IdentityIQ-Associate SailPoint Certified IdentityIQ Associate Exam Questions and Answers

No. Defining access conditions that violate business policies is not provisioning. In SailPoint IdentityIQ, this activity belongs to governance and policy configuration. Policies define conditions that IdentityIQ should detect as violations, such as separation-of-duty conflicts, prohibited combinations of access, excessive privilege, or access that conflicts with organizational rules. These policies are evaluated against identities, roles, accounts, and entitlements to identify existing or potential violations.

Provisioning is the execution or fulfillment of access changes. Examples of provisioning include creating an account, modifying account attributes, adding or removing entitlements, disabling an account, deleting an account, or generating manual fulfillment work items. A policy violation may influence provisioning by blocking a request, warning the requester, requiring approval, or triggering remediation, but defining the violation condition itself is not a provisioning action.

Therefore, the described action is governance policy definition, not provisioning. Reference topics: Governance, policy configuration, policy detection, preventive policy checking, Provisioning, provisioning plans, remediation, and access-change fulfillment.

The statement is false. In SailPoint IdentityIQ, groups and populations are used to classify, filter, and organize identities for governance, reporting, certifications, and targeted user experiences. A population is a defined collection of identities, and group factories can dynamically create identity groups based on configured identity attributes. These constructs are useful for segmentation, analysis, and campaign targeting, but they are not the standard objects assigned as owners of IdentityIQ objects.

Ownership in IdentityIQ is normally assigned to an identity or to a workgroup. A workgroup is used when ownership or responsibility must be shared by multiple users, such as application owners, certification owners, entitlement owners, or approval groups. This distinction matters because ownership drives accountability, work item assignment, approvals, escalations, and administrative responsibility. Populations and generated groups do not function as accountable owners in the same way workgroups do.

Therefore, while groups and populations can influence governance scope and visibility, they are not assigned as object owners. Reference topics: Identity Modeling — groups and populations; Foundational Concepts — common objects and usage; Governance — ownership, certifications, and work item responsibility.

No. Lifecycle Events in SailPoint IdentityIQ are not primarily defined to prevent users from violating policies. Lifecycle Events are configured to detect identity-related changes and trigger a business process or workflow in response. Typical examples include joiner, mover, leaver, rehire, or other lifecycle transitions based on changes to identity attributes such as lifecycle state, employment status, department, manager, location, or start and termination dates.

Preventing policy violations is handled through IdentityIQ’s governance and policy framework, especially preventive policy checking during access request processing. Policies define prohibited access conditions, such as separation-of-duty conflicts, and IdentityIQ can warn, block, or route requests when a proposed access change would create a violation.

Lifecycle Events may indirectly support compliance by removing or adjusting access when a user changes status, but their purpose is event-driven lifecycle automation, not policy violation prevention itself. Therefore, this statement is not the correct reason for defining Lifecycle Events.

Reference topics: Provisioning, Lifecycle Events, joiner-mover-leaver processing, workflows, identity attribute changes, Governance, policy detection, and preventive policy checking.

No. In SailPoint IdentityIQ, the application name is a configurable label assigned to the application object and does not have to match the connector selected. The application definition represents an external system or source, while the connector defines the technical integration method used to communicate with that system. These are related configuration elements, but they are not the same field and one does not automatically name the other.

For example, an application could be named “Corporate Directory,” “North America Active Directory,” or “HR Source,” while using an LDAP, Active Directory, JDBC, Delimited File, Web Services, or another connector type. The connector selection determines available configuration settings, supported schema behavior, aggregation options, and provisioning capabilities. The application name is used for identification within IdentityIQ, reporting, certifications, requests, policies, and administrative configuration.

Therefore, the statement is incorrect because IdentityIQ applications are not named by the selected connector. They are named by the administrator or implementer according to the business or system context. Reference topics: Applications, application definition, connector selection, connector-dependent settings, schemas, aggregation, and provisioning support.

The statement is false. In SailPoint IdentityIQ, the Application Name is a logical identifier used to label and distinguish the application object inside IdentityIQ. It does not determine which connector the application uses. The connector is selected separately as part of the application configuration, and that connector selection determines the available connection parameters, supported operations, schema behavior, aggregation capabilities, and provisioning capabilities.

For example, an application could be named “HR System,” “Active Directory,” or “Corporate Accounts,” but the name itself does not cause IdentityIQ to use an LDAP, JDBC, Delimited File, Web Services, or other connector. The selected connector type defines how IdentityIQ communicates with the source or target system. It also influences whether the application can aggregate accounts, discover schema, manage groups, perform provisioning, or write changes back to the managed system.

Therefore, the application name is descriptive metadata, while the connector type is the technical integration mechanism. Reference topics: Applications, application definition, connector selection, connector-dependent settings, schema configuration, aggregation, and provisioning support.

No. This definition does not describe an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the central identity record that represents a person or identity within IdentityIQ. It consolidates identity attributes, correlated application accounts, entitlements, assigned roles, detected roles, manager relationship, policy violations, lifecycle state, and other governance-relevant information. The Identity Cube is the primary object used by IdentityIQ to understand who a user is and what access that user has across connected systems.

The statement given describes provisioning, not an Identity Cube. Provisioning is the process of adding, removing, or modifying a user’s access on an application. Examples include creating an account, changing account attributes, adding an entitlement, removing group membership, disabling an account, or deleting an account.

Therefore, the definition is inaccurate because it describes an access-change process, while an Identity Cube is an identity data model. Reference topics: Identity Modeling, IdentityCube contents, application account correlation, entitlements, roles, Provisioning, account requests, and access-change fulfillment.

No. Marking an attribute as multi-valued does not, by itself, cause IdentityIQ to treat that attribute as an entitlement or include its values in the Entitlement Catalog. In an application schema, the multi-valued setting only indicates that the account attribute can contain more than one value. It describes data structure, not governance meaning.

To include access values in the Entitlement Catalog, the relevant schema attribute must be configured as an entitlement-bearing attribute, or group objects must be properly configured and aggregated through the application’s group schema where applicable. IdentityIQ then recognizes those values as governable access rights and can represent them as managed attributes in the Entitlement Catalog. Once cataloged, they can be reviewed, certified, requested, described, owned, risk-scored, and governed by policy.

For example, an account attribute such as “groups” may be multi-valued, but IdentityIQ must also know that those values represent access rights. Without entitlement configuration, the aggregation stores attribute values on the account but does not properly model them as catalog entitlements.

Reference topics: Access Modeling, Entitlement Catalog, managed attributes, application schema attributes, entitlement attribute configuration, group schema, and account aggregation.

The statement is not technically accurate. In SailPoint IdentityIQ, applications are defined to represent external systems, platforms, directories, databases, or resources from which account, group, entitlement, and attribute data are aggregated, and in some cases to which provisioning changes are written. IdentityIQ does not generally “read identities” directly from applications. Instead, it reads account records and associated attributes from applications, then uses identity correlation, authoritative-source logic, and identity refresh processing to construct or update IdentityCubes.

This distinction is fundamental. An application may be an authoritative source, such as an HR system, where account attributes contribute heavily to identity creation and lifecycle state. However, the object read from the source is still an account or source record, not an IdentityIQ identity object. The identity is modeled inside IdentityIQ after aggregation and correlation occur.

Therefore, the more precise statement is that applications represent systems from which IdentityIQ reads account and access data, not systems from which IdentityIQ simply reads identities. Reference topics: Applications, application definition, account aggregation, authoritative applications, correlation, IdentityCube creation, and Identity Modeling.

Yes. Granting an IdentityIQ capability is a valid way to provide access to additional functions within SailPoint IdentityIQ, including areas such as Advanced Analytics. Capabilities are part of IdentityIQ’s internal authorization model. They determine what a logged-in user is allowed to see and perform inside the IdentityIQ interface, such as administration, reporting, certification administration, role management, policy management, or advanced search and analysis functions.

Advanced Analytics searches are IdentityIQ functions, not external application permissions. Therefore, access to those search types is governed by IdentityIQ security controls, including capabilities, rights, and in some deployments, scoping. This is different from granting access on a connected application, which would be handled through accounts, entitlements, roles, access requests, and provisioning.

The key distinction is that capabilities grant authority inside IdentityIQ itself. They do not directly modify a user’s access on a target system. Providing access to different types of Advanced Analytics searches is therefore an appropriate reason to assign an IdentityIQ capability.

Reference topics: Identity Modeling — how IdentityIQ access is granted to users; Foundational Concepts — common IdentityIQ objects and components; Governance — analytics and access visibility.

Yes. In SailPoint IdentityIQ, the Identity Warehouse is used to review identity-centric information stored in the IdentityCube. For identities that are managers, IdentityIQ can display the list of identities that report to that manager. This information is derived from the manager relationship established during identity aggregation, correlation, and identity refresh processing.

The direct-report relationship is not an application account attribute by itself once modeled in IdentityIQ; it becomes part of the identity model. IdentityIQ uses manager correlation to associate each identity with its manager, and when those relationships are resolved, the manager identity can show its subordinate identities as direct reports. This is important for governance because managers are frequently used as certifiers, approvers, and reviewers in access review and request workflows.

The display of direct reports depends on the identity data being populated correctly and the viewer having permission to access the identity details. However, as a functional capability of the Identity Warehouse, direct reports for manager identities are part of the identity information that can be displayed.

Reference topics: Identity Modeling, IdentityCube contents, manager correlation, Identity Warehouse, identity refresh, and governance reviewer relationships.

Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed designates that the values discovered for that attribute are treated as managed entitlement values and promoted into the Entitlement Catalog. This is typically used for attributes that represent access, such as groups, roles, permissions, profiles, or other application-specific entitlement assignments. During aggregation, IdentityIQ reads account data from the application. When a schema attribute is marked as managed, the distinct values of that attribute can become ManagedAttribute objects, allowing IdentityIQ to govern them as cataloged access items.

This catalog promotion is important because raw technical values often need business context before they can be reviewed, requested, approved, certified, or reported on. The Entitlement Catalog can store metadata such as display name, description, owner, requestability, classification, and other governance attributes. These values then become usable in access certifications, access requests, reports, policy evaluation, and role modeling.

Therefore, the statement accurately describes the managed attribute function. Reference topics: Applications — account schema attribute properties; Access Modeling — entitlement catalog; Governance — certification content and entitlement review.

The statement is true. In SailPoint IdentityIQ, groups and populations are identity-segmentation mechanisms used to define sets of identities that share specific characteristics. A population is typically a saved collection of identities based on search criteria or defined membership logic. A group factory can dynamically generate identity groups based on identity attributes, such as department, location, cost center, job title, or business unit.

These constructs are useful because many IdentityIQ operations should not apply to the entire identity population. They allow administrators to scope or target actions to the relevant identities only. For example, populations and groups can support targeted reporting, focused analysis, certification scoping, and other governance activities where only a defined subset of identities should be included. This improves accuracy, reduces review noise, and aligns governance activity with business structure.

They should not be confused with ownership objects such as workgroups. Their primary purpose is identity grouping and operational targeting, not shared ownership accountability.

Reference topics: Identity Modeling — groups and populations; Governance — certification targeting and reporting scope; Foundational Concepts — business modeling and identity segmentation.

The statement is false. In SailPoint IdentityIQ, connectivity settings are determined by the connector selected for the application definition. An application represents an authoritative source, target system, or managed resource, and the connector defines how IdentityIQ communicates with that system. Because different connectors use different communication models, their required configuration fields are not universal.

For example, an LDAP or Active Directory connector commonly requires server connection details such as host, port, credentials, and search base configuration. A JDBC-based connector may require a JDBC URL, driver class, database credentials, and SQL-related configuration. A delimited file connector does not require a hostname because it reads account and entitlement data from a file location rather than connecting to a network service. Similarly, cloud or API-based connectors may require endpoint URLs, tokens, client credentials, or tenant-specific settings instead of a simple hostname field.

Therefore, hostname cannot be considered a required connectivity setting for every connector type. Required settings are connector-dependent and appear according to the selected connector’s configuration model. Reference topics: Applications, connector selection, application definition, connector-dependent settings, schema configuration, and aggregation prerequisites.

Yes. In SailPoint IdentityIQ, BeanShell rules used during aggregation are optional processing extensions, and task configuration can control whether rule processing is applied for a particular aggregation run. Aggregation itself is performed through the application definition, connector, schema, and aggregation task. Rules may be added to customize behavior, such as transforming incoming account data, applying custom correlation logic, handling identity creation, or modifying account information before it is stored.

Because rules can significantly affect aggregation behavior, IdentityIQ provides task-level controls that allow administrators to disable rule processing when appropriate. This can be useful for testing connector behavior, isolating troubleshooting scenarios, improving performance during certain runs, or validating source data without custom transformation logic. When rule processing is disabled, aggregation relies on standard connector and configuration behavior rather than custom BeanShell execution.

Therefore, the statement is accurate. Rule execution is not mandatory for aggregation and can be controlled from the task definition. Reference topics: Applications, aggregation tasks, BeanShell rules, connector configuration, account schema, correlation rules, creation rules, and aggregation task options.

Yes. In SailPoint IdentityIQ, correlation logic can be specified for authoritative applications. An authoritative application is commonly used as a trusted source for identity data, such as HR or another system of record. During aggregation, IdentityIQ reads account or source records from the application and uses correlation logic to determine whether each record should be linked to an existing IdentityCube or used in identity creation and update processing.

Correlation logic may be configured using account attributes, identity attributes, or correlation rules. For example, an authoritative source may correlate records by employee ID, user name, email address, or another unique identifier. This ensures that incoming authoritative data updates the correct identity instead of creating duplicates or leaving records uncorrelated.

The authoritative nature of the application does not eliminate the need for correlation. It defines the trust level and identity-data role of the source, while correlation defines how records from that source are matched to identities in IdentityIQ.

Reference topics: Applications, authoritative applications, correlation options, account aggregation, IdentityCube creation, identity attribute mapping, and uncorrelated account resolution.

No. This statement does not accurately describe role acquisition in IdentityIQ. Business roles are not restricted to being requested only by managers. In IdentityIQ, roles may be acquired through role assignment logic, role detection, access requests, or administrative action, depending on the role configuration and the organization’s request model.

A business role commonly represents access associated with a business function, job, department, location, or organizational responsibility. Users may receive business roles automatically when their identity attributes satisfy configured role profiles or assignment rules, typically recalculated during Identity Refresh. Separately, roles may be made requestable through Lifecycle Manager and exposed through QuickLinks, where request eligibility is controlled by QuickLink Populations, request configuration, and workflow rules.

Managers may be allowed to request roles for direct reports, but that is only one possible configuration. IdentityIQ can also allow users to request roles for themselves, allow delegated requesters to request for others, or restrict requests to specific populations.

Therefore, “only requested by managers” is too narrow and incorrect. Reference topics: Access Modeling, business roles, role assignment, role detection, Identity Refresh, User-Driven Requests, QuickLink Populations, and role request configuration.

No. QuickLink Populations do not determine which identities can approve access requests. In SailPoint IdentityIQ, QuickLink Populations control the availability and scope of QuickLinks for users. They define who can initiate a specific request action, what type of request can be launched, and in many cases who the request can be submitted for. For example, they may allow an employee to request access for themselves or allow a manager to request access for direct reports.

Approval authority is handled separately through request workflows, approval schemes, approval rules, work item assignment logic, application or role owners, managers, governance groups, or configured business processes. When an access request is submitted, IdentityIQ evaluates the configured approval path to determine which identities receive approval work items. That approval routing is not controlled by the QuickLink Population itself.

Therefore, the statement is inaccurate. QuickLink Populations govern request initiation and visibility, while approval routing is governed by workflow and approval configuration. Reference topics: User-Driven Requests, QuickLink Populations, access request process, approval workflows, work items, and request authorization.

Detecting and addressing inappropriate access is a core purpose of Identity Governance and Administration in SailPoint IdentityIQ. IdentityIQ is designed to provide visibility into who has access, what access they have, how that access was obtained, whether it is appropriate, and what corrective action should occur when access violates business or security policy. Inappropriate access may be identified through access certifications, policy violations, role analysis, entitlement review, account aggregation, and identity correlation.

IdentityIQ supports this purpose by building IdentityCubes that consolidate identity, account, entitlement, role, and manager data from connected applications. Once access is visible, governance controls such as certifications allow managers, application owners, or entitlement owners to approve, revoke, or delegate access decisions. Policies can also detect toxic combinations, prohibited access, or access inconsistent with business rules. Remediation can then be routed through provisioning, work items, or manual fulfillment processes.

Therefore, the statement aligns directly with IGA and IdentityIQ’s identity security model. Reference topic: Foundational Concepts — purpose of identity security; also related to Governance — certifications, policy detection, and remediation.