IdentityIQ-Associate Exam Dumps - SailPoint Identity Security Engineer Questions and Answers

No. An Identity Cube is not an IdentityIQ account. In SailPoint IdentityIQ, the Identity Cube is the central identity record that represents a person or identity being governed by the platform. It consolidates identity attributes, correlated application accounts, account links, entitlements, assigned roles, detected roles, manager relationship, lifecycle state, policy violations, and other governance-relevant information.

An “IdentityIQ account” usually refers to a login account or user object that allows someone to access the IdentityIQ application itself. That is different from the Identity Cube, which is used to model the user’s enterprise identity and access across connected systems. For example, one Identity Cube may contain links to multiple accounts such as Active Directory, Workday, ServiceNow, database accounts, and cloud application accounts.

Therefore, the proposed definition is inaccurate because it confuses an application login account with the broader identity model used for governance. Reference topics: Identity Modeling, IdentityCube contents, identity attributes, application account links, entitlements, roles, manager correlation, and Identity Warehouse.

Yes. In SailPoint IdentityIQ, an entitlement represents an access right, permission, privilege, group membership, role membership, or similar access-granting value on an application. Entitlements are discovered from application account data during aggregation and are commonly modeled in IdentityIQ through schema attributes marked as entitlement attributes. Once aggregated, these values may appear in the entitlement catalog as managed attributes, where they can be reviewed, requested, certified, governed by policies, and associated with roles.

The definition “an access right on an application” is accurate because entitlements describe what an identity’s account is allowed to do or access within a connected system. Examples include Active Directory group membership, database roles, application permissions, cloud groups, or other system-specific access values. IdentityIQ uses entitlements as core governance objects for certifications, access requests, policy checks, role modeling, and provisioning.

This definition is intentionally broad because different target systems represent access differently. IdentityIQ normalizes those application-specific access values into entitlement concepts for identity governance.

Reference topics: Access Modeling, entitlement catalog, managed attributes, application schema, entitlement aggregation, certifications, access requests, and provisioning.

‘

Yes. In SailPoint IdentityIQ, the Identity Warehouse is used to review identity-centric information stored in the IdentityCube. For identities that are managers, IdentityIQ can display the list of identities that report to that manager. This information is derived from the manager relationship established during identity aggregation, correlation, and identity refresh processing.

The direct-report relationship is not an application account attribute by itself once modeled in IdentityIQ; it becomes part of the identity model. IdentityIQ uses manager correlation to associate each identity with its manager, and when those relationships are resolved, the manager identity can show its subordinate identities as direct reports. This is important for governance because managers are frequently used as certifiers, approvers, and reviewers in access review and request workflows.

The display of direct reports depends on the identity data being populated correctly and the viewer having permission to access the identity details. However, as a functional capability of the Identity Warehouse, direct reports for manager identities are part of the identity information that can be displayed.

Reference topics: Identity Modeling, IdentityCube contents, manager correlation, Identity Warehouse, identity refresh, and governance reviewer relationships.

The statement is true. In SailPoint IdentityIQ, manager relationships are an important part of the identity model and are frequently used by workflows. Once an identity’s manager is resolved through manager correlation, IdentityIQ can use that manager relationship in governance and request processes. A workflow may route an approval work item to the requester’s manager, notify the manager about a submitted request, request a decision during access approval, or involve the manager in lifecycle-related actions such as onboarding, transfer, or termination processing.

Managers are commonly used because they represent business accountability for a user’s access. For example, in an access request workflow, the manager may approve or reject requested roles, entitlements, or accounts before provisioning occurs. In certification workflows, managers may also be assigned review responsibility for their direct reports’ access.

Therefore, IdentityIQ workflows can interact with managers both for approvals and notifications. Reference topics: Identity Modeling — manager correlation and IdentityCube relationships; User-Driven Requests — approval routing; Provisioning — workflow-driven provisioning; Governance — manager certifications and access review ownership.

Yes. In SailPoint IdentityIQ, the Active period is the main review window of a certification campaign. During this period, assigned certifiers review the certification items and make access decisions such as approve, revoke, delegate, allow exception, or otherwise act according to the certification configuration. This is the required operational phase in which reviewers complete their access review responsibilities before the certification moves into later lifecycle stages.

The Active period is distinct from other certification timing or processing stages. For example, generation prepares the certification contents, while challenge and remediation periods may occur after reviewer decisions depending on campaign configuration. The Active period specifically represents the time when certification decisions are expected to be made by the responsible reviewers.

Therefore, the definition is accurate because it correctly identifies the Active period as the required review period for certification decision-making. Reference topics: Governance, access reviews, certification lifecycle, Active period, certification decisions, certifier work items, challenge period, remediation, and certification sign-off.

No. This definition describes a rule more closely than an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the centralized identity model that represents a person or non-person identity inside IdentityIQ. It contains consolidated identity information such as identity attributes, correlated application accounts, assigned and detected roles, entitlements, manager relationship, lifecycle state, policy violations, certifications, and other governance-relevant data.

A “snippet of code containing custom business logic” refers to a BeanShell rule. Rules are executable logic used to customize IdentityIQ behavior in areas such as aggregation, correlation, provisioning, policy evaluation, workflow processing, and identity attribute transformation. They are configuration objects containing code, while Identity Cubes are data/model objects representing identities and their access.

Therefore, the statement is inaccurate because an Identity Cube is not custom code. It is the core identity record used by IdentityIQ for governance, access modeling, policy detection, requests, certifications, and provisioning decisions.

Reference topics: Identity Modeling, IdentityCube contents, identity attributes, correlated accounts, roles and entitlements, BeanShell rules, Foundational Concepts, and IdentityIQ object model.

This is not a correct example of an IdentityIQ policy as stated. IdentityIQ policies are used to detect governance violations based on identity, account, entitlement, role, risk, or activity conditions. An account policy is concerned with whether an identity has an account, lacks a required account, or has an account that violates defined account-related criteria. It evaluates existing identity and account state after data is aggregated and correlated into IdentityIQ.

The phrase “has requested the appropriate account” describes an access request validation concept rather than a policy-detection use case. Requests are handled through the user-driven request and provisioning framework, including QuickLinks, request forms, approvals, workflows, provisioning policies, and provisioning plans. A request can be evaluated, approved, rejected, or fulfilled, but a governance policy is normally not defined to determine whether a request itself was “appropriate.”

IdentityIQ policies detect violations against current or observed access conditions. Therefore, an account policy may check whether an identity has an inappropriate account, but not whether the identity requested the appropriate account. Reference topics: Governance — common policy examples and policy detection; User-Driven Requests — access requests; Provisioning — provisioning process and provisioning policies.

The statement is false. In SailPoint IdentityIQ, connectivity settings are determined by the connector selected for the application definition. An application represents an authoritative source, target system, or managed resource, and the connector defines how IdentityIQ communicates with that system. Because different connectors use different communication models, their required configuration fields are not universal.

For example, an LDAP or Active Directory connector commonly requires server connection details such as host, port, credentials, and search base configuration. A JDBC-based connector may require a JDBC URL, driver class, database credentials, and SQL-related configuration. A delimited file connector does not require a hostname because it reads account and entitlement data from a file location rather than connecting to a network service. Similarly, cloud or API-based connectors may require endpoint URLs, tokens, client credentials, or tenant-specific settings instead of a simple hostname field.

Therefore, hostname cannot be considered a required connectivity setting for every connector type. Required settings are connector-dependent and appear according to the selected connector’s configuration model. Reference topics: Applications, connector selection, application definition, connector-dependent settings, schema configuration, and aggregation prerequisites.

Yes. Aggregation partitioning in SailPoint IdentityIQ is a performance and scalability option used to divide a large aggregation workload into smaller units of work. Instead of processing the entire aggregation as one continuous task on a single execution thread, IdentityIQ can partition the work so multiple task executors can process different portions of the aggregation workload concurrently.

This is especially useful in large environments where applications contain many accounts, groups, or entitlement records. Partitioning can improve throughput by distributing processing across multiple hosts in an IdentityIQ deployment and by allowing multiple threads per host to participate in the aggregation workload. The goal is to reduce total aggregation runtime while maintaining controlled processing of account and entitlement data.

Partitioning is not the same as connector-based delta processing. Delta processing depends on connector support for identifying changed records, while partitioning concerns how the aggregation workload is divided and executed. Therefore, the statement is accurate.

Reference topics: Applications, aggregation task options, aggregation partitioning, account aggregation, performance optimization, task execution, and multi-host processing.

The statement is true in the context of IdentityIQ manager correlation. IdentityIQ does not infer an identity’s manager relationship without source data that identifies the manager. The authoritative application, typically an HR or personnel source, provides the trusted identity records and should include a manager reference attribute, such as manager ID, employee number, username, distinguished name, or another value that can be correlated to an existing IdentityIQ identity.

During aggregation and identity refresh, IdentityIQ uses configured manager correlation logic to resolve that manager reference to an IdentityCube representing the manager. Once resolved, the manager relationship can support governance functions such as manager certifications, access request approvals, lifecycle approvals, escalations, and reporting hierarchy-based controls. Without a manager reference from the authoritative source, IdentityIQ may still contain identities, accounts, and access, but it cannot reliably establish reporting relationships for those identities through standard manager correlation.

This is distinct from manually assigning relationships or using custom logic; the standard governance model expects manager data to originate from the authoritative identity source. Reference topics: Identity Modeling — manager correlation, IdentityCube attributes, authoritative identity data; Governance — manager-based certifications and approvals; User-Driven Requests — manager approval routing.