IdentityNow-Engineer SailPoint Certified IdentityNow Engineer Free Practice Exam Questions (2025 Updated)

No, the statement "This item is complete" is vague and does not represent any actionable configuration when implementing a JDBC connector. An IdentityNow engineer needs to focus on specific technical configurations like setting up schemas, defining SQL queries, mapping attributes, and ensuring the correct service account permissions. Simply stating "This item is complete" is not a valid step in the implementation process.

References:

SailPoint IdentityNow JDBC Connector Implementation Checklist.

SailPoint IdentityNow Configuration and Implementation Documentation.

No, an SoD (Separation of Duties) policy does not require a control matrix to be defined. While a control matrix can be a useful tool for organizations to visualize and enforce SoD policies by mapping roles to potential conflicting access rights, it is not a mandatory component of an SoD policy. An SoD policy primarily focuses on preventing conflicts of interest by ensuring that no individual has access to perform conflicting tasks within a business process (e.g., approving and processing payments). The control matrix is a recommended method for managing SoD but not a requirement.

Key Reference from SailPoint Documentation:

SoD Policy Overview: SailPoint recommends structuring SoD policies to focus on preventing conflicting access but does not mandate the use of a control matrix, which is an optional best practice for visualizing these controls.

By default, not all emails generated from a SailPoint IdentityNow tenant are sent directly to the intended recipient. SailPoint IdentityNow provides an email testing mode (sandbox mode) where emails generated from the platform, such as access request notifications or password reset messages, can be routed to a specified test recipient instead of the actual intended users. This feature is commonly used during implementation or testing phases to verify email content and delivery without impacting real users.

Once the system is out of the testing phase and the email routing rules are removed, emails will be sent directly to their intended recipients. This ensures that email communications during testing do not reach end users prematurely.

Key Reference from SailPoint Documentation:

Testing Mode for Email Routing in IdentityNow: IdentityNow allows administrators to configure an email routing setting where all emails can be sent to a test inbox to ensure that email communications are functioning properly before going live to end users.

Yes, SailPoint IdentityNow's versioned APIs are fully supported. SailPoint uses versioning in their APIs to ensure backward compatibility, allowing clients to continue using older API versions while newer versions are introduced with additional features and improvements. Versioning helps maintain stability for applications that depend on the APIs.

Key Reference from SailPoint Documentation:

API Versioning: SailPoint IdentityNow provides support for versioned APIs, allowing developers to choose specific versions of the API, which are fully maintained and supported, to prevent breaking changes in integrations.

The configuration provided is not valid due to an error in the server specification for Domain B. The server for Domain B (domainb.com) is incorrectly set to server.domaina.com, which is not correct. Each domain in the Active Directory (AD) forest should have its own respective server. For Domain B, the correct server should be something like server.domainb.com, assuming that there are distinct domain controllers for each domain.

Additionally, the search DN for Domain A appears to be valid as it correctly filters for employees with (employeeType=employee). The search DN for Domain B seems to be partially correct, as it targets the OU=Contingent Workers, but the issue lies with the incorrect server assignment.

Key Reference from SailPoint Documentation:

Active Directory Configuration: Each domain in a forest should be connected to its respective server, and incorrect server assignments between domains can cause LDAP search and synchronization issues. Proper domain controller assignment for both domaina.com and domainb.com is required.

No, custom connectors are not developed and compiled inside IdentityNow. Custom connectors are typically developed outside of the IdentityNow platform using a development environment and then tested and packaged before being uploaded to the platform. These connectors can be developed using tools provided by SailPoint, but the actual development process occurs externally, not directly within the IdentityNow environment.

Key Reference from SailPoint Documentation:

Custom Connector Development: Custom connectors are developed outside of the IdentityNow platform and then integrated into it for use.

Yes, this correctly describes Manager Correlation in SailPoint IdentityNow. Manager Correlation is the process of linking the manager of a given identity based on the value of an attribute in an account or identity profile, such as an employee's manager attribute. This allows the system to automatically identify and associate the correct manager for an identity, which can be important for tasks like access approvals and certification reviews.

Key Reference from SailPoint Documentation:

Manager Correlation Process: Manager correlation involves linking an identity to its manager based on specific attributes in the identity or account, such as the managerId or similar fields.

Yes, the Active Directory connector can run on the Virtual Appliance (VA). The VA is responsible for hosting connectors that communicate with various target systems, including Active Directory. The connector establishes the communication between IdentityNow and the target Active Directory instance for operations such as provisioning, deprovisioning, and account synchronization. The VA acts as the bridge between IdentityNow's cloud service and the on-premises AD environment, enabling secure communication through the connector.

References:

SailPoint IdentityNow Active Directory Connector Configuration Guide.

SailPoint IdentityNow Virtual Appliance Architecture and Setup Documentation.

No, the provided steps are not correct. The sequence of actions is misplaced:

Step 1: Before clicking "Test Connection," you need to download or procure the VA image and import it into the virtualization platform.

Step 6: After logging in and changing the password, the next step is to configure the networking settings, not downloading the image again.

Step 12: After uploading the config.yaml, you should proceed with testing the connection to ensure the VA is correctly configured and can communicate with IdentityNow.

Corrected Steps:

Download / procure the VA image.

Configure networking configurations (as needed).

Click Test Connection on the VA configuration.

References:

SailPoint IdentityNow Virtual Appliance Installation and Configuration Guide.

SailPoint IdentityNow Virtual Appliance Test Connection Documentation.

The use case describes a user logging into IdentityNow via an external identity provider’s login, where information is exchanged via federation. This correctly aligns with the concept of passthrough authentication.

Passthrough authentication often uses protocols like SAML (Security Assertion Markup Language) or OAuth for federation. In this case, the identity provider (IdP) handles the authentication and then passes the necessary authentication tokens or assertions back to SailPoint IdentityNow, granting the user access without directly requiring their password to be stored or authenticated by IdentityNow. This is a typical use case of federation and passthrough authentication.

References:

SailPoint IdentityNow Documentation on SAML and OAuth Federation.

SailPoint IdentityNow Federation and Passthrough Authentication Configuration Guides.

In an optimized aggregation, if an account has not changed since the last aggregation, the Virtual Appliance (VA) does not need to connect to the target system to retrieve that account’s information again. Optimized aggregation is designed to reduce the load on the system by skipping over accounts that have not been updated, thus preventing unnecessary data retrieval and improving performance.

During optimized aggregation, only accounts or data that have been modified or added since the last aggregation are retrieved. This efficiency is achieved by using timestamps or incremental updates to determine which data needs to be pulled from the target system.

References:

SailPoint IdentityNow Aggregation and Optimization Documentation.

SailPoint IdentityNow Virtual Appliance Configuration Guide for Aggregation.

Yes, the search syntax @accounts( source.name:"AD" AND state:"disabled" ) is correct, as it matches the necessary criteria for finding disabled AD accounts. This query searches for accounts in the AD source where the account state is set to "disabled," which effectively filters for the desired result.

Key Reference from SailPoint Documentation:

Correct Syntax for Disabled Accounts: The search correctly identifies accounts with a disabled state using this syntax.

SailPoint IdentityNow APIs are not authenticated using client certificates. Instead, they use OAuth 2.0 for secure authentication and authorization. API consumers are required to obtain an access token, which is used to authenticate requests made to the IdentityNow API. The token is typically obtained by sending client credentials (client ID and client secret) to the IdentityNow authorization server, which grants the token for API access.

Key Reference from SailPoint Documentation:

API Authentication: SailPoint IdentityNow uses OAuth 2.0 for API authentication rather than client certificates. Detailed steps on how to implement OAuth-based authentication are available in SailPoint’s API documentation.

Yes, "Create Account" is a valid operation type for the Web Services connector in SailPoint IdentityNow. The Web Services connector is designed to interact with REST or SOAP APIs, allowing it to perform operations such as account creation, updating, or deleting accounts on external systems. The "Create Account" operation is a standard function used when provisioning new identities to external applications or systems through the connector.

References:

SailPoint IdentityNow Web Services Connector Operations Guide.

SailPoint IdentityNow Web Services Connector API Provisioning Documentation.

SailPoint IdentityNow API documentation is indeed located at https://docs.sailpoint.com . This official documentation site contains all the information developers need to interact with IdentityNow through APIs. It includes guidelines on how to authenticate, make requests, and use the API endpoints to automate and integrate with other systems.

Key Reference from SailPoint Documentation:

SailPoint API Documentation: The site docs.sailpoint.com hosts the official API documentation for SailPoint IdentityNow, covering all aspects of using IdentityNow's APIs.

No, the OpenLDAP Connector is not suitable for this use case. OpenLDAP is designed for integrating with LDAP-based directories, and the system described is a cloud-based web application that uses a SCIM 2.0 interface with OAuth 2.0 for authentication. Since the system supports SCIM, the correct connector would be the SCIM 2.0 Connector, which is tailored for cloud-based systems with SCIM interfaces.

References:

SailPoint IdentityNow OpenLDAP Connector Guide.

SailPoint IdentityNow SCIM 2.0 Connector Documentation.

Yes, the file /etc/systemd/network/static.network (or a similarly named file depending on the Linux distribution used by the Virtual Appliance) is typically used to configure a static IP address for the VA. This file is part of the systemd network configuration, and modifying it allows you to specify static IP settings, such as the IP address, netmask, gateway, and DNS servers, for the Virtual Appliance's network interface.

To set a static IP address, you would need to modify this file and restart the network service for the changes to take effect.

References:

SailPoint IdentityNow Virtual Appliance Network Configuration Guide.

Linux systemd Network Configuration Documentation.

Yes, the fact that the disaster recovery (DR) VAs are not being utilized until a disaster recovery event occurs is a disadvantage. In this strategy, the DR VAs remain idle, leading to underutilization of resources. These VAs could otherwise handle workloads during normal operations to improve efficiency, distribute load, or reduce latency, especially if they are geographically closer to specific target systems. Relying on DR VAs only during failover scenarios limits their potential to optimize performance and balance loads in day-to-day operations.

References:

SailPoint IdentityNow Virtual Appliance Clustering and Disaster Recovery Documentation.

SailPoint IdentityNow High Availability and DR Strategies.

No, when deploying the Virtual Appliance (VA) in Azure, the IdentityNow engineer does not necessarily need to use the Azure CLI to deploy the VA image. While using the Azure CLI is one option, SailPoint provides multiple ways to deploy the VA in Azure, including using the Azure portal or ARM (Azure Resource Manager) templates. The process does not mandate using the CLI specifically.

Key Reference from SailPoint Documentation:

Azure VA Deployment Methods: SailPoint supports multiple methods for deploying the VA in Azure, including through the Azure portal or ARM templates, without requiring the CLI.