IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Free Practice Exam Questions (2026 Updated)

In SailPoint IdentityIQ, what users can see and do is indeed partly controlled by their authorized scope. Authorized scopes define the range of objects (such as identities, roles, applications) that a user has access to. Scopes can be applied to limit access based on specific criteria, ensuring that users only interact with the data and functionalities relevant to their role or responsibility within the organization.

For example, a user with access to a specific scope may only view or manage identities within a certain department or geographical location, depending on how the scope is configured.

Therefore, the correct answer is A. Yes.

No, this statement is incorrect. When a wait step is encountered in a foreground workflow, it does not cause the user’s screen to freeze for the specified number of seconds. Instead, the wait step simply pauses the workflow execution for the specified duration, but this is managed in the background. The user interface remains responsive, and the end-user typically won’t notice any freezing or delays caused by the wait step itself.

SailPoint IdentityIQ Workflow Guide (Section on Workflow Step Types)

SailPoint IdentityIQ Scripting and Workflow Best Practices

No, the code snippet provided in the image is incorrect for including a rule library named " Common Rules Library " in a Rule. The correct syntax should reference the sailpoint.object.RuleLibrary class if the intent is to include a Rule Library, as seen in the second image. The first image incorrectly references the sailpoint.object.Rule class, which is not suitable for a rule library inclusion.

Correct Syntax (as shown in the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

Correct order:

Update the corresponding hibernate file with the new attributes.

Run the command to generate the script to update the IdentityIQ database.

Shut down the application server and then run the generated extendedSchema script on the IdentityIQ database.

Start the application server and update the corresponding ObjectConfig.

These are the exact four minimum steps given in the IdentityIQ Engineer source.

The statement is incorrect. When writing and executing source mapping rules to populate identity attributes, the rule itself does not need to persist the identity attribute to the database. In SailPoint IdentityIQ, once the value for an identity attribute has been calculated by a source mapping rule, IdentityIQ automatically handles the persistence of this attribute to the database as part of the aggregation or provisioning process. The developer does not need to explicitly persist the attribute; this is managed by the system.

SailPoint IdentityIQ Source Mapping Guide

SailPoint IdentityIQ Administration Guide (Aggregation and Attribute Mapping Sections)

No. Upgrading the IdentityIQ web application does not automatically upgrade an independently installed IQService instance. IQService is a native Windows service installed on Windows hosts to support functionality requiring Windows APIs, including certain Active Directory provisioning operations and other Windows-specific connector capabilities.

SailPoint ' s IdentityIQ documentation states that the IQService version must match the IdentityIQ server version, including patch versions, and explicitly says that when one is upgraded, the other must also be upgraded. This is an operational requirement—not evidence of an automatic upgrade mechanism. The implementation engineer must deploy the appropriate IQService binaries and follow the required service upgrade or replacement procedure on each relevant Windows host.

Failing to align the versions can cause compatibility issues between IdentityIQ and IQService, particularly for connector requests, authentication/encryption behavior, provisioning, or Windows-native operations. The service configuration, port, TLS/certificate configuration, and service account should also be validated after upgrading.

Therefore, IQService must be deliberately upgraded alongside IdentityIQ; it is not automatically replaced merely because IdentityIQ itself was upgraded.

References/topics: IdentityIQ Engineer — IQService installation, version compatibility, IdentityIQ upgrades, Windows connector services, patch alignment.

=======

Yes. Importing SailPoint XML objects can be performed through supported IdentityIQ import mechanisms, and using the user interface path Global Settings > Import From File is a valid approach for importing XML object definitions. XML imports are commonly used to move IdentityIQ configuration objects such as rules, workflows, applications, roles, policies, email templates, task definitions, and other SailPoint objects between environments. Engineers may also use the IdentityIQ console for imports, especially for larger or automated deployments, but the existence of the console method does not make the UI method invalid. The proposed solution is specifically asking whether selecting a file through Global Settings > Import From File is a valid step, and it is. The important caution is that imported XML should be reviewed carefully because object names, IDs, references, and environment-specific values can affect behavior after import. References/topics: IdentityIQ Engineer — XML object import/export, Global Settings import, configuration migration, deployment management.

This statement is correct. IdentityIQ uses rule types and rule metadata to guide engineers when creating or editing rules. The Rule Registry describes expected rule behavior, including contextual information such as the rule’s purpose, expected inputs, and often the intended output or return behavior. This is important because IdentityIQ rules are not generic scripts running in isolation; they execute in specific product contexts such as aggregation, correlation, provisioning, workflow, certification, policy evaluation, or lifecycle processing. The rule editor can expose information derived from the rule registry so that an engineer understands which variables are available and what the rule is expected to return. This reduces implementation errors, especially in DOMC-style topics where a wrong return type or missing context variable can cause runtime failures. The Word bank separately confirms that the BeanShell rule editor lists typical input variables based on the rule registry. References/topics: IdentityIQ Engineer — Rule Registry, BeanShell rule editor, rule metadata, expected inputs, expected outputs.

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.

Rapid Setup does allow for specifying account correlation by mapping an identity attribute to an account attribute. This is a standard part of the onboarding process where you define how IdentityIQ should correlate accounts to identities. This basic mapping functionality is included in Rapid Setup to facilitate straightforward account correlation during application onboarding.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Mapping Sections)

An Application Owner Certification is primarily used to certify entitlements and roles associated with specific applications. It involves application owners reviewing access within their applications, which is useful for ensuring that access aligns with the intended security policies for that application.

However, in the context of ensuring that roles include the correct entitlements across the entire role model, a more suitable certification type would be a Role Composition Certification. This type specifically focuses on validating the composition of roles, including the entitlements they aggregate.

Therefore, an Application Owner Certification will not fully achieve the goal of ensuring all roles include the correct entitlements. The correct answer is B. No.

This statement is not correct. IdentityIQ syslog event searching is not limited only to Incident Code lookups. Incident Code is useful when a user-facing error displays a code that can be traced back to a logged system event, but syslog analysis is broader than that. Administrators and engineers use syslog data to investigate operational errors, workflow failures, connector issues, provisioning errors, aggregation failures, authentication problems, and application exceptions. Advanced Analytics and log-search capabilities are intended to help filter and locate system events using more than a single incident-code value. Treating Incident Code as the only searchable attribute would make syslog analysis nearly useless for routine troubleshooting where no user-facing incident code is available. The correct engineering view is that Incident Code is one important search key, not the exclusive search mechanism. References/topics: IdentityIQ Engineer — syslog search, Advanced Analytics, incident code troubleshooting, system-error diagnosis, operational logging.

No. The proposition incorrectly equates account ownership with the accounts personally held by the reviewer. Those are different relationships.

In ownership-based governance, the relevant question is which accounts or governed objects the reviewer is responsible for, not which target-system accounts belong to the reviewer ' s own identity. IdentityIQ explicitly supports ownership relationships independently from account possession. For example, account ownership can be assigned to another Identity, and targeted certifications can use an Owner filter to select accounts owned by specified identities.

Likewise, IdentityIQ ' s certification architecture generally routes reviews according to governance responsibility: an Application Owner reviews access to applications for which that person is responsible, an Entitlement Owner reviews identities holding entitlements the reviewer owns, and account-group reviews are driven by ownership of the corresponding governed objects. The reviewer need not personally possess that access.

Therefore, an ownership-based account certification is not limited to accounts that the certifier personally “holds.” Its purpose is to review accounts for which that identity has ownership/responsibility according to IdentityIQ ' s governance model.

References/topics: IdentityIQ Engineer — account ownership, certification ownership, targeted certification Owner filter, Application Owner certification, governance responsibility.

=======

No. Profile Class is explicitly an optional application configuration property. Its purpose is role modeling, not connectivity to Active Directory. A Profile Class allows multiple applications to be logically associated with a larger application class so a single role profile can apply across those applications.

For example, several similar application instances can share the same Profile Class so that role-detection logic does not require a separate profile for every individual instance. This can simplify enterprise role modeling, but it is not necessary for IdentityIQ to connect to Active Directory, aggregate accounts or groups, correlate accounts, perform certifications, or provision access.

SailPoint ' s Edit Application documentation describes Profile Class as an optional class used to associate an application with a larger set of applications for role-modeling purposes. This differs fundamentally from required connector configuration such as application identity, schema, forest/domain information, and authentication details.

An engineer may therefore configure Profile Class when the organization ' s role model requires it, but an Active Directory application can be successfully configured and operated without one.

References/topics: IdentityIQ Engineer — Profile Class, Application Definition, role modeling, Active Directory connector, optional application properties.

=======

Syslog is not intended for querying or identifying specific objects, such as all Link objects from a particular application. Syslog is used to record events and log information related to system activities, errors, and operations. To identify all Link objects from a particular application, you would use IdentityIQ ' s internal search functionality or reports that allow you to filter and retrieve such objects. These tasks involve querying the database and application-specific data structures rather than examining log files.

SailPoint IdentityIQ Administration Guide (Section on Objects and Searching)

SailPoint IdentityIQ Configuration Guide (Understanding Link Objects)

Yes. Reusing appropriate standard Lifecycle Manager subprocesses is a sound IdentityIQ workflow-design practice because those subprocesses encapsulate established processing for common lifecycle and provisioning operations. Building every custom provisioning workflow entirely from scratch duplicates tested logic and makes future maintenance substantially harder.

SailPoint describes subprocess workflows as a way to divide complex workflows into smaller components that are easier to manage and can be reused by multiple master workflows. Standard LCM workflows make extensive use of this pattern for initialization, approval processing, provisioning, policy checking, identity-request handling, notifications, and related activities. A custom workflow can call an existing subprocess and provide the input/control variables required by that subprocess.

However, “as much as possible” does not mean blindly invoking every standard LCM subprocess. The engineer must understand the subprocess contract, including expected inputs, returned values, workflow variables, provisioning-plan assumptions, and release-specific behavior. Custom logic should only replace or extend standard processing when business requirements genuinely require it.

Therefore, leveraging standard LCM subprocesses where their behavior fits the requirement is a valid best-practice approach.

References/topics: IdentityIQ Engineer — LCM workflows, subprocess reuse, reusable business processes, workflow variables, provisioning customization.

=======

Yes, defining account correlation via a rule is an action that can be performed as part of configuring an application definition in SailPoint IdentityIQ. Account correlation rules are often used to determine how accounts from different sources are linked to identities within IdentityIQ. These rules allow for complex logic to be applied when matching accounts to identities, beyond simple attribute matching.

SailPoint IdentityIQ Administration Guide (Section on Account Correlation)

SailPoint IdentityIQ Application Configuration Guide (Using Rules for Account Correlation)

A Role Membership Certification is appropriate for this requirement because the hospital is trying to confirm that users assigned to a role are correct. The test is not about whether the role contains the right entitlements; that would point to Role Composition Certification. It is also not primarily about application ownership or account group membership. The wording says the business analysts want to verify the role assignment rules by certifying the users who have been assigned the role. That maps directly to a membership review: who is in the role, whether each membership is valid, and whether the assignment rule is producing the expected population. The security team can be configured as the certifier, final reviewer, or sign-off participant depending on certification ownership and sign-off configuration. Therefore, the proposed certification type achieves the stated goal. References/topics: IdentityIQ Engineer — Role Membership Certification, role assignment rules, certification ownership, sign-off, access review routing.

Yes, the Provisioning tab under the " Administrator Console " in IdentityIQ can be used to view the specific operations on each attribute being provisioned. This tab provides detailed visibility into the provisioning operations, including which attributes are being modified, created, or removed as part of the provisioning process. This is essential for administrators to monitor and troubleshoot provisioning tasks.

SailPoint IdentityIQ Administration Guide (Provisioning Tab Overview)

SailPoint IdentityIQ Provisioning Guide