SailPoint IdentityIQ-Engineer - SailPoint Certified IdentityIQ Engineer

No. A ManagedAttribute in IdentityIQ represents a managed value of an application attribute, most commonly an entitlement or account-group value that IdentityIQ can govern, certify, request, or provision. It is not the object used to define the “type” of an account, such as service account or privileged account. Account information aggregated from an application is represented through Link objects associated with an Identity. The Application object defines the connected system, schema, connector configuration, and aggregation/provisioning behavior. A Bundle represents a role. ManagedAttribute objects are typically used when an application schema attribute is marked as managed, such as group membership, permission, role, or entitlement values. Account type classifications may be represented as attributes on a Link or through identity/account metadata, but calling that a ManagedAttribute definition is technically wrong. This question tests whether the engineer understands the IdentityIQ object model and does not confuse entitlements with account records. References/topics: IdentityIQ Engineer — Application object, Identity object, Link object, Bundle/role object, ManagedAttribute entitlement model.

In SailPoint IdentityIQ, the configuration in IdentityExtended.hbm.xml file as shown in the image indeed outlines the use of extended identity attributes. These attributes (extended1, extended2, etc.) are custom attributes that are appended to the standard identity object model to store additional identity-related data.

According to the official SailPoint IdentityIQ documentation, when defining identity mappings under Global Settings > Identity Attributes, only up to 12 additional attributes can be made searchable within the IdentityIQ system. This limitation is crucial because it directly impacts the efficiency of search operations in large environments, where making too many attributes searchable can significantly slow down performance.

Once you define these 12 searchable attributes, any additional attributes can still be added, but they will not be indexed for search operations. This means that while the data in these attributes can be used in workflows, reports, and other operations, they cannot be used in search filters in the IdentityIQ user interface.

This limitation is particularly important when planning the design of the identity schema, as it affects both performance and usability. Therefore, the statement in question is correct and accurately reflects the constraints imposed by SailPoint IdentityIQ in terms of searchable identity attributes.

The " Name " configuration option is required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Name " field is a mandatory identifier for the application within IdentityIQ. This name is used throughout the system to reference the application and is critical for configuration, management, and integration processes. Without specifying a name, IdentityIQ cannot properly identify and interact with the SCIM 2.0 application.

SailPoint IdentityIQ SCIM 2.0 Application Configuration Guide

SailPoint IdentityIQ Administration Guide (Application Setup and Naming Conventions)

A Role Membership Certification is appropriate for this requirement because the hospital is trying to confirm that users assigned to a role are correct. The test is not about whether the role contains the right entitlements; that would point to Role Composition Certification. It is also not primarily about application ownership or account group membership. The wording says the business analysts want to verify the role assignment rules by certifying the users who have been assigned the role. That maps directly to a membership review: who is in the role, whether each membership is valid, and whether the assignment rule is producing the expected population. The security team can be configured as the certifier, final reviewer, or sign-off participant depending on certification ownership and sign-off configuration. Therefore, the proposed certification type achieves the stated goal. References/topics: IdentityIQ Engineer — Role Membership Certification, role assignment rules, certification ownership, sign-off, access review routing.

No, this is not a valid action. When setting up or using the Services Standard Build (SSB) for a SailPoint IdentityIQ instance, the client ' s identityiq.war file should not be placed in the home directory of the build. The WAR file should be deployed to the appropriate application server ' s deployment directory, not in the home directory of the build itself. The SSB process typically involves more structured deployment processes that adhere to best practices for application deployment.

SailPoint IdentityIQ Services Standard Build Guide

SailPoint IdentityIQ Deployment Best Practices

No. Identity search is designed to search Identity objects and identity-related attributes, not to count certification campaigns or certification items in a specific lifecycle phase. “Revocation phase” belongs to the certification/remediation process, not the Identity object itself. To identify the number of certifications currently in revocation, an engineer should use certification search, certification reports, task/report output, or direct certification-related reporting depending on implementation permissions. Using Identity search would return identities, not certification phase counts. Even if an identity is involved in a revocation action, the certification’s phase/status is not the primary searchable object in Identity search. This is similar to the Word bank’s distinction that Syslog search is for log events and not for unrelated governance object queries. The proposed use case is therefore outside the Identity search type’s purpose. References/topics: IdentityIQ Engineer — Identity search, certification lifecycle, revocation phase, certification reporting, Advanced Analytics.

Yes. Bundle is the IdentityIQ object model class used for roles, and it can be extended to store client-specific role metadata through the supported extended schema process. Custom role programs often require extra attributes on roles, such as risk category, ownership tier, regulatory classification, business unit, lifecycle state, approval model, or migration metadata. Updating the corresponding Hibernate mapping file is part of how persistent object extensions are introduced. However, the mapping update is only one step. The engineer must generate the database schema update script, apply it to the database in the correct operational state, and update ObjectConfig so IdentityIQ understands and exposes the custom attribute properly. The Word bank describes this same extension sequence: update the mapping layer, generate the schema script, run it on the IdentityIQ database, then update ObjectConfig after restart. Therefore, Bundle is a valid object for this type of client-specific data extension. References/topics: IdentityIQ Engineer — Bundle object, role extension, Hibernate mapping, extended schema, ObjectConfig, database schema update.

In SailPoint IdentityIQ, the specific configuration that allows a user to enable an account for themselves or a subordinate through the " Manage Accounts " option does not necessarily need to be configured in Lifecycle Manager (LCM) alone. While LCM does provide extensive capabilities for account management actions like provisioning, rehire, and more, enabling an account is primarily tied to the permissions and entitlements granted to the user through their role, capabilities, and access profiles.

To address the specific functionality described:

Manage Accounts is typically a part of IdentityIQ’s broader account management capabilities, which are not exclusively tied to LCM. The ability to enable or disable accounts can be governed by rules and workflows within IdentityIQ, and these may or may not be linked directly to LCM configurations.

Rehire Action in LCM: The " Rehire " action within LCM Configuration is specific to processes related to reactivating an employee’s identity when they are rehired. This does not directly relate to enabling an account from the " Manage Accounts " screen. Rehire workflows typically involve reinstating the user’s previous access, which could include enabling accounts, but this is a broader process.

Permissions and Roles: The ability to enable accounts is often governed by the permissions assigned to a user’s role within IdentityIQ. These permissions may be granted outside of LCM configurations and handled by IdentityIQ’s access governance framework.

Workflow Configurations: Enabling or disabling an account could also be tied to specific workflows, which can be configured separately from LCM, using IdentityIQ’s workflow engine. These workflows determine the steps and approvals required to perform such actions.

SailPoint IdentityIQ Configuration Guide: Account Management

SailPoint IdentityIQ Lifecycle Manager Configuration Guide

SailPoint IdentityIQ Administration Guide (Sections on Roles and Permissions, Workflow Configurations)

The statement that the Debug-Logging page does not have to be reloaded when the log4j file is altered while the application server is running is incorrect. In SailPoint IdentityIQ, if you modify the log4j configuration file while the application is running, you generally need to reload the Debug-Logging page to reflect those changes. Without reloading, the page will not display the updated logging configurations, and the changes will not take effect until the application server or the logging system within the server acknowledges those changes.

Therefore, the correct answer is B. No.