SailPoint IdentityIQ-Associate - SailPoint Certified IdentityIQ Associate Exam

Marking an account schema attribute as managed does not mean the attribute can be edited in IdentityIQ. In IdentityIQ application schema configuration, a managed attribute is one whose values are promoted into IdentityIQ as governable access objects, commonly represented in the entitlement catalog. This allows IdentityIQ to attach governance metadata to the discovered values, such as display name, description, owner, requestability, classification, and review-related context.

Editability is controlled through different mechanisms, including provisioning policies, forms, workflows, connector capabilities, and provisioning plan operations. An attribute may be managed for governance purposes without being directly editable by a user in IdentityIQ. Conversely, an attribute may be populated during provisioning if the application connector and provisioning policy support it, but that is separate from the schema’s managed designation.

The managed setting is therefore about governance, cataloging, and access modeling, not direct modification. It enables IdentityIQ to treat values of that schema attribute as objects that can be reviewed, requested, certified, described, and owned.

Reference topics: Applications — account schema attributes and their functions; Access Modeling — entitlement catalog; Governance — certifications; Provisioning — provisioning policies and attribute handling.

No. In IdentityIQ, a birthright role is intended to represent access that is automatically assigned to identities based on defined business criteria, such as lifecycle state, department, location, job function, or other identity attributes. The purpose of a birthright role is automatic access assignment, not user-driven request selection. Rapid Setup can help configure common access-modeling and application-onboarding elements more efficiently, including birthright access patterns, but the birthright concept remains assignment-based rather than request-based.

Requestable access is handled through the access request model, where users select roles, entitlements, or other access items made available through request configuration and QuickLinks. Birthright access is different because it is granted when an identity satisfies the role assignment criteria and is recalculated through identity refresh and role evaluation. Making birthright roles requestable would undermine their purpose as standard baseline access automatically derived from identity data.

Therefore, the statement is inaccurate. Rapid Setup birthright roles are used for automated assignment and baseline access, not as requestable access items. Reference topics: Applications, Rapid Setup, Access Modeling, birthright roles, role assignment, identity refresh, and User-Driven Requests.

No. An Identity Cube is not an IdentityIQ account. In SailPoint IdentityIQ, the Identity Cube is the central identity record that represents a person or identity being governed by the platform. It consolidates identity attributes, correlated application accounts, account links, entitlements, assigned roles, detected roles, manager relationship, lifecycle state, policy violations, and other governance-relevant information.

An “IdentityIQ account” usually refers to a login account or user object that allows someone to access the IdentityIQ application itself. That is different from the Identity Cube, which is used to model the user’s enterprise identity and access across connected systems. For example, one Identity Cube may contain links to multiple accounts such as Active Directory, Workday, ServiceNow, database accounts, and cloud application accounts.

Therefore, the proposed definition is inaccurate because it confuses an application login account with the broader identity model used for governance. Reference topics: Identity Modeling, IdentityCube contents, identity attributes, application account links, entitlements, roles, manager correlation, and Identity Warehouse.

Yes. In SailPoint IdentityIQ, the Active period is the main review window of a certification campaign. During this period, assigned certifiers review the certification items and make access decisions such as approve, revoke, delegate, allow exception, or otherwise act according to the certification configuration. This is the required operational phase in which reviewers complete their access review responsibilities before the certification moves into later lifecycle stages.

The Active period is distinct from other certification timing or processing stages. For example, generation prepares the certification contents, while challenge and remediation periods may occur after reviewer decisions depending on campaign configuration. The Active period specifically represents the time when certification decisions are expected to be made by the responsible reviewers.

Therefore, the definition is accurate because it correctly identifies the Active period as the required review period for certification decision-making. Reference topics: Governance, access reviews, certification lifecycle, Active period, certification decisions, certifier work items, challenge period, remediation, and certification sign-off.

The statement is false. The Edit Identity QuickLink is not intended merely to view identity details; its purpose is to initiate an identity modification request. In IdentityIQ, QuickLinks are request-entry mechanisms that expose controlled actions to users based on QuickLink Population rules, capabilities, request configuration, and target permissions. The Edit Identity QuickLink allows an authorized user to update configured identity attributes, typically through a form-driven request process that may include validation, approval, audit tracking, and workflow execution.

Viewing identity details is a separate functional concept. Identity information is normally reviewed through identity search, identity warehouse views, certification access review context, or identity detail pages, where the user can inspect IdentityCube data such as attributes, accounts, roles, entitlements, manager, and policy violations. Edit Identity may display current values so the requester understands what is being changed, but display is contextual, not the primary function.

Therefore, “It is used to view details about an identity” describes a view-oriented function, not the Edit Identity QuickLink. Reference topics: User-Driven Requests, QuickLink Populations, create/edit/self-service identity requests, Identity Modeling, and IdentityCube usage.

No. In SailPoint IdentityIQ, the application name is a configurable label assigned to the application object and does not have to match the connector selected. The application definition represents an external system or source, while the connector defines the technical integration method used to communicate with that system. These are related configuration elements, but they are not the same field and one does not automatically name the other.

For example, an application could be named “Corporate Directory,” “North America Active Directory,” or “HR Source,” while using an LDAP, Active Directory, JDBC, Delimited File, Web Services, or another connector type. The connector selection determines available configuration settings, supported schema behavior, aggregation options, and provisioning capabilities. The application name is used for identification within IdentityIQ, reporting, certifications, requests, policies, and administrative configuration.

Therefore, the statement is incorrect because IdentityIQ applications are not named by the selected connector. They are named by the administrator or implementer according to the business or system context. Reference topics: Applications, application definition, connector selection, connector-dependent settings, schemas, aggregation, and provisioning support.

Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed identifies that attribute as governance-relevant access data. This is commonly applied to attributes that contain entitlement-like values, such as groups, roles, permissions, or application access assignments. When the attribute is managed, IdentityIQ can create and maintain managed attribute records for the values discovered during aggregation, allowing those values to be represented in the entitlement catalog with business metadata such as display name, description, owner, requestability, and classification.

This managed designation supports governance processes, including certifications. In an access review, reviewers need to evaluate meaningful access items rather than raw account data. Managed entitlement values can therefore be surfaced as reviewable access so managers, application owners, or entitlement owners can approve, revoke, or otherwise act on them during certification campaigns.

This does not mean the attribute itself is simply editable in IdentityIQ; editability is controlled separately through provisioning policies, forms, workflows, and connector support. The managed flag is primarily about governing the attribute’s values as access.

Reference topics: Applications — schema attribute properties; Access Modeling — entitlement catalog; Governance — certification review items.

Yes. Granting an IdentityIQ capability is a valid way to provide access to additional functions within SailPoint IdentityIQ, including areas such as Advanced Analytics. Capabilities are part of IdentityIQ’s internal authorization model. They determine what a logged-in user is allowed to see and perform inside the IdentityIQ interface, such as administration, reporting, certification administration, role management, policy management, or advanced search and analysis functions.

Advanced Analytics searches are IdentityIQ functions, not external application permissions. Therefore, access to those search types is governed by IdentityIQ security controls, including capabilities, rights, and in some deployments, scoping. This is different from granting access on a connected application, which would be handled through accounts, entitlements, roles, access requests, and provisioning.

The key distinction is that capabilities grant authority inside IdentityIQ itself. They do not directly modify a user’s access on a target system. Providing access to different types of Advanced Analytics searches is therefore an appropriate reason to assign an IdentityIQ capability.

Reference topics: Identity Modeling — how IdentityIQ access is granted to users; Foundational Concepts — common IdentityIQ objects and components; Governance — analytics and access visibility.

No. QuickLink Populations do not determine which identities can approve access requests. In SailPoint IdentityIQ, QuickLink Populations control the availability and scope of QuickLinks for users. They define who can initiate a specific request action, what type of request can be launched, and in many cases who the request can be submitted for. For example, they may allow an employee to request access for themselves or allow a manager to request access for direct reports.

Approval authority is handled separately through request workflows, approval schemes, approval rules, work item assignment logic, application or role owners, managers, governance groups, or configured business processes. When an access request is submitted, IdentityIQ evaluates the configured approval path to determine which identities receive approval work items. That approval routing is not controlled by the QuickLink Population itself.

Therefore, the statement is inaccurate. QuickLink Populations govern request initiation and visibility, while approval routing is governed by workflow and approval configuration. Reference topics: User-Driven Requests, QuickLink Populations, access request process, approval workflows, work items, and request authorization.