IdentityIQ-Engineer Exam Dumps - SailPoint Certified IdentityIQ Engineer

The " Delete Entitlement " batch request type is not designed for cleaning up access by correcting or updating entitlements in bulk. Instead, " Delete Entitlement " is used to remove specific entitlements from the system entirely, which may not be what is needed if the goal is to correct incorrect entitlements (e.g., removing excess entitlements while adding missing ones). For the scenario described, where users need their entitlements corrected, other batch processes such as " Update Entitlement, " " Revoke Access, " or specific role re-assignment processes would be more appropriate.

SailPoint IdentityIQ Batch Request Types Documentation

SailPoint IdentityIQ Administration Guide (Entitlement Management Sections)

In SailPoint IdentityIQ, when dealing with a policy violation of the type " Role Separation of Duties (SOD) Policy, " there are specific actions that the policy violation owner can take. These options typically include:

Mitigate: Applying a mitigating control to the violation.

Remediate: Addressing the violation by removing or altering access.

Accept: Acknowledging the violation without making changes, which usually requires justification.

Forward: Assigning the violation to another individual or group for resolution.

The option " Schedule Policy Composition Certification " is not a valid action for addressing a Role SOD Policy violation directly. The concept of scheduling a certification is related to periodic review processes, not immediate policy violation handling. Certification campaigns are scheduled and executed to review roles, entitlements, or policies, but this is not an action taken in response to a specific policy violation.

Thus, " Schedule Policy Composition Certification " is not an appropriate or valid option in this context, and the correct answer is B. No.

The statement that a user ' s access to the Identity Warehouse is controlled by the QuickLink Populations they are a member of is incorrect. QuickLink Populations in IdentityIQ are used primarily for grouping identities for specific operations, such as access reviews, certifications, or specific application provisioning, rather than directly controlling access to the Identity Warehouse.

Access to the Identity Warehouse is governed by role-based access controls (RBAC), scopes, and the user ' s entitlements within IdentityIQ. These determine what data and functionality a user can access, including the information in the Identity Warehouse.

Thus, the correct answer is B. No.

Yes. This implementation follows the essential IdentityIQ transaction-locking pattern for modifying a persistent SailPoint object. ObjectUtil.transactionLock() retrieves the named Policy object while obtaining a transaction-level database lock. A transaction lock is appropriate when processing needs exclusive access to an object for the duration of a short transaction and must prevent another transaction from updating the same object simultaneously.

After obtaining the locked Policy object, the engineer performs the required changes and then calls context.saveObject(object). saveObject() persists changes to an object derived from SailPointObject; however, persistence is not complete until the transaction is committed. The subsequent context.commitTransaction() therefore completes the modification and releases the transaction-level database lock as the transaction finishes.

SailPoint ' s documented transaction-lock example follows essentially the same sequence: obtain the object using ObjectUtil.transactionLock, modify it, invoke context.saveObject, and commit. Calling context.decache(object) afterward may be useful to remove the object from the context cache, particularly in longer-running processing, but its omission does not invalidate this basic implementation.

References/topics: IdentityIQ Engineer — ObjectUtil, transaction locking, Policy objects, SailPointContext persistence, object save/commit lifecycle.

=======

Yes. IdentityIQ ' s Debug Logging functionality provides diagnostic information about the active logging configuration, including information associated with the currently loaded Log4j configuration. This is useful because troubleshooting IdentityIQ commonly requires an engineer to determine not merely what log level is active, but which logging configuration is actually being used by the running application .

That distinction matters in application-server environments where multiple configuration files, deployment paths, classpath resources, customized Log4j configuration, or node-specific settings may exist. Editing the wrong file produces no effective logging change and can waste substantial troubleshooting time.

The Debug Logging interface is also associated with runtime logger inspection and temporary adjustment of logging levels. However, engineers should treat runtime debug logging carefully: enabling DEBUG or TRACE for broad packages can produce significant log volume and performance impact. Persistent configuration changes should be made through the supported logging configuration and change-control process rather than assuming a runtime debug change permanently modifies the source configuration.

Therefore, the proposition that the Debug Logging page can identify the location of the currently loaded Log4j file is valid.

References/topics: IdentityIQ Engineer — Debug Logging, Log4j configuration, runtime logging levels, troubleshooting, application-server logging.

=======

Yes. CertificationItem is one of the IdentityIQ object areas that can be extended to store client-specific data through the supported extended-object/Hibernate mapping approach. The purpose of updating a corresponding .hbm file is to introduce persistent custom columns or mapped properties into the IdentityIQ database model. For certification use cases, client-specific data may need to be stored with review items, such as additional context, classification values, remediation metadata, or custom review attributes. The extension process must not stop at editing the mapping file. The Word bank’s schema-extension process describes the broader pattern: update the Hibernate mapping, generate the schema update script, apply the script to the IdentityIQ database while the application server is stopped, then start the application server and update the corresponding ObjectConfig. Therefore, CertificationItem is a valid object for this proposed extension approach, provided the engineer follows the full supported schema-extension process. References/topics: IdentityIQ Engineer — object extension, CertificationItem, Hibernate mapping, extended schema, ObjectConfig.

Yes, the statement is true. When editing a step in the Business Process Editor in SailPoint IdentityIQ, the available step actions are Script, Rule, Subprocess, and Call Method. These actions allow for various types of logic and processing to be embedded within workflows. Each of these actions serves different purposes:

Script: Executes a Beanshell script.

Rule: Calls an existing IdentityIQ rule.

Subprocess: Invokes another workflow as a subprocess.

Call Method: Invokes a method on a specified object.

SailPoint IdentityIQ Business Process Editor Guide

SailPoint IdentityIQ Administration Guide (Section on Workflow Management)

No. IdentityIQ report execution is based on task/report scheduling behavior, and the platform is not limited to running reports only once per day. Reports can be executed manually or scheduled according to supported scheduling options, depending on task configuration and administrative requirements. A daily schedule is only one possible cadence. IdentityIQ reporting is built on task infrastructure, and report templates can generate report instances based on selected parameters, filters, and schedules. In real deployments, organizations may schedule reports daily, weekly, monthly, or at other configured intervals depending on governance, compliance, and operational needs. The proposed solution is too restrictive because it says “at most once per day,” which incorrectly imposes a limitation that is not inherent to IdentityIQ reporting. The accurate concept is that reports can be scheduled, but the frequency depends on the task scheduler configuration and the report’s business purpose. References/topics: IdentityIQ Engineer — reporting, report templates, scheduled reports, task execution, report instances.