Pass the SailPoint Identity Security Engineer IdentityIQ-Engineer Questions and answers with CertsForce

No. The key phrase is “inherited from an assigned Business Role.” IdentityIQ distinguishes between roles that are directly requestable and technical access that an identity receives because another role requires or contains it.

An IT Role can certainly be part of the IdentityIQ role model and can provide technical entitlement access. A Business Role can also be related to lower-level roles through required or permitted role relationships. However, when an IT Role is inherited automatically because an assigned Business Role requires it, that inherited access is not independently presented as a new role for the manager to request—the Business Role assignment is what drives the inherited role relationship.

Permitted roles are different because they can define additional role access that becomes eligible or meaningful in the context of another role. That distinction between automatic inheritance and requestability is important in access-model design.

The Word bank already contains the same manager-request stem with Business Role, which it marks valid, and another with HR Role, which it marks invalid. This inherited-IT-role proposition is separate.

References/topics: IdentityIQ Engineer — Business Roles, IT Roles, required roles, permitted roles, inherited role access, access requests.

=======

No. Specifying which applications support new account requests is not normally achieved by changing control variables in the out-of-the-box LCM workflows. That behavior is driven by application configuration, provisioning support, account creation policies, schemas, QuickLink configuration, and requestability settings. LCM workflow control variables influence how an already-launched workflow behaves: approval handling, policy checking, provisioning behavior, notifications, foreground/background behavior, trace/debug options, and similar execution controls. They do not define whether an application itself supports account creation. For an application to support new-account requests, the application must support provisioning, have the relevant create-account capability/configuration, and expose the request path through LCM/QuickLink settings. Putting this into workflow control variables would be the wrong design layer. References/topics: IdentityIQ Engineer — LCM workflows, control variables, application provisioning configuration, Create Account policy, Manage Accounts/Manage User Access.

No. Profile Class is explicitly an optional application configuration property. Its purpose is role modeling, not connectivity to Active Directory. A Profile Class allows multiple applications to be logically associated with a larger application class so a single role profile can apply across those applications.

For example, several similar application instances can share the same Profile Class so that role-detection logic does not require a separate profile for every individual instance. This can simplify enterprise role modeling, but it is not necessary for IdentityIQ to connect to Active Directory, aggregate accounts or groups, correlate accounts, perform certifications, or provision access.

SailPoint ' s Edit Application documentation describes Profile Class as an optional class used to associate an application with a larger set of applications for role-modeling purposes. This differs fundamentally from required connector configuration such as application identity, schema, forest/domain information, and authentication details.

An engineer may therefore configure Profile Class when the organization ' s role model requires it, but an Active Directory application can be successfully configured and operated without one.

References/topics: IdentityIQ Engineer — Profile Class, Application Definition, role modeling, Active Directory connector, optional application properties.

=======

No. Out-of-the-box LCM workflow control variables govern the runtime behavior of an LCM process , not the population of users authorized to launch the entry point. Control variables can influence processing such as approvals, notifications, policy checking, provisioning behavior, background/foreground execution, templates, and other workflow decisions.

Determining who can launch an LCM operation belongs at the authorization and QuickLink layer. IdentityIQ commonly controls QuickLink availability through QuickLink populations, capabilities, dynamic scopes, and related visibility or access configuration. Once an authorized user launches the operation, the associated LCM workflow executes using its configured control variables.

This architectural distinction matters. A workflow variable can change what happens after invocation, but it should not be confused with the security mechanism that decides whether a particular identity is permitted to invoke that functionality in the first place.

The question bank itself distinguishes this design layer in related LCM propositions: workflow variables control execution behavior, while application or UI eligibility is configured elsewhere.

References/topics: IdentityIQ Engineer — LCM workflow control variables, QuickLinks, QuickLink populations, capabilities, workflow authorization, dynamic scopes.

=======

Rapid Setup does allow for specifying account correlation by mapping an identity attribute to an account attribute. This is a standard part of the onboarding process where you define how IdentityIQ should correlate accounts to identities. This basic mapping functionality is included in Rapid Setup to facilitate straightforward account correlation during application onboarding.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Mapping Sections)

HR Role is not a default IdentityIQ role type. IdentityIQ role modeling uses standard role types such as Business Role, IT Role, Application Role, and Composite Role; the Word bank lists those default types and separately notes that a nonstandard label such as Entitlement Role is not a recognized default role type. “HR Role” could exist in a customer environment as a custom role name, a business-role naming convention, or a role representing human resources access, but it is not a default role type in IdentityIQ. The question is not asking whether a role named “HR Role” can be created. It asks whether HR Role is a default type available for manager request during access request. That distinction matters. Managers request role objects configured as requestable, but the role type must be one of the supported model types. Therefore, the proposed solution is invalid. References/topics: IdentityIQ Engineer — role model, default role types, Business Role, IT Role, Application Role, Composite Role, access request configuration.

This statement is incorrect. IdentityIQ supports extended identity attributes, but searchable extended attributes are not unlimited. Searchable identity attributes require database-backed indexed placeholder properties defined in the extended Hibernate mapping and exposed through Identity Attribute configuration. The Word bank already states the correct limitation: when defining identity mappings under Global Settings > Identity Attributes, only 12 additional searchable attributes can be defined; additional identity attributes and mappings may exist, but they cannot all be searchable. The proposed solution says an unlimited number of additional searchable placeholder extended attributes can be added beyond the 10 shown, which contradicts the searchable-attribute limitation. Engineers must plan identity schema extensions carefully because searchable attributes affect database schema, indexing, performance, and UI search behavior. Adding unlimited searchable placeholders would create maintainability and performance problems and is not supported as a general installation design. References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended identity attributes, searchable attributes, identity mappings, schema planning.

No. QuickLink population membership is not an exclusive one-population relationship. IdentityIQ can evaluate an identity against multiple QuickLink population definitions, and the same identity can satisfy the membership criteria for multiple populations.

QuickLink populations are used to govern which QuickLinks users can access and, for “For Others” use cases, which target identities they may act upon. Populations can be based on identity attributes, capabilities, workgroups, individual identities, or other configured membership logic. Because those criteria can overlap, there is no general requirement that an identity belong to only one population.

For example, the same employee could satisfy a Managers population, a particular geographic population, and another population associated with access-request functionality. IdentityIQ evaluates the applicable configuration rather than forcing those groups to be mutually exclusive.

The Word bank itself contains examples where QuickLink population configuration controls access to manager-only QuickLinks, reinforcing that populations represent authorization groupings rather than a single-valued classification.

Therefore, “at most one QuickLink population” is false.

References/topics: IdentityIQ Engineer — QuickLink populations, authentication and authorization, population membership, capabilities, workgroups, QuickLink visibility.

=======

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

This is not a joiner lifecycle event. The person already existed in the organization and previously had accounts. The scenario says their access was disabled and now needs to be reinstated, which is a rehire or reactivation process. In IdentityIQ, that is fundamentally different from onboarding a brand-new employee. A joiner process generally provisions new access and new accounts for a person who is newly hired or newly introduced to the identity-governance system. A rehire or reinstatement process should evaluate prior access, reactivate appropriate accounts, restore or recalculate roles, and avoid re-enabling access that is no longer valid. The phrase “previous accounts enabled” is the key clue: existing accounts are being reactivated, not newly created. Therefore, this proposed scenario should not be classified as a joiner lifecycle event. References/topics: IdentityIQ Engineer — joiner/mover/leaver model, rehire processing, account reactivation, LCM workflow routing, disabled account enablement.