j.logger.sailpoint.api.Certification=info.

This step enables the logger for Certification by removing the comment from the respective line in the log4j.properties file. This makes the logger active for the certification process.

Change the log level to trace and save.

After uncommenting the logger, change the log level from info to trace. The trace level provides the most detailed logging, capturing comprehensive information about the certification process for troubleshooting.

Restart the application server.

Restarting the application server is necessary for the changes in the log4j.properties file to take effect. SailPoint IdentityIQ reads the updated configuration during the startup process.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Editing the log4j.properties file is a standard practice in SailPoint IdentityIQ for configuring logging. This file, located in the WEB-INF/classes directory, controls how and what IdentityIQ logs for different components.

Uncommenting the specific logger is needed to ensure that the system is logging the events related to certification. The commented line #log4j.logger.sailpoint.api.Certification=info can be found in the default configuration and needs to be activated for proper logging.

Setting the log level to trace is crucial because trace provides the most detailed logging, which is essential for deep debugging or tracking granular details about the certifications in IdentityIQ.

Restarting the server ensures that the changes to the logging configuration are applied, as the settings in log4j.properties are only read during the startup phase.

SailPoint IdentityIQ Log Management and Troubleshooting Guide (section on adjusting log levels and configurations).

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.

The scenario describes triggering a workflow when a " Division " attribute changes from a specific value to " Senior IT, " but only when the user is a manager. The proposed solution suggests creating a trigger with an event type of " rule " that checks the previous and new values of the " Division " attribute.

However, this approach has a couple of issues:

Trigger Configuration: In SailPoint IdentityIQ, a lifecycle event trigger typically operates on changes in identity attributes, but it’s not standard to define this trigger using a rule that directly inspects the previous and new values. Instead, the lifecycle event would usually be configured in the context of the application or identity to directly listen to specific changes without needing to define the logic in a custom rule.

Condition Validation: The condition of checking if the user is a manager should ideally be integrated within the workflow itself or the lifecycle event configuration, not just as part of a rule in the trigger.

While a rule can be used to define complex conditions, the correct way to implement this in IdentityIQ would involve setting up the lifecycle event trigger specifically for the attribute change and managing any additional conditions (like checking if the user is a manager) within the workflow or using an appropriate script/rule in that context.

Therefore, while partially correct in approach, the described solution is not the best practice or a valid process in IdentityIQ, so the correct answer is B. No.

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)

Yes. This is a valid Identity search use case because the relationship between an employee and their manager is normally represented on Identity objects through attributes such as manager, manager ID, supervisor, or reporting relationship. If the identity cube contains the manager relationship, Identity search or Advanced Analytics can be used to filter identities whose manager equals a specific person and then count the returned identities. This is completely different from using Syslog for the same purpose. The Word bank rejects Syslog for this scenario because Syslog is a logging facility, not an organizational data query mechanism. But the video asks about the Identity search type, and Identity search is the correct object domain for employee reporting relationships. The engineer must ensure that the manager attribute is populated and searchable or otherwise available to the search interface. References/topics: IdentityIQ Engineer — Identity search, manager attribute, identity cube, reporting relationships, Advanced Analytics filters.

Yes. The Environment area under the Administrator Console is intended for administrative visibility into the running IdentityIQ environment, including product/environment details and installed components or extensions where exposed by the platform. Viewing the status or presence of installed SailPoint modules/extensions is consistent with environment inspection. This is very different from controlling the application server itself. The engineer can use IdentityIQ administrative pages to understand what is installed, enabled, or available in the current deployment, which helps during troubleshooting, patch verification, upgrade planning, and support analysis. In multi-node deployments, this kind of environment visibility is useful because module or extension inconsistencies can cause unpredictable behavior. However, viewing status does not imply the Environment tab can install, uninstall, start, or stop all components. The proposed action is read/inspection-oriented, so it fits the purpose of the tab. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, installed modules, extensions, environment validation, upgrade/troubleshooting checks.

A Post-Iterate rule is used in the context of data aggregation or import processes, where it runs after each record has been processed during the iteration of accounts. This type of rule is not appropriate for handling provisioning errors or creating audit records based on provisioning failures. For auditing provisioning errors, you should configure error handling in the provisioning policy or use a custom workflow that logs errors into the audit log. The Post-Iterate rule is irrelevant to provisioning tasks and error logging, making it unsuitable for this purpose. Refer to the SailPoint IdentityIQ documentation on rules and workflows for proper error handling strategies during provisioning.