IdentityIQ-Engineer Exam Dumps - SailPoint Certified IdentityIQ Engineer

No. IdentityIQ ' s standard audit-event configuration is managed primarily through the Audit Configuration page, not through the Administrator Console. SailPoint documents the navigation for audit configuration under Global Settings > Audit Configuration , where administrators choose which General Actions, Identity Attribute Changes, Link Attribute Changes, Class Actions, and other supported activities are collected in the audit log.

The Administrator Console serves a different operational purpose. It is used for areas such as task-result management, provisioning transaction monitoring, host/environment monitoring, application health, and status information for SailPoint modules and extensions. Although some activities viewed or performed there may themselves generate audit records when auditing is enabled, that does not make the Administrator Console the central audit-configuration interface.

This distinction is important for an IdentityIQ engineer. Audit Configuration controls what governance events are recorded; Advanced Analytics provides mechanisms to search the resulting audit events; Administrator Console focuses primarily on operational monitoring and administration. Therefore, replacing “Audit Configuration page” with “Administrators Console page” changes the statement from correct to incorrect.

References/topics: IdentityIQ Engineer — Audit Configuration, audit actions, Administrator Console, Environment Monitoring, Advanced Analytics.

=======

Yes. This is the classic joiner lifecycle event. The person has not previously been with the company, has now been hired, and needs new access and new accounts. In IdentityIQ Lifecycle Manager terms, a joiner process usually starts from an authoritative-source change such as a new HR record. The process may create or activate the Identity Cube, assign birthright roles, request or automatically provision accounts, calculate policies, trigger approvals, and send notifications. Unlike rehire or reinstatement scenarios, there are no existing disabled accounts to restore. The access model should be built from onboarding rules, role assignment logic, provisioning policies, application create policies, and approval workflows. This is exactly why joiner workflows exist: to standardize new-person onboarding and ensure access is created consistently, securely, and audibly. References/topics: IdentityIQ Engineer — joiner lifecycle event, LCM onboarding, birthright access, account creation, provisioning policy, role assignment.

The statement that " All certifications include generation, the active period, sign-off, and the end period " is true. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization ' s policies.

SailPoint IdentityIQ Certification Administrator ' s Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)

Yes. IdentityIQ ' s authorization model uses granular SPRights and higher-level Capabilities to control access to product functions. SPRights govern access to menus, tools, tabs, pages, and individual operations. Capabilities group one or more of those rights into logical sets that can be assigned according to job responsibilities.

A capability can be assigned directly to an Identity through the identity ' s User Rights configuration. Capabilities may also be inherited indirectly through workgroup membership. Therefore, the capabilities available to a logged-in identity are one of the mechanisms IdentityIQ uses to determine which product features that user can see and what administrative or operational actions the user can perform.

Capabilities should not be confused with Scopes . Scopes constrain the objects or portions of the environment to which a user has visibility or control, whereas capabilities determine the functions/features the user is authorized to use. The two mechanisms can operate together.

SailPoint documentation explicitly states that identities can have capabilities assigned directly and that capabilities determine which IdentityIQ features users can access.

References/topics: IdentityIQ Engineer — SPRights, Capabilities, User Rights, authorization, workgroup-inherited rights, scopes.

=======

Yes. IdentityIQ role configuration can support conditional role requestability and assignment logic. A role does not have to be universally requestable for every identity. Engineers can restrict role availability through role configuration, assignment logic, population rules, request controls, or related role requirements depending on the implementation design. The proposed solution describes a role that can only be requested if the target user already has a related role. That is a valid access-governance pattern because role models often contain dependency relationships, prerequisites, or related-role structures. For example, a business role may make another IT role or application role meaningful only when the identity already satisfies a prerequisite access condition. This type of restriction prevents users from requesting access that is inappropriate outside a defined role relationship. The important engineering point is that IdentityIQ roles are not just static entitlement containers; they can include assignment rules, profiles, permitted/requestable behavior, and relationships that influence when they are visible or eligible during access requests. References/topics: IdentityIQ Engineer — role model design, requestable roles, role relationships, assignment rules, access-request governance.

The Create Identity Provisioning Policy in SailPoint IdentityIQ is designed to apply specific provisioning rules and actions during the creation of identities, especially when aggregating data from authoritative sources. These policies ensure that newly created identities have valid and authorized attribute values based on organizational rules and compliance requirements.

During identity aggregation from an authoritative source, the provisioning policy can enforce rules such as role assignments, attribute validation, and other actions necessary to ensure that the identity is created correctly and securely.

Therefore, the correct answer is A. Yes.

Yes. IdentityIQ provides several core identity properties that are directly available as standard search criteria without requiring them to be implemented as customer-defined extended searchable attributes. These include First Name, Last Name, Display Name, Email, and Manager . Identity Search exposes these properties separately from the configurable section called Searchable Attributes , which contains additional identity attributes created and designated as searchable during deployment.

This distinction is important when interpreting IdentityExtended.hbm.xml. The extended Hibernate mapping is primarily concerned with additional database-backed attributes that a customer wants to search efficiently. It does not mean that every searchable identity property must consume one of the numbered extended1, extended2, and similar columns.

Current IdentityIQ documentation lists Last Name, First Name, Display Name, Email, and Manager directly among Identity Search criteria, with separately configured searchable attributes presented in their own category. Therefore, the proposed solution correctly identifies standard searchable identity information supplied by IdentityIQ.

References/topics: IdentityIQ Engineer — Identity Search, Identity Mapping, standard identity attributes, searchable extended attributes, IdentityExtended.hbm.xml.

=======

This proposed solution is not valid as written. The stem says the engineer needs to create a custom audit event and set up an associated report. The proposed XML fragment is an ObjectAttribute definition for an attribute named userType; it is not an AuditAction definition. An ObjectAttribute entry is used in object configuration contexts to describe an attribute’s display, edit behavior, extended number, name, and type. That does not define a new audit action/event in the AuditConfig object. A proper audit event definition would use an AuditAction element or equivalent AuditConfig configuration identifying the audit action name, display name, and enabled state. Because the XML fragment shown does not create a custom audit action, it cannot satisfy the required step. This is exactly the kind of syntax-level distinction an IdentityIQ engineer must catch: correct object type and correct XML element matter. References/topics: IdentityIQ Engineer — AuditConfig XML, AuditAction definition, ObjectAttribute configuration, custom audit event setup.