Pass the SailPoint Identity Security Engineer IdentityIQ-Associate Questions and answers with ExamsMirror

The statement is not a correct use case for entitlement catalog data. In SailPoint IdentityIQ, the entitlement catalog is used to govern and enrich entitlement data after entitlements are discovered from application account/group schemas and aggregation. The catalog stores managed entitlement metadata such as display name, description, owner, classification, requestability, risk-related information, and other governance attributes. This information supports access reviews, access requests, approvals, role modeling, policy analysis, and decision-making by presenting business-readable information about technical access.

The application definition is primarily the configuration object for connecting to a target system. It contains connector settings, schemas, correlation configuration, aggregation options, provisioning settings, and related application-level controls. While entitlement-related configuration begins with the application schema, the entitlement catalog is not principally used to provide descriptions “for viewing on the application definition.” Its governed data is used in operational governance contexts, especially where reviewers, requesters, approvers, and administrators need understandable access context.

Therefore, entitlement descriptions are catalog governance metadata, not a feature whose purpose is simply display on the application definition. Reference topics: Access Modeling — purpose of the entitlement catalog; Applications — group/account schemas; Governance — certification decision support; User-Driven Requests — access request display and approval context.

The statement is false. The Identity Refresh task does not execute aggregation rules configured on an application definition. Aggregation rules are part of the application aggregation process, where IdentityIQ connects to a source system, reads account or group data, applies connector and application-level processing, and stores account links, entitlement values, and related data in the IdentityIQ repository.

The Identity Refresh task operates after data is already present in IdentityIQ. Its function is to update IdentityCubes and recalculate identity-level governance information. Depending on selected options, Identity Refresh may update identity attributes, refresh role assignments, detect assigned or detected roles, evaluate policies, process lifecycle events, refresh manager relationships, or recalculate risk and access-related identity state.

Application aggregation and identity refresh are separate task functions. Aggregation obtains and normalizes data from applications; Identity Refresh interprets and recalculates identity governance state using that aggregated data. Therefore, rules tied specifically to aggregation on the application definition are execute during aggregation, not during Identity Refresh.

Reference topics: Identity Modeling — Identity Refresh task options; Applications — aggregation rules and application definitions; Foundational Concepts — tasks and workflows.

The statement is not accurate as written. In IdentityIQ LifeCycle Manager, allowing users to request a new account on an application does not automatically mean they can request an additional account on that same application. These are related but distinct account request scenarios. A new account request typically applies when an identity does not already have an account on the target application. An additional account request applies when an identity already has an account and the application is configured to support more than one account for the same identity.

Whether additional accounts are available depends on the application’s account model, connector support, application configuration, request configuration, and provisioning policy behavior. Some applications support only one account per identity; in those cases, IdentityIQ may allow creation of the initial account but not allow a second or additional account. Manage Accounts can expose account lifecycle actions such as create, modify, enable, disable, unlock, delete, or request additional accounts, but only when the underlying application and IdentityIQ configuration support those operations.

Reference topics: User-Driven Requests — account request types and operations; Applications — connector and application settings; Provisioning — provisioning policies and account creation behavior.

Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed designates that the values discovered for that attribute are treated as managed entitlement values and promoted into the Entitlement Catalog. This is typically used for attributes that represent access, such as groups, roles, permissions, profiles, or other application-specific entitlement assignments. During aggregation, IdentityIQ reads account data from the application. When a schema attribute is marked as managed, the distinct values of that attribute can become ManagedAttribute objects, allowing IdentityIQ to govern them as cataloged access items.

This catalog promotion is important because raw technical values often need business context before they can be reviewed, requested, approved, certified, or reported on. The Entitlement Catalog can store metadata such as display name, description, owner, requestability, classification, and other governance attributes. These values then become usable in access certifications, access requests, reports, policy evaluation, and role modeling.

Therefore, the statement accurately describes the managed attribute function. Reference topics: Applications — account schema attribute properties; Access Modeling — entitlement catalog; Governance — certification content and entitlement review.

No. This definition does not describe an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the central identity record that represents a person or identity within IdentityIQ. It consolidates identity attributes, correlated application accounts, entitlements, assigned roles, detected roles, manager relationship, policy violations, lifecycle state, and other governance-relevant information. The Identity Cube is the primary object used by IdentityIQ to understand who a user is and what access that user has across connected systems.

The statement given describes provisioning, not an Identity Cube. Provisioning is the process of adding, removing, or modifying a user’s access on an application. Examples include creating an account, changing account attributes, adding an entitlement, removing group membership, disabling an account, or deleting an account.

Therefore, the definition is inaccurate because it describes an access-change process, while an Identity Cube is an identity data model. Reference topics: Identity Modeling, IdentityCube contents, application account correlation, entitlements, roles, Provisioning, account requests, and access-change fulfillment.

No. In IdentityIQ, a birthright role is intended to represent access that is automatically assigned to identities based on defined business criteria, such as lifecycle state, department, location, job function, or other identity attributes. The purpose of a birthright role is automatic access assignment, not user-driven request selection. Rapid Setup can help configure common access-modeling and application-onboarding elements more efficiently, including birthright access patterns, but the birthright concept remains assignment-based rather than request-based.

Requestable access is handled through the access request model, where users select roles, entitlements, or other access items made available through request configuration and QuickLinks. Birthright access is different because it is granted when an identity satisfies the role assignment criteria and is recalculated through identity refresh and role evaluation. Making birthright roles requestable would undermine their purpose as standard baseline access automatically derived from identity data.

Therefore, the statement is inaccurate. Rapid Setup birthright roles are used for automated assignment and baseline access, not as requestable access items. Reference topics: Applications, Rapid Setup, Access Modeling, birthright roles, role assignment, identity refresh, and User-Driven Requests.

The statement is false. In SailPoint IdentityIQ, an uncorrelated account is an account record aggregated from an application that has not been matched to an IdentityCube. Manual correlation is one valid remediation method, but it is not the only method. IdentityIQ can also resolve uncorrelated accounts through configured correlation logic, correlation rules, identity refresh processing, and re-aggregation after application correlation settings are corrected.

Correlation is normally configured on the application using identity attributes, account attributes, or rules that determine how an account should be associated with an identity. For example, an account attribute such as employee ID, email address, user name, or another unique identifier can be used to locate the matching IdentityCube. When the correlation configuration is improved and aggregation or refresh is rerun, previously uncorrelated accounts may be automatically linked without manual intervention.

Manual correlation is primarily an administrative correction path for exceptions where automatic matching cannot safely determine ownership. Therefore, “only manually” is too restrictive and does not reflect IdentityIQ’s correlation model. Reference topics: Applications, correlation configuration, uncorrelated account resolution, account aggregation, IdentityCube association, and Identity Modeling.

Yes. In SailPoint IdentityIQ, connector selection determines not only how IdentityIQ communicates with the target application, but also which operations the connector is capable of supporting. The connector featureString identifies connector capabilities exposed to IdentityIQ. These capabilities can include whether the connector supports account aggregation, group aggregation, schema discovery, provisioning, password management, authentication, or other connector-specific functions.

This is important because IdentityIQ uses connector capabilities to determine which configuration options and operational behaviors are valid for the application. For example, a connector that supports provisioning can write account or entitlement changes back to the managed system through provisioning plans. A read-only connector, by contrast, may support aggregation but not allow IdentityIQ to create, modify, disable, or delete accounts on the target. Therefore, the featureString helps define whether the connector can perform write operations against the application.

The statement is accurate because the connector’s advertised features directly describe functional capabilities, including the ability to write changes where supported. Reference topics: Applications, connector selection, application definition, connector-dependent settings, provisioning support, aggregation behavior, and connector capabilities.

The statement is false. In IdentityIQ, an account attribute is defined within a specific application account schema and represents data stored on an account link for that application. Its value is obtained from the account data aggregated from that particular application connector. For example, an account attribute such asmemberOf,department,title, oraccountStatusbelongs to the account schema of a defined application and is populated from that application’s aggregation results.

The concept of sourcing values from several applications applies more directly to identity attributes, not account attributes. Identity attributes reside on the IdentityCube and may be derived from authoritative sources, account links, rules, mappings, or precedence logic across multiple applications. IdentityIQ uses identity attribute configuration to normalize data such as department, location, manager, email, or lifecycle state at the identity level.

Therefore, while multiple applications may contain similarly named account attributes, each account attribute value is tied to its own application account schema and account link. It is not a single shared account attribute sourced from several applications.

Reference topics: Applications — account schema attributes; Identity Modeling — identity attributes versus account attributes; Identity Refresh — updating IdentityCube attributes.

This is not a standard example of a policy that can be defined in IdentityIQ. IdentityIQ policies are governance controls used to detect inappropriate access, risky access combinations, account conditions, identity conditions, or activity-related violations based on configured policy logic. Common policy examples include separation of duties policies, account policies, identity policies, risk policies, and activity policies. These policies evaluate identities, accounts, roles, entitlements, attributes, and access relationships to determine whether a violation exists.

The wording “administrator policy” is not a standard IdentityIQ policy category. IdentityIQ can audit administrative activity and can secure administrative functions through capabilities, scopes, workgroups, permissions, and object-level controls, but that is different from defining an “administrator policy” as a governance policy type. Risky actions performed within IdentityIQ itself are generally handled through audit events, administrative security configuration, logging, and operational monitoring rather than a standard policy definition named administrator policy.

Therefore, this statement does not describe a valid common IdentityIQ policy example. Reference topics: Governance — examples of common policies, policy detection, policy violations; Foundational Concepts — common objects and components; Identity Modeling — IdentityCube attributes and access context.