IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Free Practice Exam Questions (2026 Updated)

The purpose of an IdentityIQ certification is not to attest to a user ' s integrity. Certifications in IdentityIQ are designed to review and verify user access rights to ensure they are appropriate based on roles, policies, and organizational rules. The focus is on access management rather than personal qualities like integrity.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

In SailPoint IdentityIQ, certain objects, such as the Link object, cannot be directly extended by updating the corresponding .HBM (Hibernate Mapping) file. Modifying or extending core IdentityIQ objects typically requires a deeper level of customization involving the extension of the application schema and possibly custom Java code. The .HBM files are part of IdentityIQ ' s internal persistence framework, and altering them is not a supported or recommended method for extending objects in a production environment. Customization should instead be done using SailPoint’s supported extension points, such as using ManagedAttributes or CustomAttributes within the IdentityIQ application framework. For guidelines on extending IdentityIQ objects, refer to the SailPoint IdentityIQ Customization Guide and best practices documentation.

Top of Form

Bottom of Form

A Role Composition Certification is specifically designed to ensure that roles are composed correctly by reviewing the entitlements and other roles they aggregate. This certification allows reviewers to verify whether the roles include the appropriate entitlements based on business needs and compliance requirements.

Given that the bank ' s objective is to ensure that all roles include the correct entitlements, a Role Composition Certification is the most appropriate tool to achieve this goal. It allows for the comprehensive review and validation of roles and their associated entitlements, ensuring alignment with the overall access governance strategy.

Therefore, the correct answer is A. Yes.

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

The statement that " All certifications include generation, the active period, sign-off, and the end period " is true. These stages are fundamental to the certification process in SailPoint IdentityIQ:

Generation: This is the initial stage where the certification campaign is created. During this phase, the system generates the list of items (such as access, roles, or entitlements) that need to be reviewed.

Active Period: Once the certification is generated, it enters the active period. During this time, the designated reviewers are responsible for examining the items in the certification, making decisions (such as approving or revoking access), and providing any necessary comments.

Sign-off: After the active period, the certification moves into the sign-off stage. Here, the final approver(s) review the decisions made during the active period and formally approve or reject the certification outcomes.

End Period: Finally, the end period marks the conclusion of the certification campaign. The certification is closed, and the results are archived. Any necessary actions, such as revoking access or triggering workflows based on the certification decisions, are implemented.

These stages are essential to the structured process that ensures all access rights are properly reviewed and either maintained or adjusted according to the organization ' s policies.

SailPoint IdentityIQ Certification Administrator ' s Guide

SailPoint IdentityIQ Certification Process Documentation

SailPoint IdentityIQ Administration Guide (Sections on Certification Lifecycle and Workflow)

This statement is false. BeanShell rules in IdentityIQ do not universally have to produce a meaningful output. A rule’s expected return behavior depends on the rule type and the context in which the rule is executed. Some rules are designed to return a Boolean, String, Map, ProvisioningPlan, Identity, or another object. Other rules perform side effects, such as modifying a plan, transforming values, logging, altering an object, or executing validation logic, and may return null or no useful result. The Word bank contains a related but different rule-output concept: a BeanShell rule does not always need to return an object derived from sailpoint.object.SailPointObject; it may return several other object types or null. The proposed statement is even broader and still incorrect because IdentityIQ rule output is rule-type dependent, not mandatory in a generic sense. References/topics: IdentityIQ Engineer — BeanShell rules, rule registry, return values, rule execution context, input/output contracts.

Yes. IdentityIQ role configuration can support conditional role requestability and assignment logic. A role does not have to be universally requestable for every identity. Engineers can restrict role availability through role configuration, assignment logic, population rules, request controls, or related role requirements depending on the implementation design. The proposed solution describes a role that can only be requested if the target user already has a related role. That is a valid access-governance pattern because role models often contain dependency relationships, prerequisites, or related-role structures. For example, a business role may make another IT role or application role meaningful only when the identity already satisfies a prerequisite access condition. This type of restriction prevents users from requesting access that is inappropriate outside a defined role relationship. The important engineering point is that IdentityIQ roles are not just static entitlement containers; they can include assignment rules, profiles, permitted/requestable behavior, and relationships that influence when they are visible or eligible during access requests. References/topics: IdentityIQ Engineer — role model design, requestable roles, role relationships, assignment rules, access-request governance.

This is a valid step, with the typo corrected as “create the audit event.” Registering an AuditAction in AuditConfig only defines the custom event type; IdentityIQ still needs executable logic to actually write the audit event when the relevant condition occurs. That logic can be placed in a BeanShell rule, task, workflow step, or other appropriate execution point depending on the business process being audited. The code must create/populate the audit record with the configured action name and the relevant data values, such as target identity, actor, source object, application, attribute values, or other fields needed by the later report. Without this implementation logic, the custom audit action would exist but no audit records would be generated. Therefore, writing the logic to create the audit event is a legitimate step in the end-to-end process. References/topics: IdentityIQ Engineer — BeanShell audit logic, workflow audit events, custom AuditAction usage, audit data population, custom audit reporting.

Yes, specifying which access items may be requested can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In IdentityIQ, control variables within LCM workflows allow administrators to define the scope and criteria for access requests, including restricting or specifying which entitlements, roles, or applications can be requested by users. This is part of the request configuration process, where the access items that users can see and request are defined.

Therefore, the correct answer is A. Yes.

This scenario describes an employee quitting their job and needing all of their accounts disabled, which aligns with a leaver lifecycle event rather than a mover event. A leaver event typically involves the deactivation of accounts and removal of access for users who are leaving the organization entirely, whereas a mover event involves changes to roles or access as part of an internal transition (e.g., promotion, transfer).

Therefore, the correct answer is B. No.

This proposed solution is incorrect. A create-type lifecycle event trigger is used when a new identity is created or first detected in IdentityIQ. The requirement is not about a new identity; it is about an existing identity whose Division attribute changes from IT to Senior IT. That is an update or attribute-change scenario. A create event would not reliably fire when an existing user’s Division attribute is modified during aggregation or identity refresh. It also does not address the second required condition: the user must be a manager. The correct approach must detect the specific attribute transition and then evaluate the manager condition. Using a create trigger would either never launch the workflow for the intended case or launch it only at identity creation time, which is outside the stated requirement. This is a basic but important lifecycle-event design distinction: joiner/create events are not substitutes for mover or attribute-change events. References/topics: IdentityIQ Engineer — lifecycle events, create triggers, attribute-change triggers, mover events, identity refresh processing.

Reassigning all object ownership to a user’s manager during Leaver and Termination events is a complex process that typically involves custom logic or workflows to ensure that all owned objects (like access, certifications, roles, etc.) are correctly reassigned.

The Rapid Setup interface is primarily designed for standard lifecycle management tasks, such as role assignments, account enabling/disabling, and certifications. It does not inherently support the automatic reassignment of object ownership based on lifecycle events such as Leaver and Termination events.

This kind of reassignment would typically require a custom rule or workflow to track and reassign all owned objects, which falls outside the scope of what Rapid Setup can handle directly. Therefore, the correct answer is B. No.

This proposed solution is not correct. In IdentityIQ, features and functional access are controlled primarily through capabilities, not scopes. Capabilities determine whether a user can perform administrative or functional actions such as managing identities, accessing reports, configuring applications, launching tasks, or using privileged pages. Scopes, by contrast, are generally used to restrict which objects or data a user can see or act upon. For example, a scoped administrator may only be able to view or administer identities, applications, or work items within an assigned organizational boundary. That is object/data visibility control, not feature enablement. Saying that scopes control “the features that are used” confuses two different authorization layers. The correct IdentityIQ distinction is: capabilities control functional permissions, while scopes constrain object access boundaries. References/topics: IdentityIQ Engineer — authentication, authorization, capabilities, scopes, delegated administration.

The scenario describes triggering a workflow when a " Division " attribute changes from a specific value to " Senior IT, " but only when the user is a manager. The proposed solution suggests creating a trigger with an event type of " rule " that checks the previous and new values of the " Division " attribute.

However, this approach has a couple of issues:

Trigger Configuration: In SailPoint IdentityIQ, a lifecycle event trigger typically operates on changes in identity attributes, but it’s not standard to define this trigger using a rule that directly inspects the previous and new values. Instead, the lifecycle event would usually be configured in the context of the application or identity to directly listen to specific changes without needing to define the logic in a custom rule.

Condition Validation: The condition of checking if the user is a manager should ideally be integrated within the workflow itself or the lifecycle event configuration, not just as part of a rule in the trigger.

While a rule can be used to define complex conditions, the correct way to implement this in IdentityIQ would involve setting up the lifecycle event trigger specifically for the attribute change and managing any additional conditions (like checking if the user is a manager) within the workflow or using an appropriate script/rule in that context.

Therefore, while partially correct in approach, the described solution is not the best practice or a valid process in IdentityIQ, so the correct answer is B. No.

This statement is not correct. IdentityIQ syslog event searching is not limited only to Incident Code lookups. Incident Code is useful when a user-facing error displays a code that can be traced back to a logged system event, but syslog analysis is broader than that. Administrators and engineers use syslog data to investigate operational errors, workflow failures, connector issues, provisioning errors, aggregation failures, authentication problems, and application exceptions. Advanced Analytics and log-search capabilities are intended to help filter and locate system events using more than a single incident-code value. Treating Incident Code as the only searchable attribute would make syslog analysis nearly useless for routine troubleshooting where no user-facing incident code is available. The correct engineering view is that Incident Code is one important search key, not the exclusive search mechanism. References/topics: IdentityIQ Engineer — syslog search, Advanced Analytics, incident code troubleshooting, system-error diagnosis, operational logging.

An Account Group Membership Certification is designed to certify group memberships within accounts, typically focusing on the validation of access within specific account groups (e.g., Active Directory groups).

This type of certification does not directly address the accuracy of role composition or the correctness of entitlements assigned within roles. Since the bank ' s goal is to ensure that all roles include the correct entitlements, an Account Group Membership Certification is not suitable for this purpose.

Thus, the correct answer is B. No.

No. The Environment tab in the IdentityIQ Administrator Console is not used to start or stop a particular application server. Starting and stopping an application server is an infrastructure-level operation handled by the application-server platform, operating system service manager, container orchestration layer, or hosting environment. IdentityIQ can display environment and runtime information, but it does not replace WebLogic, Tomcat, JBoss/WildFly, systemd, Windows Services, Kubernetes, or other server-control mechanisms. This distinction matters because engineers must not assume IdentityIQ UI controls can manage the underlying Java application server lifecycle. The Environment area is for visibility and administrative inspection, not for controlling server process state. To restart or stop a node, the engineer must use the proper server administration tool and follow clustered-environment procedures to avoid disrupting tasks, workflow execution, aggregation, provisioning, or user sessions. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, application server administration, clustered deployment operations, runtime monitoring.

Export CSV / Import CSV is not a valid action for a policy violation owner when acting on an individual Account Policy violation. In IdentityIQ, a policy violation owner is expected to resolve or manage the violation through violation-handling actions such as allowing, mitigating, remediating, forwarding, or otherwise taking governance action depending on configured permissions and workflow. Exporting or importing CSV files is an administrative or bulk-data activity, not a violation-disposition action. An Account Policy violation normally relates to a condition such as a user having more accounts than permitted on an application or system. The Word bank describes Account policies as policies that limit the number of accounts users may have on a given system. Acting on that violation requires a compliance decision or remediation path, not a CSV operation. Therefore, this proposed solution is not a valid policy-violation owner action. References/topics: IdentityIQ Engineer — Compliance Manager, policy violations, Account Policy, violation remediation, policy owner actions.