IdentityIQ-Associate SailPoint Certified IdentityIQ Associate Exam Free Practice Exam Questions (2026 Updated)

No. In IdentityIQ, a birthright role is intended to represent access that is automatically assigned to identities based on defined business criteria, such as lifecycle state, department, location, job function, or other identity attributes. The purpose of a birthright role is automatic access assignment, not user-driven request selection. Rapid Setup can help configure common access-modeling and application-onboarding elements more efficiently, including birthright access patterns, but the birthright concept remains assignment-based rather than request-based.

Requestable access is handled through the access request model, where users select roles, entitlements, or other access items made available through request configuration and QuickLinks. Birthright access is different because it is granted when an identity satisfies the role assignment criteria and is recalculated through identity refresh and role evaluation. Making birthright roles requestable would undermine their purpose as standard baseline access automatically derived from identity data.

Therefore, the statement is inaccurate. Rapid Setup birthright roles are used for automated assignment and baseline access, not as requestable access items. Reference topics: Applications, Rapid Setup, Access Modeling, birthright roles, role assignment, identity refresh, and User-Driven Requests.

Yes. In SailPoint IdentityIQ aggregation, correlation is attempted first to match an aggregated account to an existing IdentityCube. Correlation may use configured attribute mappings, correlation rules, or other application correlation logic. If IdentityIQ cannot correlate the account to an existing identity, the application’s creation rule, when configured, can be invoked to determine how IdentityIQ should handle identity creation for that uncorrelated account.

This is especially relevant for authoritative applications, where aggregated account records may represent people who should exist as identities in IdentityIQ. The creation rule can control identity creation behavior, populate required identity attributes, and apply implementation-specific logic when standard correlation does not find a match. Without appropriate creation behavior, the account may remain uncorrelated and require later remediation through corrected correlation logic, re-aggregation, or manual correlation.

Therefore, the statement is accurate: the creation rule is associated with the aggregation and correlation process and is used when an account cannot be matched to an existing IdentityCube. Reference topics: Applications, BeanShell rules, account aggregation, correlation logic, identity creation rules, authoritative applications, and uncorrelated account handling.

The statement is false. IdentityIQ does not apply a universal rule that removes uncorrelated IdentityCubes after 30 days. Uncorrelated accounts or uncorrelated identity records result from aggregation and correlation processing when IdentityIQ cannot confidently associate an account from an application with an existing IdentityCube. These records remain available for administrative review and remediation until they are resolved through correlation logic, manual correlation, re-aggregation, identity refresh activity, or configured cleanup processes.

The key point is that retention and removal behavior is configuration-driven, not controlled by a fixed 30-day product rule. Administrators may use tasks, aggregation settings, pruning behavior, or lifecycle processes to clean up stale identity or account data, but such actions depend on implementation choices and task configuration. IdentityIQ preserves uncorrelated data because it may represent a real account requiring governance, certification, policy evaluation, or investigation.

Therefore, the assertion that uncorrelated IdentityCubes are automatically removed after 30 days is incorrect. Reference topics: Applications, uncorrelated account resolution, correlation configuration, aggregation results, IdentityCube association, identity refresh, and administrative cleanup tasks.

Detecting and addressing inappropriate access is a core purpose of Identity Governance and Administration in SailPoint IdentityIQ. IdentityIQ is designed to provide visibility into who has access, what access they have, how that access was obtained, whether it is appropriate, and what corrective action should occur when access violates business or security policy. Inappropriate access may be identified through access certifications, policy violations, role analysis, entitlement review, account aggregation, and identity correlation.

IdentityIQ supports this purpose by building IdentityCubes that consolidate identity, account, entitlement, role, and manager data from connected applications. Once access is visible, governance controls such as certifications allow managers, application owners, or entitlement owners to approve, revoke, or delegate access decisions. Policies can also detect toxic combinations, prohibited access, or access inconsistent with business rules. Remediation can then be routed through provisioning, work items, or manual fulfillment processes.

Therefore, the statement aligns directly with IGA and IdentityIQ’s identity security model. Reference topic: Foundational Concepts — purpose of identity security; also related to Governance — certifications, policy detection, and remediation.

Yes. In SailPoint IdentityIQ, connector selection determines not only how IdentityIQ communicates with the target application, but also which operations the connector is capable of supporting. The connector featureString identifies connector capabilities exposed to IdentityIQ. These capabilities can include whether the connector supports account aggregation, group aggregation, schema discovery, provisioning, password management, authentication, or other connector-specific functions.

This is important because IdentityIQ uses connector capabilities to determine which configuration options and operational behaviors are valid for the application. For example, a connector that supports provisioning can write account or entitlement changes back to the managed system through provisioning plans. A read-only connector, by contrast, may support aggregation but not allow IdentityIQ to create, modify, disable, or delete accounts on the target. Therefore, the featureString helps define whether the connector can perform write operations against the application.

The statement is accurate because the connector’s advertised features directly describe functional capabilities, including the ability to write changes where supported. Reference topics: Applications, connector selection, application definition, connector-dependent settings, provisioning support, aggregation behavior, and connector capabilities.

Yes. In SailPoint IdentityIQ, tasks are used to automate repeatable system processes that build, update, and maintain IdentityIQ data. Tasks are executable operations that can be run manually or scheduled to run at defined intervals. They are commonly used for core operational activities such as account aggregation, group aggregation, identity refresh, role processing, certification generation support, report execution, data maintenance, and other background processing.

This statement accurately describes the purpose of tasks because much of IdentityIQ’s governance model depends on current and processed data. For example, aggregation tasks bring account and entitlement data from applications into IdentityIQ. Identity Refresh tasks update IdentityCubes, calculate role assignments, process lifecycle events, evaluate policies, and refresh identity attributes. Maintenance tasks help keep stored information consistent and usable.

Tasks differ from workflows because tasks are primarily system-executed jobs, while workflows coordinate business processes, approvals, provisioning logic, and human interaction. Therefore, tasks are correctly described as mechanisms that automate the operational processes used to build, update, and maintain information inside IdentityIQ.

Reference topics: Foundational Concepts, tasks versus workflows, aggregation tasks, identity refresh, IdentityCube maintenance, application data processing, and system automation.

The statement is true. In SailPoint IdentityIQ, identity attributes are stored on the IdentityCube and represent normalized information about a user. These attributes describe the identity at the governance level rather than describing a single account on a connected application. Common examples include first name, last name, email, department, location, job title, employee number, manager, lifecycle state, and status.

Identity attributes are important because IdentityIQ uses them throughout identity governance processes. They support identity correlation, manager correlation, certification scoping, policy evaluation, role assignment, lifecycle events, access request routing, reporting, and population or group membership. Identity attributes may be sourced from an authoritative application, derived from account data, calculated through rules, or refreshed through Identity Refresh processing.

This differs from account attributes, which are defined in an application account schema and belong to a specific application account link. Identity attributes provide the consolidated user profile that IdentityIQ uses to make governance decisions.

Reference topics: Identity Modeling — IdentityCubes, identity attributes versus account attributes, manager correlation, Identity Refresh options.

No. The statement is too restrictive. In SailPoint IdentityIQ, business roles do not have to be requested in order to become associated with identities. A business role can be associated through access-request processing when the role is configured as requestable, but request submission is not the only acquisition path.

In the default role model, role association is maintained through IdentityIQ role evaluation and identity refresh behavior. Business roles may be assigned directly, assigned through administrative action, or associated through configured assignment logic. IdentityIQ then evaluates role relationships and updates the IdentityCube accordingly during refresh processing. By contrast, detected roles are commonly inferred from the access an identity already has, based on role profiles and entitlement conditions.

The important distinction is between requestable access and role association. Requestability controls whether users can ask for a role through Lifecycle Manager and QuickLinks. It does not mean the role can only be associated through a request. Therefore, “must be requested” is inaccurate.

Reference topics: Access Modeling, business roles, role assignment, detected roles, requestable roles, Identity Refresh, IdentityCube role data, and User-Driven Requests.

The statement is true. In SailPoint IdentityIQ, the Identity Refresh task is used to recalculate and update identity-level data stored on IdentityCubes. One of its core functions is refreshing identity attributes, which are the normalized identity fields IdentityIQ uses for governance, correlation, lifecycle processing, certifications, policy evaluation, role assignment, and reporting. These attributes may originate from authoritative sources, account links, rules, mappings, or configured identity attribute definitions.

When the Identity Refresh task runs with the appropriate options selected, IdentityIQ evaluates the configured identity attribute mappings and updates the IdentityCube accordingly. This ensures that changes from authoritative data or aggregated account information are reflected at the identity level. For example, department, manager, location, job title, status, or lifecycle state may be recalculated and stored on the IdentityCube for downstream governance processes.

This task is different from aggregation. Aggregation collects account and entitlement data from applications, while Identity Refresh updates IdentityIQ’s internal identity model using the data already stored in the repository.

Reference topics: Identity Modeling — IdentityCubes, identity attributes, manager correlation, and common Identity Refresh task options.

Yes. Aggregation partitioning in SailPoint IdentityIQ is a performance and scalability option used to divide a large aggregation workload into smaller units of work. Instead of processing the entire aggregation as one continuous task on a single execution thread, IdentityIQ can partition the work so multiple task executors can process different portions of the aggregation workload concurrently.

This is especially useful in large environments where applications contain many accounts, groups, or entitlement records. Partitioning can improve throughput by distributing processing across multiple hosts in an IdentityIQ deployment and by allowing multiple threads per host to participate in the aggregation workload. The goal is to reduce total aggregation runtime while maintaining controlled processing of account and entitlement data.

Partitioning is not the same as connector-based delta processing. Delta processing depends on connector support for identifying changed records, while partitioning concerns how the aggregation workload is divided and executed. Therefore, the statement is accurate.

Reference topics: Applications, aggregation task options, aggregation partitioning, account aggregation, performance optimization, task execution, and multi-host processing.

Yes. In SailPoint IdentityIQ, the Active period is the main review window of a certification campaign. During this period, assigned certifiers review the certification items and make access decisions such as approve, revoke, delegate, allow exception, or otherwise act according to the certification configuration. This is the required operational phase in which reviewers complete their access review responsibilities before the certification moves into later lifecycle stages.

The Active period is distinct from other certification timing or processing stages. For example, generation prepares the certification contents, while challenge and remediation periods may occur after reviewer decisions depending on campaign configuration. The Active period specifically represents the time when certification decisions are expected to be made by the responsible reviewers.

Therefore, the definition is accurate because it correctly identifies the Active period as the required review period for certification decision-making. Reference topics: Governance, access reviews, certification lifecycle, Active period, certification decisions, certifier work items, challenge period, remediation, and certification sign-off.

No. QuickLink Populations do not control which capabilities are granted to an identity. In SailPoint IdentityIQ, capabilities are administrative permission sets assigned to identities to determine what system-level functions they can perform, such as administration, certification management, report access, or other privileged IdentityIQ operations. Capabilities are part of the identity’s authorization model and are managed separately from QuickLink Population configuration.

QuickLink Populations serve a different purpose. They determine which QuickLinks are visible and usable for a defined population of users, and they can also influence request behavior such as who may perform a request, what actions are available, and for whom the request may be submitted. For example, a QuickLink Population may allow certain users to request access for themselves, request access for others, edit identities, or initiate password-related actions, depending on configuration.

Therefore, QuickLink Populations control access to request actions and QuickLink availability, not the granting of IdentityIQ capabilities themselves. Reference topics: User-Driven Requests, QuickLink Populations, identity authorization, capabilities, access request configuration, and self-service request controls.

No. QuickLink Populations do not determine which identities can approve access requests. In SailPoint IdentityIQ, QuickLink Populations control the availability and scope of QuickLinks for users. They define who can initiate a specific request action, what type of request can be launched, and in many cases who the request can be submitted for. For example, they may allow an employee to request access for themselves or allow a manager to request access for direct reports.

Approval authority is handled separately through request workflows, approval schemes, approval rules, work item assignment logic, application or role owners, managers, governance groups, or configured business processes. When an access request is submitted, IdentityIQ evaluates the configured approval path to determine which identities receive approval work items. That approval routing is not controlled by the QuickLink Population itself.

Therefore, the statement is inaccurate. QuickLink Populations govern request initiation and visibility, while approval routing is governed by workflow and approval configuration. Reference topics: User-Driven Requests, QuickLink Populations, access request process, approval workflows, work items, and request authorization.

No. IdentityIQ capabilities are used to control what a user can do inside SailPoint IdentityIQ, not to grant elevated permissions on a connected target application. A capability defines access to IdentityIQ functions such as administration, reporting, certification management, policy management, role management, access request functions, or other internal product features. Capabilities are part of IdentityIQ’s internal authorization model and determine which menus, pages, actions, and administrative operations a logged-in IdentityIQ user may perform.

Elevated permissions on a connected application must be granted through governed access, such as requesting or provisioning an account, entitlement, role, or permission on that target system. That process is handled through access requests, approval workflows, provisioning plans, connector operations, and application-specific provisioning policies. For example, adding a privileged group in Active Directory or assigning an administrative application role would be modeled as target-system access, not as an IdentityIQ capability.

Therefore, granting an IdentityIQ capability is appropriate when the user needs additional permissions within IdentityIQ itself, not when they need elevated access on an external connected application. Reference topics: Identity Modeling — how IdentityIQ access is granted to users; User-Driven Requests — access requests; Provisioning — target application access fulfillment.

Yes. In SailPoint IdentityIQ, an application definition represents an external system or managed source and contains the configuration IdentityIQ needs to connect to and interact with that system. The selected connector determines which connectivity settings are required, and the application definition stores those values. Examples can include server host, port, credentials, JDBC URL, file path, API endpoint, tenant information, authentication parameters, or other connector-specific settings.

This connectivity information enables IdentityIQ to perform operations such as account aggregation, group aggregation, schema discovery, entitlement collection, and provisioning where the connector supports write operations. The exact fields vary by connector type, which is why an LDAP, JDBC, Delimited File, Active Directory, or Web Services application may expose different configuration requirements.

Therefore, the statement is accurate: application definitions contain the communication and connectivity configuration used by IdentityIQ to access the application. Reference topics: Applications, application definition, connector selection, connector-dependent settings, account aggregation, schema configuration, and provisioning support.

No. The “Detect deleted accounts” aggregation task option is not used to ignore accounts that were previously deleted from IdentityIQ. Its purpose is to compare the accounts returned by the current aggregation with the accounts already stored in IdentityIQ for that application. When an account exists in IdentityIQ but is no longer found in the authoritative aggregation results from the source application, IdentityIQ can treat that account as deleted or removed from the target system.

This option helps keep IdentityIQ’s account inventory accurate by identifying stale Links that remain in IdentityIQ even though the corresponding account is no longer present on the application. It is especially important for governance accuracy because certifications, policy checks, identity warehouse views, and access reporting rely on current account and entitlement data.

The statement is incorrect because it reverses the behavior. Detecting deleted accounts is about recognizing accounts missing from the source during aggregation, not ignoring newly returned source accounts that were once deleted in IdentityIQ.

Reference topics: Applications, aggregation task options, account aggregation, deleted account detection, Link maintenance, IdentityCube account data, and application data reconciliation.

The statement is not a correct use case for entitlement catalog data. In SailPoint IdentityIQ, the entitlement catalog is used to govern and enrich entitlement data after entitlements are discovered from application account/group schemas and aggregation. The catalog stores managed entitlement metadata such as display name, description, owner, classification, requestability, risk-related information, and other governance attributes. This information supports access reviews, access requests, approvals, role modeling, policy analysis, and decision-making by presenting business-readable information about technical access.

The application definition is primarily the configuration object for connecting to a target system. It contains connector settings, schemas, correlation configuration, aggregation options, provisioning settings, and related application-level controls. While entitlement-related configuration begins with the application schema, the entitlement catalog is not principally used to provide descriptions “for viewing on the application definition.” Its governed data is used in operational governance contexts, especially where reviewers, requesters, approvers, and administrators need understandable access context.

Therefore, entitlement descriptions are catalog governance metadata, not a feature whose purpose is simply display on the application definition. Reference topics: Access Modeling — purpose of the entitlement catalog; Applications — group/account schemas; Governance — certification decision support; User-Driven Requests — access request display and approval context.

Yes. In SailPoint IdentityIQ, the Identity Warehouse is used to review identity-centric information stored in the IdentityCube. For identities that are managers, IdentityIQ can display the list of identities that report to that manager. This information is derived from the manager relationship established during identity aggregation, correlation, and identity refresh processing.

The direct-report relationship is not an application account attribute by itself once modeled in IdentityIQ; it becomes part of the identity model. IdentityIQ uses manager correlation to associate each identity with its manager, and when those relationships are resolved, the manager identity can show its subordinate identities as direct reports. This is important for governance because managers are frequently used as certifiers, approvers, and reviewers in access review and request workflows.

The display of direct reports depends on the identity data being populated correctly and the viewer having permission to access the identity details. However, as a functional capability of the Identity Warehouse, direct reports for manager identities are part of the identity information that can be displayed.

Reference topics: Identity Modeling, IdentityCube contents, manager correlation, Identity Warehouse, identity refresh, and governance reviewer relationships.

The statement is false. The Identity Refresh task does not execute aggregation rules configured on an application definition. Aggregation rules are part of the application aggregation process, where IdentityIQ connects to a source system, reads account or group data, applies connector and application-level processing, and stores account links, entitlement values, and related data in the IdentityIQ repository.

The Identity Refresh task operates after data is already present in IdentityIQ. Its function is to update IdentityCubes and recalculate identity-level governance information. Depending on selected options, Identity Refresh may update identity attributes, refresh role assignments, detect assigned or detected roles, evaluate policies, process lifecycle events, refresh manager relationships, or recalculate risk and access-related identity state.

Application aggregation and identity refresh are separate task functions. Aggregation obtains and normalizes data from applications; Identity Refresh interprets and recalculates identity governance state using that aggregated data. Therefore, rules tied specifically to aggregation on the application definition are execute during aggregation, not during Identity Refresh.

Reference topics: Identity Modeling — Identity Refresh task options; Applications — aggregation rules and application definitions; Foundational Concepts — tasks and workflows.