Pass the SailPoint Identity Security Engineer IdentityIQ-Engineer Questions and answers with Dumpstech

Yes, the code provided in the second image is correct for including a rule library named " Common Rules Library " in a Rule. The correct syntax is to use class= " sailpoint.object.RuleLibrary " and specify the name of the rule library. This allows the Rule to reference the functions and logic defined in the " Common Rules Library. "

Correct Syntax (from the second image):

< ReferenceRules >

< Reference class= " sailpoint.object.RuleLibrary " name= " Common Rules Library " / >

< /ReferenceRules >

SailPoint IdentityIQ Rule Library Documentation

SailPoint IdentityIQ Configuration Guide (Rule and Rule Library Management)

This statement is false. BeanShell rules in IdentityIQ do not universally have to produce a meaningful output. A rule’s expected return behavior depends on the rule type and the context in which the rule is executed. Some rules are designed to return a Boolean, String, Map, ProvisioningPlan, Identity, or another object. Other rules perform side effects, such as modifying a plan, transforming values, logging, altering an object, or executing validation logic, and may return null or no useful result. The Word bank contains a related but different rule-output concept: a BeanShell rule does not always need to return an object derived from sailpoint.object.SailPointObject; it may return several other object types or null. The proposed statement is even broader and still incorrect because IdentityIQ rule output is rule-type dependent, not mandatory in a generic sense. References/topics: IdentityIQ Engineer — BeanShell rules, rule registry, return values, rule execution context, input/output contracts.

Yes. IdentityIQ reports are closely tied to the platform’s task framework. Out-of-the-box report templates are represented as task/report definitions, and these definitions describe how the report is executed, what arguments or filters it accepts, and how the resulting report instance is generated. In IdentityIQ, scheduled and executable background operations commonly use TaskDefinition objects, and reporting is implemented through this same general task infrastructure. A report definition is not the same thing as a generated report result. The TaskDefinition defines the report template or executable report behavior, while a run of that report creates task/report result data. This distinction matters because an engineer may inspect, export, import, customize, or troubleshoot report definitions through IdentityIQ objects. The proposed statement is therefore valid for out-of-the-box reports as report definitions/templates. References/topics: IdentityIQ Engineer — reporting framework, TaskDefinition objects, report templates, task execution, generated report results.

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

No. Custom branding changes should not be assumed to update automatically during an IdentityIQ upgrade. Branding changes often involve customized UI resources, message files, images, CSS, JSPs, configuration entries, or other web-application artifacts. During an upgrade, the standard IdentityIQ application files are replaced or changed, and customizations may need to be re-applied, merged, retested, or adjusted to align with the new release. Assuming the upgrade process automatically updates every custom branding change is a bad implementation practice. Engineers should inventory all customizations before upgrade, compare them against the new release, reapply supported changes, and validate the UI after deployment. This also applies to broader customizations such as rules, workflows, Quicklinks, forms, libraries, object extensions, and localized messages. The correct upgrade discipline is controlled migration and regression testing, not blind reliance on automatic preservation. References/topics: IdentityIQ Engineer — upgrade planning, branding customization, UI resource changes, regression testing, customization inventory.

Yes, the statement is true. In SailPoint IdentityIQ, the built-in auditing options are indeed immutable, meaning they are always recorded and cannot be disabled or altered. This ensures that critical actions and changes are always logged for compliance and security purposes. However, custom audit configurations, such as additional custom audit fields or logs, can be turned on or off based on specific organizational requirements.

SailPoint IdentityIQ Audit Guide

SailPoint IdentityIQ Administration Guide (Sections on Auditing and Compliance)

No. Whether an application supports password change requests through the IdentityIQ UI is not controlled by generic LCM workflow control variables. Password-change support depends on the application connector’s capabilities, password-management configuration, application settings, schema/support for password operations, policies, and QuickLink/user-interface configuration. The workflow may process or route a password-change request once launched, but it does not define which target applications support that operation. That capability must be configured at the application/connector and password-management layer. Mixing these layers would create a brittle design: workflow variables should govern execution behavior, while application configuration defines available account operations. Therefore, the proposed solution is not achievable merely by configuring out-of-the-box LCM workflow control variables. References/topics: IdentityIQ Engineer — password management, application connector capabilities, LCM workflows, QuickLink password change, account operation support.

The scenario describes triggering a workflow when a " Division " attribute changes from a specific value to " Senior IT, " but only when the user is a manager. The proposed solution suggests creating a trigger with an event type of " rule " that checks the previous and new values of the " Division " attribute.

However, this approach has a couple of issues:

Trigger Configuration: In SailPoint IdentityIQ, a lifecycle event trigger typically operates on changes in identity attributes, but it’s not standard to define this trigger using a rule that directly inspects the previous and new values. Instead, the lifecycle event would usually be configured in the context of the application or identity to directly listen to specific changes without needing to define the logic in a custom rule.

Condition Validation: The condition of checking if the user is a manager should ideally be integrated within the workflow itself or the lifecycle event configuration, not just as part of a rule in the trigger.

While a rule can be used to define complex conditions, the correct way to implement this in IdentityIQ would involve setting up the lifecycle event trigger specifically for the attribute change and managing any additional conditions (like checking if the user is a manager) within the workflow or using an appropriate script/rule in that context.

Therefore, while partially correct in approach, the described solution is not the best practice or a valid process in IdentityIQ, so the correct answer is B. No.

The Rapid Setup user interface configuration options in IdentityIQ can be used to disable an account and remove all its entitlements on a particular application during Leaver events. Rapid Setup is designed to simplify the configuration of common identity lifecycle processes, including handling leaver (termination) events. When configuring these events, you can specify actions such as disabling accounts and removing entitlements from specific applications as part of the termination process.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Lifecycle Manager Guide (Sections on Lifecycle Event Configuration)

An Account Group Membership Certification is designed to certify group memberships within accounts, typically focusing on the validation of access within specific account groups (e.g., Active Directory groups).

This type of certification does not directly address the accuracy of role composition or the correctness of entitlements assigned within roles. Since the bank ' s goal is to ensure that all roles include the correct entitlements, an Account Group Membership Certification is not suitable for this purpose.

Thus, the correct answer is B. No.