[UPDATED] SailPoint IdentityIQ-Associate Certification Exam Questions
Quickly and Easily Pass SailPoint Exam with IdentityIQ-Associate real Dumps
SailPoint IdentityIQ-Associate Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 25
Is this definition of Identity Cube accurate?
A snippet code containing custom business logic
- A. No
- B. Yes
Answer: A
Explanation:
No. This definition describes a rule more closely than an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the centralized identity model that represents a person or non-person identity inside IdentityIQ. It contains consolidated identity information such as identity attributes, correlated application accounts, assigned and detected roles, entitlements, manager relationship, lifecycle state, policy violations, certifications, and other governance-relevant data.
A "snippet of code containing custom business logic" refers to a BeanShell rule. Rules are executable logic used to customize IdentityIQ behavior in areas such as aggregation, correlation, provisioning, policy evaluation, workflow processing, and identity attribute transformation. They are configuration objects containing code, while Identity Cubes are data/model objects representing identities and their access.
Therefore, the statement is inaccurate because an Identity Cube is not custom code. It is the core identity record used by IdentityIQ for governance, access modeling, policy detection, requests, certifications, and provisioning decisions.
Reference topics: Identity Modeling, IdentityCube contents, identity attributes, correlated accounts, roles and entitlements, BeanShell rules, Foundational Concepts, and IdentityIQ object model.
NEW QUESTION # 26
Does this statement accurately describe how roles are acquired by users in the default role model configuration?
Business roles must be requested to be associated to identities.
- A. No
- B. Yes
Answer: A
Explanation:
No. The statement is too restrictive. In SailPoint IdentityIQ, business roles do not have to be requested in order to become associated with identities. A business role can be associated through access-request processing when the role is configured as requestable, but request submission is not the only acquisition path.
In the default role model, role association is maintained through IdentityIQ role evaluation and identity refresh behavior. Business roles may be assigned directly, assigned through administrative action, or associated through configured assignment logic. IdentityIQ then evaluates role relationships and updates the IdentityCube accordingly during refresh processing. By contrast, detected roles are commonly inferred from the access an identity already has, based on role profiles and entitlement conditions.
The important distinction is between requestable access and role association. Requestability controls whether users can ask for a role through Lifecycle Manager and QuickLinks. It does not mean the role can only be associated through a request. Therefore, "must be requested" is inaccurate.
Reference topics: Access Modeling, business roles, role assignment, detected roles, requestable roles, Identity Refresh, IdentityCube role data, and User-Driven Requests.
NEW QUESTION # 27
Does this statement accurately describe how roles are acquired by users in the default role model configuration?
The Perform Maintenance task adjusts role assignments to keep user access current.
- A. No
- B. Yes
Answer: A
Explanation:
No. In the default IdentityIQ role model, role acquisition and role recalculation are not handled by the Perform Maintenance task. Role assignment and detection are primarily evaluated during identity refresh processing. The Identity Refresh task can update IdentityCubes, evaluate role assignment rules or role profiles, refresh detected roles, process policy evaluations, and recalculate identity-related governance state. This is the mechanism that keeps role relationships aligned with current identity attributes and account access.
The Perform Maintenance task serves a different operational purpose. It is generally used for system maintenance and cleanup activities, not for determining whether a user should acquire or lose a role. It does not function as the default engine for adjusting role assignments based on changes such as department, job title, location, lifecycle state, or account entitlements.
Therefore, the statement is inaccurate. Keeping role acquisition current is associated with identity refresh and role evaluation logic, not the Perform Maintenance task.
Reference topics: Access Modeling, business roles, IT roles, role assignment, detected roles, Identity Refresh task, IdentityCube recalculation, and Foundational Concepts: tasks versus workflows.
NEW QUESTION # 28
Is this statement true for IdentityIQ application definitions?
Correlation logic can be specified for authoritative applications.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. In SailPoint IdentityIQ, correlation logic can be specified for authoritative applications. An authoritative application is commonly used as a trusted source for identity data, such as HR or another system of record. During aggregation, IdentityIQ reads account or source records from the application and uses correlation logic to determine whether each record should be linked to an existing IdentityCube or used in identity creation and update processing.
Correlation logic may be configured using account attributes, identity attributes, or correlation rules. For example, an authoritative source may correlate records by employee ID, user name, email address, or another unique identifier. This ensures that incoming authoritative data updates the correct identity instead of creating duplicates or leaving records uncorrelated.
The authoritative nature of the application does not eliminate the need for correlation. It defines the trust level and identity-data role of the source, while correlation defines how records from that source are matched to identities in IdentityIQ.
Reference topics: Applications, authoritative applications, correlation options, account aggregation, IdentityCube creation, identity attribute mapping, and uncorrelated account resolution.
NEW QUESTION # 29
Is this statement accurate about the BeanShell rules used in the aggregation process?
Rule processing can be disabled in the task definition.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. In SailPoint IdentityIQ, BeanShell rules used during aggregation are optional processing extensions, and task configuration can control whether rule processing is applied for a particular aggregation run. Aggregation itself is performed through the application definition, connector, schema, and aggregation task. Rules may be added to customize behavior, such as transforming incoming account data, applying custom correlation logic, handling identity creation, or modifying account information before it is stored.
Because rules can significantly affect aggregation behavior, IdentityIQ provides task-level controls that allow administrators to disable rule processing when appropriate. This can be useful for testing connector behavior, isolating troubleshooting scenarios, improving performance during certain runs, or validating source data without custom transformation logic. When rule processing is disabled, aggregation relies on standard connector and configuration behavior rather than custom BeanShell execution.
Therefore, the statement is accurate. Rule execution is not mandatory for aggregation and can be controlled from the task definition. Reference topics: Applications, aggregation tasks, BeanShell rules, connector configuration, account schema, correlation rules, creation rules, and aggregation task options.
NEW QUESTION # 30
Is this an accurate statement about preventive policy checking in IdentityIQ?
Preventive policy checking can only stop self-service requests.
- A. No
- B. Yes
Answer: A
Explanation:
The statement is false. Preventive policy checking in SailPoint IdentityIQ is not limited only to self-service requests. Preventive policy evaluation is used to identify policy violations before access changes are completed. This can occur during access request processing, provisioning-related activity, or other configured request paths where IdentityIQ evaluates proposed changes against defined policies before allowing the transaction to proceed.
A self-service request is only one possible entry point. IdentityIQ access requests may be submitted by an end user, a manager, an administrator, or another authorized requester depending on QuickLink Population rules, request configuration, and access-request permissions. Preventive policy checking evaluates the requested access change itself, not merely the fact that the request was self-initiated. If the proposed access would violate a separation-of-duty, risk, or other governance policy, IdentityIQ can warn, require additional handling, or block the request depending on policy and workflow configuration.
Therefore, the word "only" makes the statement incorrect. Preventive policy checking is a governance control applied to configured access-change activity, not exclusively to self-service actions. Reference topics:
Governance, policy detection, preventive policy checking, access request policy evaluation, User-Driven Requests, and provisioning request control.
NEW QUESTION # 31
Is this statement true for IdentityIQ application definitions?
Applications in IdentityIQ are named with the connector that is selected.
- A. No
- B. Yes
Answer: A
Explanation:
No. In SailPoint IdentityIQ, the application name is a configurable label assigned to the application object and does not have to match the connector selected. The application definition represents an external system or source, while the connector defines the technical integration method used to communicate with that system. These are related configuration elements, but they are not the same field and one does not automatically name the other.
For example, an application could be named "Corporate Directory," "North America Active Directory," or "HR Source," while using an LDAP, Active Directory, JDBC, Delimited File, Web Services, or another connector type. The connector selection determines available configuration settings, supported schema behavior, aggregation options, and provisioning capabilities. The application name is used for identification within IdentityIQ, reporting, certifications, requests, policies, and administrative configuration.
Therefore, the statement is incorrect because IdentityIQ applications are not named by the selected connector. They are named by the administrator or implementer according to the business or system context. Reference topics: Applications, application definition, connector selection, connector-dependent settings, schemas, aggregation, and provisioning support.
NEW QUESTION # 32
Is this statement true for IdentityIQ application definitions?
Applications in IdentityIQ are named with the connector that is selected.
- A. No
- B. Yes
Answer: A
Explanation:
No. In SailPoint IdentityIQ, the application name is a configurable label assigned to the application object and does not have to match the connector selected. The application definition represents an external system or source, while the connector defines the technical integration method used to communicate with that system.
These are related configuration elements, but they are not the same field and one does not automatically name the other.
For example, an application could be named "Corporate Directory," "North America Active Directory," or
"HR Source," while using an LDAP, Active Directory, JDBC, Delimited File, Web Services, or another connector type. The connector selection determines available configuration settings, supported schema behavior, aggregation options, and provisioning capabilities. The application name is used for identification within IdentityIQ, reporting, certifications, requests, policies, and administrative configuration.
Therefore, the statement is incorrect because IdentityIQ applications are not named by the selected connector.
They are named by the administrator or implementer according to the business or system context. Reference topics: Applications, application definition, connector selection, connector-dependent settings, schemas, aggregation, and provisioning support.
NEW QUESTION # 33
Is this an accurate statement about the Manage Accounts feature in LifeCycle Manager?
If users can request new accounts on an application, IdentityIQ also allows them to request an additional account on the application.
- A. No
- B. Yes
Answer: A
Explanation:
The statement is not accurate as written. In IdentityIQ LifeCycle Manager, allowing users to request a new account on an application does not automatically mean they can request an additional account on that same application. These are related but distinct account request scenarios. A new account request typically applies when an identity does not already have an account on the target application. An additional account request applies when an identity already has an account and the application is configured to support more than one account for the same identity.
Whether additional accounts are available depends on the application's account model, connector support, application configuration, request configuration, and provisioning policy behavior. Some applications support only one account per identity; in those cases, IdentityIQ may allow creation of the initial account but not allow a second or additional account. Manage Accounts can expose account lifecycle actions such as create, modify, enable, disable, unlock, delete, or request additional accounts, but only when the underlying application and IdentityIQ configuration support those operations.
Reference topics: User-Driven Requests - account request types and operations; Applications - connector and application settings; Provisioning - provisioning policies and account creation behavior.
NEW QUESTION # 34
Is this an accurate statement about the selection of a connector as part of an application definition?
Hostname is a required connectivity setting, regardless of the connector type selected.
- A. No
- B. Yes
Answer: A
Explanation:
The statement is false. In SailPoint IdentityIQ, connectivity settings are determined by the connector selected for the application definition. An application represents an authoritative source, target system, or managed resource, and the connector defines how IdentityIQ communicates with that system. Because different connectors use different communication models, their required configuration fields are not universal.
For example, an LDAP or Active Directory connector commonly requires server connection details such as host, port, credentials, and search base configuration. A JDBC-based connector may require a JDBC URL, driver class, database credentials, and SQL-related configuration. A delimited file connector does not require a hostname because it reads account and entitlement data from a file location rather than connecting to a network service. Similarly, cloud or API-based connectors may require endpoint URLs, tokens, client credentials, or tenant-specific settings instead of a simple hostname field.
Therefore, hostname cannot be considered a required connectivity setting for every connector type. Required settings are connector-dependent and appear according to the selected connector's configuration model.
Reference topics: Applications, connector selection, application definition, connector-dependent settings, schema configuration, and aggregation prerequisites.
NEW QUESTION # 35
Is this a true statement about the provisioning process in IdentityIQ?
The provisioning plan will never be changed or updated.
- A. No
- B. Yes
Answer: A
Explanation:
No. In SailPoint IdentityIQ, the provisioning plan is not necessarily static after it is initially created. A provisioning plan represents the requested account and access changes to be fulfilled, such as creating an account, modifying attributes, adding or removing entitlements, disabling an account, or deleting an account. During provisioning processing, IdentityIQ may update, expand, enrich, or transform the plan before fulfillment.
For example, provisioning policies may require additional data before a requested operation can be completed. Workflow logic, rules, approval outcomes, role expansion, dependency processing, and application-specific provisioning configuration can also affect the final provisioning instructions. IdentityIQ may compile the plan into executable provisioning activity, split requests by application, route items to connectors, or generate manual work items when direct connector provisioning is not available. These processing steps can alter what is ultimately sent to the target system or assigned for fulfillment.
Therefore, the statement that the provisioning plan will never be changed or updated is incorrect. Reference topics: Provisioning, provisioning plans, provisioning policies, plan compilation, workflows, connector provisioning, manual fulfillment, and application-specific provisioning behavior.
NEW QUESTION # 36
Is this statement true for IdentityIQ application definitions?
Application definitions contain the connectivity information IdentityIQ uses to communicate with the application.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. In SailPoint IdentityIQ, an application definition represents an external system or managed source and contains the configuration IdentityIQ needs to connect to and interact with that system. The selected connector determines which connectivity settings are required, and the application definition stores those values. Examples can include server host, port, credentials, JDBC URL, file path, API endpoint, tenant information, authentication parameters, or other connector-specific settings.
This connectivity information enables IdentityIQ to perform operations such as account aggregation, group aggregation, schema discovery, entitlement collection, and provisioning where the connector supports write operations. The exact fields vary by connector type, which is why an LDAP, JDBC, Delimited File, Active Directory, or Web Services application may expose different configuration requirements.
Therefore, the statement is accurate: application definitions contain the communication and connectivity configuration used by IdentityIQ to access the application. Reference topics: Applications, application definition, connector selection, connector-dependent settings, account aggregation, schema configuration, and provisioning support.
NEW QUESTION # 37
Is this a true statement about the provisioning process in IdentityIQ?
IdentityIQ determines if the account needs to be created before modification.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. In SailPoint IdentityIQ provisioning, the system evaluates the requested access change in the context of the identity's existing application accounts. When a provisioning request requires a modification on an application, IdentityIQ must determine whether the identity already has an account, represented by a Link, on that application. If no existing account is available and the requested change requires one, IdentityIQ can include account creation as part of the provisioning activity before applying attribute or entitlement modifications.
This behavior is central to request-based provisioning. For example, if a user requests an entitlement on an application where they do not yet have an account, IdentityIQ cannot simply add the entitlement to a nonexistent account. The provisioning process must first establish the account, collect required values through provisioning policies, and then apply the requested access. The provisioning plan may therefore be expanded or adjusted during compilation and fulfillment.
Therefore, the statement is true: IdentityIQ can determine whether an account must be created before modification. Reference topics: Provisioning, provisioning plan processing, account requests, provisioning policies, account creation, entitlement modification, and plan compilation.
NEW QUESTION # 38
Why would an organization define lifecycle events in IdentityIQ?
To prevent users from violating policies
- A. No
- B. Yes
Answer: A
Explanation:
No. Lifecycle Events in SailPoint IdentityIQ are not primarily defined to prevent users from violating policies. Lifecycle Events are configured to detect identity-related changes and trigger a business process or workflow in response. Typical examples include joiner, mover, leaver, rehire, or other lifecycle transitions based on changes to identity attributes such as lifecycle state, employment status, department, manager, location, or start and termination dates.
Preventing policy violations is handled through IdentityIQ's governance and policy framework, especially preventive policy checking during access request processing. Policies define prohibited access conditions, such as separation-of-duty conflicts, and IdentityIQ can warn, block, or route requests when a proposed access change would create a violation.
Lifecycle Events may indirectly support compliance by removing or adjusting access when a user changes status, but their purpose is event-driven lifecycle automation, not policy violation prevention itself. Therefore, this statement is not the correct reason for defining Lifecycle Events.
Reference topics: Provisioning, Lifecycle Events, joiner-mover-leaver processing, workflows, identity attribute changes, Governance, policy detection, and preventive policy checking.
NEW QUESTION # 39
Does this statement accurately describe how roles are acquired by users in the default role model configuration?
Birthright role assignment may be processed during a mover lifecycle event.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. In SailPoint IdentityIQ, birthright roles represent access that is automatically granted based on identity context, such as job function, department, location, lifecycle state, or organizational assignment. A mover lifecycle event occurs when an identity undergoes a material change, such as transfer to a new department, change in manager, change in location, or change in business role eligibility. Because these changes can alter what baseline access the identity should have, birthright role assignment may be processed as part of the mover event.
The mover event can launch a configured business process that evaluates the identity's updated attributes and initiates access changes, including assignment of new birthright roles or removal of access no longer appropriate. This differs from requestable roles, where a user or manager explicitly asks for access through Lifecycle Manager. Birthright access is driven by identity state and business rules.
Therefore, the statement is accurate. Mover lifecycle processing can be used to keep baseline role-based access aligned with the user's changed business position. Reference topics: Access Modeling, birthright roles, role assignment, Identity Refresh, Lifecycle Events, mover processes, and Provisioning.
NEW QUESTION # 40
Is this statement true for the identity refresh task?
It can send reminders for open work items.
- A. No
- B. Yes
Answer: A
Explanation:
The statement is false. The Identity Refresh task is used to update and recalculate identity-related data in IdentityIQ, not to manage open work item reminders. Its purpose is to refresh IdentityCubes after aggregation or identity data changes. Depending on selected task options, Identity Refresh can recalculate identity attributes, apply correlation-related updates, refresh role assignments and detections, evaluate policies, process lifecycle events, update risk-related data, and ensure that the identity model reflects the current state of authoritative and application data.
Open work items belong to IdentityIQ's workflow and governance execution layer. Reminders, escalations, expirations, and related work item follow-up behavior are handled through work item configuration, workflow behavior, certification configuration, and maintenance-style processing rather than the Identity Refresh task. Although Identity Refresh may trigger downstream actions such as lifecycle events or policy evaluation, it is not the task responsible for notifying users about pending approvals or review items.
Therefore, sending reminders for open work items is outside the purpose of Identity Refresh. Reference topics: Identity Modeling - common Identity Refresh options; Foundational Concepts - tasks versus workflows; Governance - work items, certifications, reminders, and escalation behavior.
NEW QUESTION # 41
Is this an accurate statement about the selection of a connector as part of an application definition?
Hostname is a required connectivity setting, regardless of the connector type selected.
- A. No
- B. Yes
Answer: A
Explanation:
The statement is false. In SailPoint IdentityIQ, connectivity settings are determined by the connector selected for the application definition. An application represents an authoritative source, target system, or managed resource, and the connector defines how IdentityIQ communicates with that system. Because different connectors use different communication models, their required configuration fields are not universal.
For example, an LDAP or Active Directory connector commonly requires server connection details such as host, port, credentials, and search base configuration. A JDBC-based connector may require a JDBC URL, driver class, database credentials, and SQL-related configuration. A delimited file connector does not require a hostname because it reads account and entitlement data from a file location rather than connecting to a network service. Similarly, cloud or API-based connectors may require endpoint URLs, tokens, client credentials, or tenant-specific settings instead of a simple hostname field.
Therefore, hostname cannot be considered a required connectivity setting for every connector type. Required settings are connector-dependent and appear according to the selected connector's configuration model. Reference topics: Applications, connector selection, application definition, connector-dependent settings, schema configuration, and aggregation prerequisites.
NEW QUESTION # 42
Is this statement true about Rapid Setup?
It will create the application definitions.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. Rapid Setup in SailPoint IdentityIQ is designed to accelerate application onboarding by creating and configuring the application definitions required for IdentityIQ to manage data from connected systems. An application definition is the IdentityIQ object that represents an external source or target system and stores the connector selection, connectivity settings, schema information, aggregation behavior, correlation configuration, and related governance options.
Rapid Setup reduces the amount of manual configuration normally required when defining applications.
Instead of building every application definition entirely through the standard detailed configuration screens, Rapid Setup guides the administrator through a simplified setup path and creates the required IdentityIQ application objects from that configuration. Those application definitions can then be used for aggregation, correlation, entitlement discovery, access modeling, and downstream governance processes.
This does not mean Rapid Setup eliminates the need for validation. Administrators must still verify schemas, correlation rules, entitlement treatment, and provisioning behavior. However, the statement is accurate because creating application definitions is a core function of Rapid Setup.
Reference topics: Applications, Rapid Setup, application definitions, connector configuration, schema configuration, aggregation, correlation, and entitlement discovery.
NEW QUESTION # 43
Does this statement accurately describe how roles are acquired by users in the default role model configuration?
Business roles can only be requested by managers.
- A. No
- B. Yes
Answer: A
Explanation:
No. This statement does not accurately describe role acquisition in IdentityIQ. Business roles are not restricted to being requested only by managers. In IdentityIQ, roles may be acquired through role assignment logic, role detection, access requests, or administrative action, depending on the role configuration and the organization's request model.
A business role commonly represents access associated with a business function, job, department, location, or organizational responsibility. Users may receive business roles automatically when their identity attributes satisfy configured role profiles or assignment rules, typically recalculated during Identity Refresh. Separately, roles may be made requestable through Lifecycle Manager and exposed through QuickLinks, where request eligibility is controlled by QuickLink Populations, request configuration, and workflow rules.
Managers may be allowed to request roles for direct reports, but that is only one possible configuration.
IdentityIQ can also allow users to request roles for themselves, allow delegated requesters to request for others, or restrict requests to specific populations.
Therefore, "only requested by managers" is too narrow and incorrect. Reference topics: Access Modeling, business roles, role assignment, role detection, Identity Refresh, User-Driven Requests, QuickLink Populations, and role request configuration.
NEW QUESTION # 44
......
Start your IdentityIQ-Associate Exam Questions Preparation: https://testking.guidetorrent.com/IdentityIQ-Associate-dumps-questions.html