SailPoint IdentityIQ-Engineer - SailPoint Certified IdentityIQ Engineer

This scenario describes an employee quitting their job and needing all of their accounts disabled, which aligns with a leaver lifecycle event rather than a mover event. A leaver event typically involves the deactivation of accounts and removal of access for users who are leaving the organization entirely, whereas a mover event involves changes to roles or access as part of an internal transition (e.g., promotion, transfer).

Therefore, the correct answer is B. No.

No. This is not a correct procedure. IMAP is a protocol used to retrieve/read mail from a mailbox; it is not the normal protocol IdentityIQ uses to send generated notification emails. IdentityIQ email notification delivery is based on SMTP configuration, including SMTP host, port, authentication, and security settings where required. For non-production testing, engineers generally avoid sending test notifications to real user mailboxes. A safer approach is to configure email redirection, a test SMTP server, or a controlled mailbox so workflow, certification, approval, and lifecycle emails can be validated without accidentally notifying real users. The proposed solution is flawed in two ways: it uses IMAP as though it were a sending mechanism, and it suggests verifying delivery to mailboxes specified on Identity objects, which is risky in a non-production test. References/topics: IdentityIQ Engineer — SMTP mail settings, email notification testing, non-production safety, mail redirection, workflow/certification notifications.

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

This proposed solution is incorrect. A create-type lifecycle event trigger is used when a new identity is created or first detected in IdentityIQ. The requirement is not about a new identity; it is about an existing identity whose Division attribute changes from IT to Senior IT. That is an update or attribute-change scenario. A create event would not reliably fire when an existing user’s Division attribute is modified during aggregation or identity refresh. It also does not address the second required condition: the user must be a manager. The correct approach must detect the specific attribute transition and then evaluate the manager condition. Using a create trigger would either never launch the workflow for the intended case or launch it only at identity creation time, which is outside the stated requirement. This is a basic but important lifecycle-event design distinction: joiner/create events are not substitutes for mover or attribute-change events. References/topics: IdentityIQ Engineer — lifecycle events, create triggers, attribute-change triggers, mover events, identity refresh processing.

This solution correctly addresses the client ' s requirement. By setting the membership match list to " All " and configuring " Who can members request for? " as " share attributes with the requester, " with the attribute set to location, the system ensures that users in the " Management " workgroup can only request roles and entitlements for other users who share the same location. This setup effectively filters based on the location attribute, aligning with the client ' s needs.

The " Delete Entitlement " batch request type is not designed for cleaning up access by correcting or updating entitlements in bulk. Instead, " Delete Entitlement " is used to remove specific entitlements from the system entirely, which may not be what is needed if the goal is to correct incorrect entitlements (e.g., removing excess entitlements while adding missing ones). For the scenario described, where users need their entitlements corrected, other batch processes such as " Update Entitlement, " " Revoke Access, " or specific role re-assignment processes would be more appropriate.

SailPoint IdentityIQ Batch Request Types Documentation

SailPoint IdentityIQ Administration Guide (Entitlement Management Sections)

An AfterProvisioning rule in SailPoint IdentityIQ is typically used to execute custom logic after the provisioning process has been completed successfully. However, if provisioning fails, this rule will not be triggered because it is specifically designed for post-successful provisioning activities. To log an error message in the audit record when provisioning fails, a better approach would be to use a provisioning error handler or configure a specific workflow that captures errors and logs them accordingly. The AfterProvisioning rule is not the correct solution for this use case. Refer to the SailPoint IdentityIQ Provisioning and Workflow documentation for appropriate methods of handling provisioning errors and audit logging.

Allowing a user to create a new identity cube in IdentityIQ is not a scenario that can be achieved through QuickLink populations. QuickLink populations are used to define which users have access to specific QuickLinks or tasks in the IdentityIQ interface. They do not control the creation of identity cubes, which is a function typically handled through the aggregation process, API calls, or specific administrative actions within the IdentityIQ platform. The creation of an identity cube involves data import and transformation processes, not just a UI-level permission.

Therefore, the correct answer is B. No.

Creating a custom audit event and setting up an associated report involves steps such as defining the audit event, modifying the audit configuration, and creating a custom report using the SailPoint IdentityIQ reporting framework. Simply creating a Data Export task does not fulfill these requirements. A Data Export task is used for exporting data from IdentityIQ and is unrelated to the creation of custom audit events or custom reports. Refer to the SailPoint IdentityIQ Reporting Guide and the IdentityIQ Audit Framework documentation for more information on correctly creating and configuring custom audit events and reports.

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.