IdentityIQ-Engineer SailPoint Certified IdentityIQ Engineer Free Practice Exam Questions (2026 Updated)

Yes. A Manager Correlation Rule is specifically intended for situations where IdentityIQ must establish the manager/direct-report relationship but a straightforward attribute-to-attribute mapping is insufficient. In a simple implementation, IdentityIQ can correlate an application attribute containing the manager identifier directly to an identity attribute. Here, however, the organization has inherited several employee-number formats through mergers. That requires normalization, transformation, conditional comparison, or other custom matching logic before the manager identity can be resolved.

SailPoint explicitly documents that Manager Correlation normally uses an application attribute and an identity attribute, but when the matching requirement is more complex than a simple field match, a Manager Correlation Rule can implement the correlation programmatically. The rule can normalize the different employee-number formats, generate appropriate comparison values, search for the matching Identity object, and return the manager relationship required during identity processing. A normal account Correlation Rule addresses account-to-identity correlation and is therefore not the precise rule type for this requirement.

References/topics: IdentityIQ Engineer — Manager Correlation Rule, authoritative-source aggregation, Identity Cube manager relationships, complex correlation logic, Application Definition Rules.

=======

This proposed solution is not valid as written. The stem says the engineer needs to create a custom audit event and set up an associated report. The proposed XML fragment is an ObjectAttribute definition for an attribute named userType; it is not an AuditAction definition. An ObjectAttribute entry is used in object configuration contexts to describe an attribute’s display, edit behavior, extended number, name, and type. That does not define a new audit action/event in the AuditConfig object. A proper audit event definition would use an AuditAction element or equivalent AuditConfig configuration identifying the audit action name, display name, and enabled state. Because the XML fragment shown does not create a custom audit action, it cannot satisfy the required step. This is exactly the kind of syntax-level distinction an IdentityIQ engineer must catch: correct object type and correct XML element matter. References/topics: IdentityIQ Engineer — AuditConfig XML, AuditAction definition, ObjectAttribute configuration, custom audit event setup.

The configuration option " Comment Character " is not required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Comment Character " option is generally used for handling comment lines in flat files or CSV file-based connectors. Since SCIM 2.0 is a RESTful API-based protocol designed for managing identities in a standardized way, this option does not apply to SCIM 2.0 integrations. Therefore, it is not a necessary configuration when working with SCIM 2.0 applications.

SailPoint IdentityIQ SCIM 2.0 Integration Guide

SailPoint IdentityIQ Application Configuration Guide (SCIM and REST API sections)

In SailPoint IdentityIQ, certain objects are designed to be extended by updating their corresponding Hibernate Mapping (.HBM) files. However, the WorkItem object is not one of these extendable objects. The WorkItem is a system object that primarily represents tasks or actions that need to be processed within the workflow. It is not intended to store client-specific data through direct modification of its .HBM file. Instead, client-specific data should be handled using other mechanisms, such as custom attributes or the extension of Identity or Account objects. Attempting to modify the WorkItem object ' s HBM file could lead to unexpected behavior and is not supported by SailPoint ' s best practices.

Yes. Out-of-the-box LCM workflows commonly support configurable notification behavior, and email templates can be selected or referenced through workflow variables, arguments, or workflow configuration. IdentityIQ workflows use email templates to generate notification content for approvals, requests, provisioning outcomes, policy violations, reminders, and other lifecycle events. The ability to control which template is used allows implementers to customize communications without rewriting the whole workflow. This is a valid use of workflow configuration because the workflow is responsible for sending or triggering notifications during lifecycle processing. The engineer still needs to ensure the referenced EmailTemplate object exists, contains the correct variables for the workflow context, and is suitable for the intended recipient. But conceptually, specifying the email template for notifications is exactly the type of behavior that can be controlled through LCM workflow configuration rather than through application schema or identity-attribute configuration. References/topics: IdentityIQ Engineer — LCM workflow variables, EmailTemplate objects, notification configuration, approval emails, workflow-controlled messaging.

No. Whether an application supports password change requests through the IdentityIQ UI is not controlled by generic LCM workflow control variables. Password-change support depends on the application connector’s capabilities, password-management configuration, application settings, schema/support for password operations, policies, and QuickLink/user-interface configuration. The workflow may process or route a password-change request once launched, but it does not define which target applications support that operation. That capability must be configured at the application/connector and password-management layer. Mixing these layers would create a brittle design: workflow variables should govern execution behavior, while application configuration defines available account operations. Therefore, the proposed solution is not achievable merely by configuring out-of-the-box LCM workflow control variables. References/topics: IdentityIQ Engineer — password management, application connector capabilities, LCM workflows, QuickLink password change, account operation support.

Inserting the " Managers " QuickLink population as the dynamic scope in the QuickLink object is a valid step when creating a custom QuickLink that should only be accessible by managers. QuickLink populations are used to define which users have access to specific QuickLinks based on criteria like role, department, or other attributes. By assigning the " Managers " population, only users who are members of that population will see and be able to launch the QuickLink.

Therefore, the correct answer is A. Yes.

Yes. IdentityIQ ' s Debug Logging functionality provides diagnostic information about the active logging configuration, including information associated with the currently loaded Log4j configuration. This is useful because troubleshooting IdentityIQ commonly requires an engineer to determine not merely what log level is active, but which logging configuration is actually being used by the running application .

That distinction matters in application-server environments where multiple configuration files, deployment paths, classpath resources, customized Log4j configuration, or node-specific settings may exist. Editing the wrong file produces no effective logging change and can waste substantial troubleshooting time.

The Debug Logging interface is also associated with runtime logger inspection and temporary adjustment of logging levels. However, engineers should treat runtime debug logging carefully: enabling DEBUG or TRACE for broad packages can produce significant log volume and performance impact. Persistent configuration changes should be made through the supported logging configuration and change-control process rather than assuming a runtime debug change permanently modifies the source configuration.

Therefore, the proposition that the Debug Logging page can identify the location of the currently loaded Log4j file is valid.

References/topics: IdentityIQ Engineer — Debug Logging, Log4j configuration, runtime logging levels, troubleshooting, application-server logging.

=======

Adding a new object attribute to the Application ObjectConfig in IdentityIQ is not sufficient on its own to generate the database script needed to extend Application attributes. This action updates the configuration within IdentityIQ for how the application object is managed, but it does not produce the necessary SQL scripts to modify the underlying database schema. The actual database schema must be extended using specific IdentityIQ tools and commands like iiq extendedSchema.

SailPoint IdentityIQ Configuration Guide (ObjectConfig and Schema Management)

SailPoint IdentityIQ Administration Guide (Database Schema Extension)

Yes. IdentityIQ uses message-catalog properties to supply a large amount of user-interface text rather than hard-coding every label directly into individual pages. In traditional IdentityIQ deployments, the iiqMessages resource files contain message keys and their displayed text. Changing or overriding the relevant message key is therefore a standard mechanism for customizing labels, prompts, descriptions, placeholders, and other localized UI strings.

A safer customization pattern is generally to place customer-specific overrides into the appropriate custom message properties file rather than directly altering the SailPoint-delivered base resource, because base files can be replaced during an upgrade. This also supports internationalization because locale-specific message catalogs can provide different values for the same key.

For example, IdentityIQ certification screens, access-request pages, login-related messages, and general interface labels frequently resolve displayed strings through message keys. SailPoint ' s internationalization and templating mechanisms likewise retrieve translated values from message catalogs.

Therefore, the statement that iiQMessages files can be used to change text labels is valid.

References/topics: IdentityIQ Engineer — message catalogs, iiqMessages.properties, iiqCustom.properties, localization, UI labels and branding.

=======

No. The proposed XML is not correct because the reference class is wrong. In IdentityIQ, rule libraries are represented through rule objects used as reusable BeanShell libraries. When a rule references a common library, the referenced object should be a Rule object, not a nonstandard sailpoint.object.RuleLibrary class. The correct pattern is to reference the library as a rule by name under the rule’s referenced-rules section. Rule libraries allow shared methods and reusable code to be included across multiple rules, which is important for reducing duplication and maintaining consistent logic. However, XML object references must use the correct IdentityIQ object class. If the class does not correspond to the persisted object type, the import or runtime resolution can fail. The concept of referencing a common rules library is valid, but this specific code is not. References/topics: IdentityIQ Engineer — Rule libraries, ReferencedRules XML, Rule object references, BeanShell code reuse, XML object configuration.

Not all Application objects in SailPoint IdentityIQ must have an Identity object as the owner. While it is common practice to assign an owner to an Application object for governance and administration purposes, it is not a strict requirement. Applications can exist without a direct association to an Identity object. The ownership concept in IdentityIQ is more of a best practice for accountability rather than a mandatory attribute. Refer to the SailPoint IdentityIQ Application Definition Guide for more information on the configuration and management of Application objects.

SMTP Port is a required mail configuration value for successful SMTP communication. IdentityIQ must know not only the mail server host but also the network port used to connect to that SMTP service. Common SMTP ports include 25, 465, or 587 depending on whether the environment uses unauthenticated SMTP relay, SSL/TLS, or STARTTLS. Without the port, IdentityIQ cannot reliably establish the socket connection to the mail server, even if the hostname and credentials are correct. Email notification is used heavily across IdentityIQ processes, including workflow approvals, certification reminders, lifecycle events, policy violations, provisioning notifications, and work-item escalation. Therefore, SMTP connectivity settings must be complete and accurate. SMTP Port is not merely cosmetic; it is part of the transport configuration required for IdentityIQ to communicate with the mail infrastructure. References/topics: IdentityIQ Engineer — email notification setup, SMTP server configuration, mail host and port, workflow and certification notifications.

The solution provided is incomplete. To create a custom audit event and set up an associated report, the process involves several steps, including defining the custom audit event in the Audit Configuration object, updating or creating relevant audit triggers in the system, and defining the custom report using XML or the IdentityIQ report editor. The steps mentioned in the solution do not cover the necessary configuration and implementation details required for this task. For a complete process, consult the SailPoint IdentityIQ Reporting Guide and the Audit Framework documentation.

Yes. A Boolean datatype is appropriate because the stated purpose is to flag privileged accounts . A flag normally represents a binary condition: the account either satisfies the privileged-account criteria or it does not. Consequently, true and false accurately represent the resulting classification.

The engineer can derive this Boolean from the Financial application ' s privileged attribute and/or calculate the result through logic involving the Keystore application ' s responsibility-code attribute. Once populated, the Boolean value can be referenced reliably from rules and policy conditions and can participate in searchable/analytics configuration when the associated attribute is configured appropriately.

This distinction also resolves the earlier Attribute Type: string proposition. A String could technically hold textual values, but the requirement here is specifically a Boolean privilege flag. Therefore, for this DOMC scenario, Boolean is the configuration that matches the requirement , while String should be answered No.

The bank already tests source mapping and edit mode for the same scenario but does not contain this Boolean proposition.

References/topics: IdentityIQ Engineer — account schema, Boolean attributes, privileged-account classification, source mapping, rules, policies.

=======

Yes. IdentityIQ role configuration can support conditional role requestability and assignment logic. A role does not have to be universally requestable for every identity. Engineers can restrict role availability through role configuration, assignment logic, population rules, request controls, or related role requirements depending on the implementation design. The proposed solution describes a role that can only be requested if the target user already has a related role. That is a valid access-governance pattern because role models often contain dependency relationships, prerequisites, or related-role structures. For example, a business role may make another IT role or application role meaningful only when the identity already satisfies a prerequisite access condition. This type of restriction prevents users from requesting access that is inappropriate outside a defined role relationship. The important engineering point is that IdentityIQ roles are not just static entitlement containers; they can include assignment rules, profiles, permitted/requestable behavior, and relationships that influence when they are visible or eligible during access requests. References/topics: IdentityIQ Engineer — role model design, requestable roles, role relationships, assignment rules, access-request governance.

Yes. IdentityIQ supports certain UI branding customizations, but product attribution requirements still matter. If a customer removes SailPoint branding from a prominent UI location such as the header bar, the product attribution should still be preserved elsewhere, such as in the copyright footer with wording like “Powered by SailPoint IdentityIQ.” This reflects the distinction between cosmetic branding changes and removal of required product identification. From an engineering standpoint, UI customization should be implemented carefully so it survives upgrades as much as possible and does not violate branding, licensing, or support expectations. Teams should also document all branding changes because customized UI files are commonly impacted during upgrades and patching. The proposed statement is valid because it preserves SailPoint product attribution while allowing the customer to modify the visible header branding. References/topics: IdentityIQ Engineer — UI customization, branding requirements, copyright footer, upgrade-safe customization, customer-specific UI changes.

Yes, this statement is true. The default language of IdentityIQ can be changed from English by replacing the appropriate message files. Administrators can modify or replace the default English message files with those for another language, which will then become the system’s default language. This allows IdentityIQ to be localized according to the organization ' s language preferences.

SailPoint IdentityIQ Localization Guide

SailPoint IdentityIQ Administration Guide (Language Settings and Message File Management Sections)

Yes. A ManagedAttribute represents managed access originating from an IdentityIQ application—for example an entitlement value, account group, or permission. Consequently, its definition includes an association with the Application object that supplies or owns that managed access.

The Entitlement Catalog makes this relationship explicit. For each managed attribute, IdentityIQ displays an Application property identifying the application associated with the attribute. The remaining ManagedAttribute metadata—such as Type, Attribute or Target, Value, owner, requestability, classifications, and associated roles—is interpreted within that application ' s schema and governance context.

This relationship is important because identical entitlement values can exist on different systems but represent completely different access. IdentityIQ therefore requires application context to uniquely and correctly interpret the entitlement. For example, a value called Administrators on one Active Directory application is not inherently the same governed entitlement as Administrators on another target.

A ManagedAttribute can participate in roles, certifications, requests, classifications, and policy evaluation, but those governance relationships do not remove its underlying application association.

References/topics: IdentityIQ Engineer — ManagedAttribute object, Application object, Entitlement Catalog, managed entitlements, application schemas.

=======