Pass the SailPoint Identity Security Engineer IdentityNow-Engineer Questions and answers with ExamsMirror

Yes, defining an account schema is an essential step when implementing a JDBC connector. The schema defines the structure of the identity data being pulled from the database, including the attributes that will be mapped to identity profiles in IdentityNow. The schema can be defined either by using the "Discover Schema" option, which automatically identifies available attributes, or by manually configuring the schema attributes if specific custom mappings are required.

References:

SailPoint IdentityNow JDBC Connector Schema Configuration Guide.

SailPoint IdentityNow Source Schema Discovery Documentation.

In SailPoint IdentityNow, provisioning is the process of granting or revoking access to systems and applications based on access requests or changes in user identity attributes. The scenario describes John Doe requesting access to the "Sales" profile in Salesforce, which is approved by his manager.

However, simply approving an access request does not automatically trigger provisioning unless specific conditions are met:

Provisioning Policy: For the access to be provisioned, SailPoint IdentityNow requires a provisioning policy that defines the action to be taken after the approval process. This policy is often configured to specify whether access should be granted or denied after approval. If no provisioning policy is linked to the requested access, no action will be triggered.

Source Configuration: The Salesforce source (connector) in SailPoint IdentityNow must also be properly configured to handle provisioning tasks. Without proper configuration of the Salesforce source, no provisioning action will be sent even if the request is approved.

Manual Provisioning Workflow: In some cases, IdentityNow might be configured to require manual intervention after approval (e.g., triggering a manual provisioning workflow or an additional step) to enforce the provisioning action. If this configuration is missing, the approved request will not lead to automatic provisioning.

Since the scenario does not explicitly state that a provisioning policy or source configuration exists to handle the access request, the correct conclusion is that no provisioning would be sent out.

Key Reference from SailPoint Documentation:

Provisioning Concepts in IdentityNow: Documentation emphasizes that provisioning is triggered by defined workflows and provisioning policies that link the request to the connector source. Without these, the approval does not lead to actual provisioning.

No, reconfiguration within IdentityNow is not required to connect to the disaster recovery (DR) VAs, which makes this scenario not a disadvantage. When properly configured, all VAs (including DR VAs) in a cluster are part of the same logical unit, meaning that failover to the DR VAs should happen seamlessly without manual intervention or significant reconfiguration. IdentityNow handles the failover automatically, directing traffic to the DR VAs when primary VAs become unavailable.

While there might be some overhead in a manual failover scenario for certain configurations, the use of a single VA cluster helps mitigate this by ensuring the system can failover without needing complex reconfigurations for every source.

References:

SailPoint IdentityNow Virtual Appliance Failover and Disaster Recovery Configuration.

SailPoint IdentityNow High Availability Architecture Guide.

The use case describes a user logging into IdentityNow via an external identity provider’s login, where information is exchanged via federation. This correctly aligns with the concept of passthrough authentication.

Passthrough authentication often uses protocols like SAML (Security Assertion Markup Language) or OAuth for federation. In this case, the identity provider (IdP) handles the authentication and then passes the necessary authentication tokens or assertions back to SailPoint IdentityNow, granting the user access without directly requiring their password to be stored or authenticated by IdentityNow. This is a typical use case of federation and passthrough authentication.

References:

SailPoint IdentityNow Documentation on SAML and OAuth Federation.

SailPoint IdentityNow Federation and Passthrough Authentication Configuration Guides.

Yes, checking that the port values configured on the source in SailPoint IdentityNow are correct and accessible is an essential troubleshooting step. A timeout error can occur if the virtual appliance (VA) cannot reach the source due to incorrect port configuration or network issues blocking communication. Verifying the correct port numbers and ensuring that the necessary ports are open on both the VA and the source's firewall is critical.

Key Reference from SailPoint Documentation:

Port Configuration for Source Connectivity: Ensuring that the proper port values are configured and accessible is one of the primary troubleshooting steps when facing timeout errors in IdentityNow.

Yes, using a query select statement with a clause to match the incoming account to an existing account is a key configuration for the Single Account SQL Query in a JDBC connector. This query is used to fetch specific account details from the database and must be written in such a way that it uniquely identifies each account, ensuring accurate correlation between the data in the source and the identities in IdentityNow. Properly configuring this SQL query ensures the right accounts are matched and managed.

References:

SailPoint IdentityNow JDBC Connector Single Account Query Configuration Guide.

SailPoint IdentityNow SQL Query Best Practices Documentation.

Yes, the file /etc/systemd/network/static.network (or a similarly named file depending on the Linux distribution used by the Virtual Appliance) is typically used to configure a static IP address for the VA. This file is part of the systemd network configuration, and modifying it allows you to specify static IP settings, such as the IP address, netmask, gateway, and DNS servers, for the Virtual Appliance's network interface.

To set a static IP address, you would need to modify this file and restart the network service for the changes to take effect.

References:

SailPoint IdentityNow Virtual Appliance Network Configuration Guide.

Linux systemd Network Configuration Documentation.

The default non-production tenant does not have the same full performance scalability as a production tenant. Non-production environments are typically configured with reduced resources since they are intended for testing, development, or demonstration rather than handling large-scale, live workloads.

Key Reference from SailPoint Documentation:

Performance Differences Between Tenants: SailPoint non-production tenants are generally scaled down compared to production environments to reflect their testing and demonstration purposes, not for high-performance or large-scale operations.

The Web Services connector in SailPoint IdentityNow does not support SAML authentication. SAML is primarily used for Single Sign-On (SSO) authentication for web applications, whereas the Web Services connector in IdentityNow typically supports Basic Authentication, OAuth, or custom header-based authentication for API-based integrations. SAML authentication is generally used for federated identity management rather than for API-based interactions.

References:

SailPoint IdentityNow Web Services Connector Configuration Guide.

SailPoint IdentityNow Authentication Methods for Connectors.

No, this example does not accurately describe an IdentityNow data flow. The step where the domain controller sends a list of accounts directly to the virtual appliance is incorrect. Instead, during manual aggregation, the virtual appliance is responsible for initiating the connection to the domain controller (or other authoritative source), retrieving account data, and then sending the results to the IdentityNow tenant. Sensitive information is masked before sending the data from the virtual appliance to the IdentityNow tenant, but the domain controller does not interact directly with the IdentityNow tenant.

References:

SailPoint IdentityNow Aggregation Process Documentation.

SailPoint IdentityNow Virtual Appliance Data Flow Guide.