SailPoint IdentityIQ-Engineer - SailPoint Certified IdentityIQ Engineer

This implementation is not correct. The requirement is to return all account names for an identity on the application MagicBox, but the code retrieves only a single Link by calling service.getLink(identity, " MagicBox " ). Even worse, the while (link != null) loop never changes the link variable, so if a link is found, the loop becomes infinite and repeatedly adds the same native identity. A correct implementation must retrieve the application object, obtain all matching Link objects for the identity and application, iterate over that list, and add each link’s native identity once. There is also no visible import for ArrayList or List, although BeanShell environments may sometimes tolerate imports differently. The fatal issue remains the flawed loop and single-link retrieval. IdentityIQ account data is represented by Link objects, and multiple accounts may exist for the same identity on the same application depending on connector and policy design. References/topics: IdentityIQ Engineer — IdentityService, Link objects, native identity, BeanShell API usage, account lookup logic.

Yes, the sets of columns displayed in most tables in the IdentityIQ user interface are controlled by entries in the ColumnConfig elements of the UIConfig object. The UIConfig object in IdentityIQ is responsible for defining various aspects of the user interface, including the configuration of columns that are displayed in tables throughout the application. By modifying the ColumnConfig elements within this object, administrators can customize which columns appear in specific tables, including their order, visibility, and labels.

Therefore, the correct answer is A. Yes.

Yes. Attesting assignment of roles to users is a valid purpose of an IdentityIQ certification. Role-based governance depends not only on whether roles contain the correct entitlements, but also on whether the correct users hold those roles. A certification can ask reviewers to validate role membership, confirm that role assignments are appropriate for job function, and revoke or remediate role assignments that are no longer justified. This is especially important in environments where role assignment rules, business roles, or automated provisioning logic are used. If the rule assigns a role to the wrong population, users may inherit incorrect access even if the role composition itself is technically correct. Certification provides a formal review and sign-off process, creating accountability and audit evidence. Therefore, attesting role assignment to users is squarely within IdentityIQ certification functionality. References/topics: IdentityIQ Engineer — role membership certification, access review, role assignment attestation, certification sign-off, remediation decisions.

When setting up a new IdentityIQ test environment, it is important to assess the needs of the customer, including whether they would benefit from using a deployment accelerator.

Deployment accelerators are pre-configured sets of rules, policies, and workflows that can significantly reduce the time and effort required to deploy IdentityIQ in a test or production environment. These accelerators are particularly useful for rapidly setting up environments that align with common industry practices or specific compliance requirements.

Asking the customer whether they need a deployment accelerator is a valid and important question during the initial setup phase, as it helps to determine the best approach to configuring the test environment efficiently. Therefore, the correct answer is A. Yes.

Yes. IdentityIQ role configuration can support conditional role requestability and assignment logic. A role does not have to be universally requestable for every identity. Engineers can restrict role availability through role configuration, assignment logic, population rules, request controls, or related role requirements depending on the implementation design. The proposed solution describes a role that can only be requested if the target user already has a related role. That is a valid access-governance pattern because role models often contain dependency relationships, prerequisites, or related-role structures. For example, a business role may make another IT role or application role meaningful only when the identity already satisfies a prerequisite access condition. This type of restriction prevents users from requesting access that is inappropriate outside a defined role relationship. The important engineering point is that IdentityIQ roles are not just static entitlement containers; they can include assignment rules, profiles, permitted/requestable behavior, and relationships that influence when they are visible or eligible during access requests. References/topics: IdentityIQ Engineer — role model design, requestable roles, role relationships, assignment rules, access-request governance.

The statement " The Identity object is passed to the rule " is correct. When writing source mapping rules to populate identity attributes, the Identity object is indeed passed to the rule. This allows the rule to access and modify attributes on the Identity object based on the logic defined within the rule.

Therefore, the correct answer is A. Yes.

This is a valid step, with the typo corrected as “create the audit event.” Registering an AuditAction in AuditConfig only defines the custom event type; IdentityIQ still needs executable logic to actually write the audit event when the relevant condition occurs. That logic can be placed in a BeanShell rule, task, workflow step, or other appropriate execution point depending on the business process being audited. The code must create/populate the audit record with the configured action name and the relevant data values, such as target identity, actor, source object, application, attribute values, or other fields needed by the later report. Without this implementation logic, the custom audit action would exist but no audit records would be generated. Therefore, writing the logic to create the audit event is a legitimate step in the end-to-end process. References/topics: IdentityIQ Engineer — BeanShell audit logic, workflow audit events, custom AuditAction usage, audit data population, custom audit reporting.

Yes, this action can be performed as part of configuring an application definition in IdentityIQ. When defining an application, you can specify provisioning policies, including which users should be provisioned with a basic account as part of a joiner event. This is typically done by setting up account creation rules or provisioning policies that trigger when a new user (joiner) is detected, ensuring they receive the necessary basic accounts and entitlements.

Therefore, the correct answer is A. Yes.

No. Specifying which applications support new account requests is not normally achieved by changing control variables in the out-of-the-box LCM workflows. That behavior is driven by application configuration, provisioning support, account creation policies, schemas, QuickLink configuration, and requestability settings. LCM workflow control variables influence how an already-launched workflow behaves: approval handling, policy checking, provisioning behavior, notifications, foreground/background behavior, trace/debug options, and similar execution controls. They do not define whether an application itself supports account creation. For an application to support new-account requests, the application must support provisioning, have the relevant create-account capability/configuration, and expose the request path through LCM/QuickLink settings. Putting this into workflow control variables would be the wrong design layer. References/topics: IdentityIQ Engineer — LCM workflows, control variables, application provisioning configuration, Create Account policy, Manage Accounts/Manage User Access.

Yes. Bundle is the IdentityIQ object model class used for roles, and it can be extended to store client-specific role metadata through the supported extended schema process. Custom role programs often require extra attributes on roles, such as risk category, ownership tier, regulatory classification, business unit, lifecycle state, approval model, or migration metadata. Updating the corresponding Hibernate mapping file is part of how persistent object extensions are introduced. However, the mapping update is only one step. The engineer must generate the database schema update script, apply it to the database in the correct operational state, and update ObjectConfig so IdentityIQ understands and exposes the custom attribute properly. The Word bank describes this same extension sequence: update the mapping layer, generate the schema script, run it on the IdentityIQ database, then update ObjectConfig after restart. Therefore, Bundle is a valid object for this type of client-specific data extension. References/topics: IdentityIQ Engineer — Bundle object, role extension, Hibernate mapping, extended schema, ObjectConfig, database schema update.