Pass the SailPoint Identity Security Engineer IdentityIQ-Engineer Questions and answers with CertsForce

The statement that the application server must be restarted after reloading the logging file through the Debug-Logging page is incorrect. SailPoint IdentityIQ allows you to reload the logging configuration from the Debug-Logging page without restarting the application server. The Debug-Logging page provides a way to dynamically reload the logging settings, including those in the log4j file, so that changes can take effect immediately without the need for a server restart.

Therefore, the correct answer is B. No.

Yes. The IdentityIQ version is essential information when setting up a new sandbox environment. Version affects installation steps, supported Java versions, supported application servers, database compatibility, connector behavior, patch requirements, schema scripts, upgrade paths, and available product features. A sandbox is usually intended to mirror or safely test changes for another environment, so the engineer must know which IdentityIQ version the sandbox should run. Without the version, the engineer could deploy the wrong WAR file, apply incompatible patches, use the wrong schema scripts, or test behavior that does not match production. Version also matters for customizations such as rules, workflows, Quicklinks, UI branding, extended attributes, and connector configuration because APIs and supported patterns can differ between releases. Therefore, IdentityIQ version is not optional background information; it is a core environment-planning input. References/topics: IdentityIQ Engineer — sandbox setup, installation planning, version compatibility, patching, environment parity.

HR Role is not a default IdentityIQ role type. IdentityIQ role modeling uses standard role types such as Business Role, IT Role, Application Role, and Composite Role; the Word bank lists those default types and separately notes that a nonstandard label such as Entitlement Role is not a recognized default role type. “HR Role” could exist in a customer environment as a custom role name, a business-role naming convention, or a role representing human resources access, but it is not a default role type in IdentityIQ. The question is not asking whether a role named “HR Role” can be created. It asks whether HR Role is a default type available for manager request during access request. That distinction matters. Managers request role objects configured as requestable, but the role type must be one of the supported model types. Therefore, the proposed solution is invalid. References/topics: IdentityIQ Engineer — role model, default role types, Business Role, IT Role, Application Role, Composite Role, access request configuration.

The Rapid Setup user interface in SailPoint IdentityIQ is designed to simplify and streamline common configuration tasks, particularly during the initial setup of IdentityIQ environments. However, it has certain limitations in terms of granularity and customization.

In this case, the requirement is to disable an account on a particular application for one set of users and delete the account for another set of users during administrative terminations. The Rapid Setup interface does not provide options to differentiate between user groups for different actions (disable vs. delete) within the same termination event.

This level of specificity—applying different actions based on user group membership—would require a more advanced setup, possibly involving custom rules or workflows rather than using the Rapid Setup options. Therefore, the correct answer is B. No.

Yes. If a user already has an account on an application and needs the ability to request an additional/new account through Manage User Access, the relevant LCM/QuickLink configuration must permit requesting new accounts. The proposed setting, “Allow requesting new accounts,” is specifically aligned with that requirement. Manage User Access and Manage Accounts behavior is controlled through Lifecycle Manager quicklink and population configuration, which determines what actions are visible and available to eligible users. Without enabling new-account requests for the appropriate QuickLink population, the user may only be able to manage existing account access or request entitlements for current accounts, not initiate a new account request on that application. This setting must also align with the application’s provisioning support and account creation policy. The configuration grants the UI/request capability; successful fulfillment still depends on application schema, create policy, approvals, and provisioning workflow. References/topics: IdentityIQ Engineer — LCM, Manage User Access, Manage Accounts QuickLink, QuickLink population, new account request, provisioning policy.

Yes, setting the " Source Mappings: Application Rule " configuration on the account attribute is necessary to meet the requirements described. The use case involves flagging privileged accounts based on attributes read from different applications and using these flags in various IdentityIQ features like Advanced Analytics, rule writing, and policy enforcement. By configuring the attribute with a source mapping that uses an Application Rule, you can implement complex logic to derive the attribute ' s value from multiple sources, such as a financial application and a keystore application, according to the specific requirements.

Therefore, the correct answer is A. Yes.

Yes. Attesting assignment of roles to users is a valid purpose of an IdentityIQ certification. Role-based governance depends not only on whether roles contain the correct entitlements, but also on whether the correct users hold those roles. A certification can ask reviewers to validate role membership, confirm that role assignments are appropriate for job function, and revoke or remediate role assignments that are no longer justified. This is especially important in environments where role assignment rules, business roles, or automated provisioning logic are used. If the rule assigns a role to the wrong population, users may inherit incorrect access even if the role composition itself is technically correct. Certification provides a formal review and sign-off process, creating accountability and audit evidence. Therefore, attesting role assignment to users is squarely within IdentityIQ certification functionality. References/topics: IdentityIQ Engineer — role membership certification, access review, role assignment attestation, certification sign-off, remediation decisions.

This is not a joiner lifecycle event. The person already existed in the organization and previously had accounts. The scenario says their access was disabled and now needs to be reinstated, which is a rehire or reactivation process. In IdentityIQ, that is fundamentally different from onboarding a brand-new employee. A joiner process generally provisions new access and new accounts for a person who is newly hired or newly introduced to the identity-governance system. A rehire or reinstatement process should evaluate prior access, reactivate appropriate accounts, restore or recalculate roles, and avoid re-enabling access that is no longer valid. The phrase “previous accounts enabled” is the key clue: existing accounts are being reactivated, not newly created. Therefore, this proposed scenario should not be classified as a joiner lifecycle event. References/topics: IdentityIQ Engineer — joiner/mover/leaver model, rehire processing, account reactivation, LCM workflow routing, disabled account enablement.

The statement is incorrect. The " For Others " option in the quicklink configuration is used to allow users to perform actions on behalf of other identities (e.g., a manager performing an action for a subordinate). However, setting the quicklink to " For Others " does not make it launch a workflow immediately. To have a quicklink launch a workflow immediately when clicked, you would typically need to configure the quicklink to call the workflow directly, without requiring additional user input. " For Others " is more about the context of the action rather than triggering workflows automatically.

SailPoint IdentityIQ Quicklink Development Guide

SailPoint IdentityIQ Administration Guide (Quicklink and Workflow Configuration)

This implementation is correct in structure. The code first resolves the Application object named MagicBox, then creates an IdentityService, then calls service.getLinks(identity, application) to retrieve the account links for that identity on the application. Because the requirement is to return all account names, using getLinks and iterating over the returned List < Link > is the right pattern. Each Link represents an account on an application, and getNativeIdentity() returns the account’s native identifier, which is the account name or unique account key from the target application. The null check prevents a null-pointer issue if no links are returned. In a production-quality version, an engineer might also handle a missing application object and ensure Java collection imports are available, but those do not invalidate the core implementation pattern shown. Compared with the flawed single-link version, this solution correctly handles multiple accounts. References/topics: IdentityIQ Engineer — IdentityService API, Application object lookup, Link collection retrieval, nativeIdentity, BeanShell utility methods.