SailPoint IdentityIQ-Engineer - SailPoint Certified IdentityIQ Engineer

This is a valid step. To create a custom audit event in IdentityIQ, the event/action must be registered so the audit framework recognizes it. Adding an AuditAction entry in the AuditConfig object XML is the correct type of configuration because it defines the audit action name, display name, and enabled state. The name value is the internal audit action identifier that code, rules, workflows, or tasks can use when writing audit records. The displayName provides the readable label, and enabled= " true " allows the event to be captured. This step alone is not the entire solution because the engineer must also write logic to create the audit record and configure a report to query and display it. However, the question asks whether this is one of the required steps, and it is. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction XML, custom audit actions, audit event enablement, audit report setup.

The four minimum steps necessary to extend attributes in an IdentityIQ database after it has been created, in the correct order, are:

Update the corresponding hibernate file with the new attributes.

The Hibernate mapping file needs to be updated with the new attributes so that the SailPoint IdentityIQ application is aware of the new columns or properties in the database. This step ensures that the object-relational mapping (ORM) reflects the updated data model.

Run the command to generate the script to update the IdentityIQ database.

After updating the Hibernate file, a schema update script is generated. This script contains the necessary SQL commands to modify the database schema based on the new attributes added in the Hibernate file.

Shut down the application server and then run the generated extendedSchema script on the IdentityIQ database.

Before applying schema changes, the application server must be stopped to avoid any transactional conflicts. Afterward, the extendedSchema script is run on the database to apply the new attributes.

Start the application server and update the corresponding ObjectConfig.

Once the database schema is updated, restart the IdentityIQ application server and modify the ObjectConfig in SailPoint to register the new attributes for use within the IdentityIQ platform.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Updating the Hibernate File: This step involves modifying the Hibernate XML or annotation-based mapping files to reflect the new attributes that are being added to the database. SailPoint IdentityIQ uses Hibernate as its ORM, and any new database fields must first be defined at this layer.

Generating the Schema Update Script: SailPoint provides a command (usually via iiq console or build tools) that reads the updated Hibernate mapping and generates a database-specific script to alter the schema. This ensures that the database is modified in a way that matches the application ' s expectations.

Running the Schema Update Script: With the application server stopped, the schema update script is executed on the database. This step adds the new columns, indexes, or constraints that are required for the extended attributes.

Updating the ObjectConfig: Once the database is updated and the application server is running again, the ObjectConfig (typically located in the IdentityIQ admin UI) must be updated to incorporate the new fields. This step ensures that these new attributes are accessible to workflows, forms, and identity data within the system.

SailPoint IdentityIQ Installation and Configuration Guide (sections on extending the data model and schema updates).

Adding a new object attribute to the Application ObjectConfig in IdentityIQ is not sufficient on its own to generate the database script needed to extend Application attributes. This action updates the configuration within IdentityIQ for how the application object is managed, but it does not produce the necessary SQL scripts to modify the underlying database schema. The actual database schema must be extended using specific IdentityIQ tools and commands like iiq extendedSchema.

SailPoint IdentityIQ Configuration Guide (ObjectConfig and Schema Management)

SailPoint IdentityIQ Administration Guide (Database Schema Extension)

In SailPoint IdentityIQ, certain objects, such as the Link object, cannot be directly extended by updating the corresponding .HBM (Hibernate Mapping) file. Modifying or extending core IdentityIQ objects typically requires a deeper level of customization involving the extension of the application schema and possibly custom Java code. The .HBM files are part of IdentityIQ ' s internal persistence framework, and altering them is not a supported or recommended method for extending objects in a production environment. Customization should instead be done using SailPoint’s supported extension points, such as using ManagedAttributes or CustomAttributes within the IdentityIQ application framework. For guidelines on extending IdentityIQ objects, refer to the SailPoint IdentityIQ Customization Guide and best practices documentation.

Top of Form

Bottom of Form

The statement is incorrect. When writing and executing source mapping rules to populate identity attributes, the rule itself does not need to persist the identity attribute to the database. In SailPoint IdentityIQ, once the value for an identity attribute has been calculated by a source mapping rule, IdentityIQ automatically handles the persistence of this attribute to the database as part of the aggregation or provisioning process. The developer does not need to explicitly persist the attribute; this is managed by the system.

SailPoint IdentityIQ Source Mapping Guide

SailPoint IdentityIQ Administration Guide (Aggregation and Attribute Mapping Sections)

No. IdentityIQ report execution is based on task/report scheduling behavior, and the platform is not limited to running reports only once per day. Reports can be executed manually or scheduled according to supported scheduling options, depending on task configuration and administrative requirements. A daily schedule is only one possible cadence. IdentityIQ reporting is built on task infrastructure, and report templates can generate report instances based on selected parameters, filters, and schedules. In real deployments, organizations may schedule reports daily, weekly, monthly, or at other configured intervals depending on governance, compliance, and operational needs. The proposed solution is too restrictive because it says “at most once per day,” which incorrectly imposes a limitation that is not inherent to IdentityIQ reporting. The accurate concept is that reports can be scheduled, but the frequency depends on the task scheduler configuration and the report’s business purpose. References/topics: IdentityIQ Engineer — reporting, report templates, scheduled reports, task execution, report instances.

When setting up a new IdentityIQ test environment, it is important to assess the needs of the customer, including whether they would benefit from using a deployment accelerator.

Deployment accelerators are pre-configured sets of rules, policies, and workflows that can significantly reduce the time and effort required to deploy IdentityIQ in a test or production environment. These accelerators are particularly useful for rapidly setting up environments that align with common industry practices or specific compliance requirements.

Asking the customer whether they need a deployment accelerator is a valid and important question during the initial setup phase, as it helps to determine the best approach to configuring the test environment efficiently. Therefore, the correct answer is A. Yes.

This statement is not correct. IdentityIQ syslog event searching is not limited only to Incident Code lookups. Incident Code is useful when a user-facing error displays a code that can be traced back to a logged system event, but syslog analysis is broader than that. Administrators and engineers use syslog data to investigate operational errors, workflow failures, connector issues, provisioning errors, aggregation failures, authentication problems, and application exceptions. Advanced Analytics and log-search capabilities are intended to help filter and locate system events using more than a single incident-code value. Treating Incident Code as the only searchable attribute would make syslog analysis nearly useless for routine troubleshooting where no user-facing incident code is available. The correct engineering view is that Incident Code is one important search key, not the exclusive search mechanism. References/topics: IdentityIQ Engineer — syslog search, Advanced Analytics, incident code troubleshooting, system-error diagnosis, operational logging.

An Account Group Membership Certification is designed to certify group memberships within accounts, typically focusing on the validation of access within specific account groups (e.g., Active Directory groups).

This type of certification does not directly address the accuracy of role composition or the correctness of entitlements assigned within roles. Since the bank ' s goal is to ensure that all roles include the correct entitlements, an Account Group Membership Certification is not suitable for this purpose.

Thus, the correct answer is B. No.

No, the " Email Protocol " is not a setting that an engineer must set up to ensure successful communication with the SMTP server. Instead, the essential settings include the mail server address, port, authentication details (like username and password if required), and possibly the security settings (such as SSL/TLS). While the email protocol (e.g., SMTP) is implicitly involved, it is not a specific setting that needs to be configured separately within IdentityIQ. The critical setup revolves around configuring the mail server connection parameters.

SailPoint IdentityIQ Configuration Guide (Email and Notification Settings)

SailPoint IdentityIQ Administration Guide (SMTP Configuration for Email Notifications)