SailPoint IdentityIQ-Engineer - SailPoint Certified IdentityIQ Engineer

Yes. This implementation follows the essential IdentityIQ transaction-locking pattern for modifying a persistent SailPoint object. ObjectUtil.transactionLock() retrieves the named Policy object while obtaining a transaction-level database lock. A transaction lock is appropriate when processing needs exclusive access to an object for the duration of a short transaction and must prevent another transaction from updating the same object simultaneously.

After obtaining the locked Policy object, the engineer performs the required changes and then calls context.saveObject(object). saveObject() persists changes to an object derived from SailPointObject; however, persistence is not complete until the transaction is committed. The subsequent context.commitTransaction() therefore completes the modification and releases the transaction-level database lock as the transaction finishes.

SailPoint ' s documented transaction-lock example follows essentially the same sequence: obtain the object using ObjectUtil.transactionLock, modify it, invoke context.saveObject, and commit. Calling context.decache(object) afterward may be useful to remove the object from the context cache, particularly in longer-running processing, but its omission does not invalidate this basic implementation.

References/topics: IdentityIQ Engineer — ObjectUtil, transaction locking, Policy objects, SailPointContext persistence, object save/commit lifecycle.

=======

Yes, defining account correlation via a rule is an action that can be performed as part of configuring an application definition in SailPoint IdentityIQ. Account correlation rules are often used to determine how accounts from different sources are linked to identities within IdentityIQ. These rules allow for complex logic to be applied when matching accounts to identities, beyond simple attribute matching.

SailPoint IdentityIQ Administration Guide (Section on Account Correlation)

SailPoint IdentityIQ Application Configuration Guide (Using Rules for Account Correlation)

This statement is incorrect. In SailPoint IdentityIQ email templates, entire blocks of text, including whole paragraphs, can indeed be conditionally included or omitted using the appropriate templating syntax such as #if, #else, and #end. The templating engine in IdentityIQ, which typically uses Apache Velocity, supports complex conditional logic that can control large sections of the email content, not just individual lines.

Yes, this is a valid action. When using the Services Standard Build (SSB) in SailPoint IdentityIQ, placing the patch jar file in the build ' s base/patch folder is a correct procedure, provided the patch version matches what the client is using. This allows the build process to incorporate the patch into the deployment, ensuring that the correct versions and fixes are applied to the IdentityIQ instance.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Patching and Version Management Guide

No. The statement is too absolute. IdentityIQ does not always require the scheduled challenge-period duration to expire before sign-off can occur.

When a challenge period is enabled and revocation decisions exist, the related challenge processing must reach an appropriate completed state before the access review can be signed off. However, IdentityIQ documentation explicitly permits sign-off while the certification is in the challenge phase when all items are complete, all applicable revocation decisions have progressed through the challenge procedure, and no open decisions remain.

Expiration of the configured challenge period is another condition that permits the certification to proceed, but it is not the only possible path. In other words, there is an important difference between saying that challenge processing must be complete and saying that the reviewer must always wait until the full scheduled challenge period expires.

SailPoint ' s Access Review documentation lists both conditions independently: completed challenge processing can permit sign-off, or the challenge period can expire.

Therefore, the proposition “cannot be signed off until after the challenge period ends” is technically false.

References/topics: IdentityIQ Engineer — challenge phase, certification sign-off, completed challenges, revocation procedure, certification lifecycle.

=======

Yes. If a user already has an account on an application and needs the ability to request an additional/new account through Manage User Access, the relevant LCM/QuickLink configuration must permit requesting new accounts. The proposed setting, “Allow requesting new accounts,” is specifically aligned with that requirement. Manage User Access and Manage Accounts behavior is controlled through Lifecycle Manager quicklink and population configuration, which determines what actions are visible and available to eligible users. Without enabling new-account requests for the appropriate QuickLink population, the user may only be able to manage existing account access or request entitlements for current accounts, not initiate a new account request on that application. This setting must also align with the application’s provisioning support and account creation policy. The configuration grants the UI/request capability; successful fulfillment still depends on application schema, create policy, approvals, and provisioning workflow. References/topics: IdentityIQ Engineer — LCM, Manage User Access, Manage Accounts QuickLink, QuickLink population, new account request, provisioning policy.

This is not a clean joiner lifecycle event. A joiner event normally represents a person newly entering the organization or being newly onboarded into managed access, usually requiring new identity setup, new accounts, baseline access, roles, approvals, and provisioning. The proposed scenario describes a contractor whose previous relationship ended, whose accounts were disabled, and who now has a new contract requiring previous accounts to be enabled. That is closer to a rehire/reactivation or account-enable lifecycle event than a first-time joiner. The distinction matters in IdentityIQ because a true joiner process may create accounts and assign initial access, while a rehire/reactivation process may restore, enable, or reassess previously existing accounts and access. Treating this as a joiner could create duplicate accounts or duplicate access instead of properly reactivating existing Links/accounts. References/topics: IdentityIQ Engineer — Lifecycle Manager, joiner event, rehire/reactivation, account enablement, identity lifecycle workflow design.

In SailPoint IdentityIQ, what users can see and do is indeed partly controlled by their authorized scope. Authorized scopes define the range of objects (such as identities, roles, applications) that a user has access to. Scopes can be applied to limit access based on specific criteria, ensuring that users only interact with the data and functionalities relevant to their role or responsibility within the organization.

For example, a user with access to a specific scope may only view or manage identities within a certain department or geographical location, depending on how the scope is configured.

Therefore, the correct answer is A. Yes.

No. IdentityIQ does not require a dedicated Catch step to accompany every individual workflow step capable of throwing an exception. Such a requirement would make workflows unnecessarily verbose and would not reflect normal workflow exception-handling design.

Workflow steps can execute scripts, rules, subprocesses, methods, approvals, and other operations, many of which can theoretically throw runtime exceptions. Exception handling can be designed at an appropriate level depending on the workflow ' s requirements. BeanShell logic can explicitly use exception handling where necessary, subprocess behavior can be handled by the calling process, and workflow-level failure processing can deal with unhandled exceptions.

A Catch construct is useful when the workflow needs to intercept a particular failure and intentionally route execution into recovery, cleanup, notification, auditing, or another controlled path. It is therefore an exception-handling mechanism , not a mandatory companion to every potentially failing step.

The Word bank already tests other workflow-step semantics, including the available Script, Rule, Subprocess, and Call Method actions; those are separate concepts from mandatory exception handling. The universal wording “must accompany every step” makes this proposition false.

References/topics: IdentityIQ Engineer — workflow step types, exception handling, Catch processing, BeanShell exceptions, subprocess failure handling, workflow error paths.