Pass the SailPoint Identity Security Engineer IdentityIQ-Engineer Questions and answers with CertsForce

Yes. An account attribute must have an Attribute Name because the name provides the logical identifier IdentityIQ uses to reference that attribute throughout the application configuration and subsequent processing. In this scenario, the engineer needs an attribute representing whether an account is privileged. That attribute must be identifiable when its value is populated from source data, calculated by rule logic, exposed to Advanced Analytics, referenced from BeanShell, or evaluated in policies.

The Attribute Name is distinct from the source mapping and datatype. The name establishes what attribute is being defined ; the source mapping determines where or how its value is obtained; and the datatype specifies what kind of value IdentityIQ expects.

The existing Word bank tests this same scenario with Source Mappings: Application Rule, which it marks as required, and separately with Edit Mode: Read Only. Those do not duplicate this proposition because DOMC treats each configuration option independently.

Therefore, Attribute Name is necessary for the account-attribute definition.

References/topics: IdentityIQ Engineer — application schema, account attributes, attribute naming, source mappings, Advanced Analytics, policy attributes.

=======

No. An individual SPRight is a granular IdentityIQ product right, but roles do not normally grant an arbitrary standalone SPRight directly as a role entitlement. IdentityIQ groups SPRights into Capabilities , which provide logical collections of rights associated with administrative or functional job responsibilities.

The Role Editor provides a Granted IdentityIQ User Rights section where an engineer can associate IdentityIQ capabilities and scopes with a role. When that role is assigned and role provisioning is processed through Identity Refresh, the corresponding capabilities and scopes can be granted to the identity. This is the supported role-level abstraction.

The distinction matters because an SPRight controls granular access to specific IdentityIQ UI functions, tools, pages, or operations, while a Capability groups one or more SPRights into a maintainable authorization construct. Directly treating a single SPRight as an ordinary role option bypasses the intended rights-to-capability model.

Therefore, although a role can grant IdentityIQ user rights indirectly through configured capabilities, the proposed statement that the role is configured to include a single SPRight object is not the valid role configuration model.

References/topics: IdentityIQ Engineer — SPRight, Capability, Granted IdentityIQ User Rights, Role Editor, authorization model.

=======

In SailPoint IdentityIQ, what users can see and do is indeed partly controlled by their authorized scope. Authorized scopes define the range of objects (such as identities, roles, applications) that a user has access to. Scopes can be applied to limit access based on specific criteria, ensuring that users only interact with the data and functionalities relevant to their role or responsibility within the organization.

For example, a user with access to a specific scope may only view or manage identities within a certain department or geographical location, depending on how the scope is configured.

Therefore, the correct answer is A. Yes.

Specifying account correlation using a rule cannot be performed using the Rapid Setup application onboarding process. Rapid Setup is designed for straightforward and simplified onboarding processes with a focus on quick configuration, typically using predefined templates and options. However, advanced configurations like custom account correlation rules require more detailed setup, typically done outside of the Rapid Setup UI, involving scripting or detailed configuration within the application definition.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Application Onboarding Sections)

The statement that " An Application object is not required to aggregate external user account information into IdentityIQ " is false. In SailPoint IdentityIQ, an Application object is essential for aggregating (importing) external user account information. The Application object defines the connection settings, schema, and mapping that enable IdentityIQ to connect to external systems and retrieve identity data. Without an Application object, IdentityIQ would not have the necessary configuration to establish a connection and aggregate user data from external sources.

SailPoint IdentityIQ Administration Guide (Section on Applications and Aggregation)

SailPoint IdentityIQ Integration and Configuration Guide

Yes. A Manager Correlation Rule is specifically intended for situations where IdentityIQ must establish the manager/direct-report relationship but a straightforward attribute-to-attribute mapping is insufficient. In a simple implementation, IdentityIQ can correlate an application attribute containing the manager identifier directly to an identity attribute. Here, however, the organization has inherited several employee-number formats through mergers. That requires normalization, transformation, conditional comparison, or other custom matching logic before the manager identity can be resolved.

SailPoint explicitly documents that Manager Correlation normally uses an application attribute and an identity attribute, but when the matching requirement is more complex than a simple field match, a Manager Correlation Rule can implement the correlation programmatically. The rule can normalize the different employee-number formats, generate appropriate comparison values, search for the matching Identity object, and return the manager relationship required during identity processing. A normal account Correlation Rule addresses account-to-identity correlation and is therefore not the precise rule type for this requirement.

References/topics: IdentityIQ Engineer — Manager Correlation Rule, authoritative-source aggregation, Identity Cube manager relationships, complex correlation logic, Application Definition Rules.

=======

This implementation is not correct. The requirement is to return all account names for an identity on the application MagicBox, but the code retrieves only a single Link by calling service.getLink(identity, " MagicBox " ). Even worse, the while (link != null) loop never changes the link variable, so if a link is found, the loop becomes infinite and repeatedly adds the same native identity. A correct implementation must retrieve the application object, obtain all matching Link objects for the identity and application, iterate over that list, and add each link’s native identity once. There is also no visible import for ArrayList or List, although BeanShell environments may sometimes tolerate imports differently. The fatal issue remains the flawed loop and single-link retrieval. IdentityIQ account data is represented by Link objects, and multiple accounts may exist for the same identity on the same application depending on connector and policy design. References/topics: IdentityIQ Engineer — IdentityService, Link objects, native identity, BeanShell API usage, account lookup logic.

No. IdentityIQ report execution is based on task/report scheduling behavior, and the platform is not limited to running reports only once per day. Reports can be executed manually or scheduled according to supported scheduling options, depending on task configuration and administrative requirements. A daily schedule is only one possible cadence. IdentityIQ reporting is built on task infrastructure, and report templates can generate report instances based on selected parameters, filters, and schedules. In real deployments, organizations may schedule reports daily, weekly, monthly, or at other configured intervals depending on governance, compliance, and operational needs. The proposed solution is too restrictive because it says “at most once per day,” which incorrectly imposes a limitation that is not inherent to IdentityIQ reporting. The accurate concept is that reports can be scheduled, but the frequency depends on the task scheduler configuration and the report’s business purpose. References/topics: IdentityIQ Engineer — reporting, report templates, scheduled reports, task execution, report instances.

Inserting the " Managers " QuickLink population as the dynamic scope in the QuickLink object is a valid step when creating a custom QuickLink that should only be accessible by managers. QuickLink populations are used to define which users have access to specific QuickLinks based on criteria like role, department, or other attributes. By assigning the " Managers " population, only users who are members of that population will see and be able to launch the QuickLink.

Therefore, the correct answer is A. Yes.

No. Rapid Setup provides a simplified attribute-based manager correlation mechanism, but it does not provide the Rapid Setup user with a custom Manager Correlation Rule configuration option.

For manager correlation in Rapid Setup, the engineer selects an application attribute containing the manager reference, chooses the comparison operator, and maps that value to an IdentityIQ identity attribute. For example, an application ' s managerEmail attribute could be mapped to the IdentityIQ email attribute. Rapid Setup permits one manager-correlation method for each application.

IdentityIQ itself does support a Manager Correlation Rule , but that is a different configuration path. SailPoint documents Manager Correlation Rule as an application rule used when a simple manager-attribute mapping is insufficient. Such rule-based logic is configured through the application ' s normal Rules configuration rather than through Rapid Setup.

This distinction is important because the existing bank already asks whether account correlation using a rule can be performed through Rapid Setup and correctly answers No. The video proposition specifically changes the subject to manager correlation , making it a separate DOMC question.

References/topics: IdentityIQ Engineer — Rapid Setup, Manager Correlation, attribute-based correlation, Manager Correlation Rule, application Rules tab.

=======