IdentityIQ-Engineer Exam Dumps - SailPoint Identity Security Engineer Questions and Answers

Yes, the text on the login page of IdentityIQ is set through message keys in the message catalog. The message catalog in IdentityIQ contains localized text strings that are used throughout the user interface, including on the login page. By modifying the appropriate message keys in the catalog, you can customize the text that appears on the login page to match the organization ' s branding or messaging requirements.

Therefore, the correct answer is A. Yes.

This is a valid step, with the typo corrected as “create the audit event.” Registering an AuditAction in AuditConfig only defines the custom event type; IdentityIQ still needs executable logic to actually write the audit event when the relevant condition occurs. That logic can be placed in a BeanShell rule, task, workflow step, or other appropriate execution point depending on the business process being audited. The code must create/populate the audit record with the configured action name and the relevant data values, such as target identity, actor, source object, application, attribute values, or other fields needed by the later report. Without this implementation logic, the custom audit action would exist but no audit records would be generated. Therefore, writing the logic to create the audit event is a legitimate step in the end-to-end process. References/topics: IdentityIQ Engineer — BeanShell audit logic, workflow audit events, custom AuditAction usage, audit data population, custom audit reporting.

Identity Attribute is required because IdentityIQ must know which account attribute uniquely identifies an account on the application. During aggregation, IdentityIQ creates Link objects that represent external accounts. Those Link objects need a stable native identity value so IdentityIQ can correlate, track, certify, and provision the correct account. The Identity Attribute identifies the schema attribute that supplies this unique account identifier. Without it, IdentityIQ cannot reliably distinguish one account from another on the target system. This would break core functions such as account aggregation, account correlation, access review, provisioning, and account display on the identity cube. The exact attribute varies by application type: it may be a username, DN, account ID, employee number, database key, or another native account identifier. However, the requirement itself is universal: every onboarded application must have a clear account identity attribute in its schema configuration. References/topics: IdentityIQ Engineer — application schema, identity attribute, native identity, Link objects, aggregation and correlation.

Yes. Add Entitlement is an explicitly supported IdentityIQ batch request type and directly addresses the portion of this scenario where users are missing required access. Lifecycle Manager batch requests enable administrators to prepare a comma-delimited file containing multiple access operations and submit those operations for bulk processing instead of manually requesting access identity by identity.

SailPoint documents the operation name as AddEntitlement. The batch file identifies the application, entitlement attribute name, entitlement value, and either the target account ' s native identity or the IdentityIQ identity name. Multiple identities can therefore receive the required entitlement through a controlled batch process. This makes the operation particularly suitable for regional reorganizations, migrations, remediation projects, or other situations where the same access change must be applied across a defined population.

The scenario also states that some users possess excess entitlements. Those items require the complementary Remove Entitlement operation rather than Add Entitlement. A complete cleanup might therefore involve separate add and removal records—or separate files if processing order matters. Nevertheless, Add Entitlement is unquestionably one supported batch request type that helps meet the stated goal.

References/topics: IdentityIQ Engineer — Batch Requests, AddEntitlement, bulk access remediation, Lifecycle Manager, entitlement provisioning.

=======

No. Setting the length of an IdentityIQ extended String attribute to 9000 is not a supported general mechanism for storing an identity image. The length value in IdentityExtended.hbm.xml influences how Hibernate maps the String property to a database column. It therefore has database-specific consequences and must not be treated as an arbitrary storage-capacity control.

The standard IdentityIQ extended-attribute configuration uses String properties with much smaller lengths—for example, length= " 450 " —specifically so the resulting columns remain suitable for searching and indexing. SailPoint ' s own configuration commentary warns that database platforms have different VARCHAR limitations and that sufficiently large String definitions may cause Hibernate to map the value to a LOB/blob-like type that cannot be used in the same way for searches.

An image is binary content and should not be modeled merely by making an extended searchable String column extremely large. Even an encoded image can exceed practical database/index limits and introduces unnecessary Identity Cube and persistence overhead.

Therefore, length= " 9000 " is not a prescribed IdentityIQ image-storage configuration.

References/topics: IdentityIQ Engineer — IdentityExtended.hbm.xml, extended properties, Hibernate mappings, VARCHAR limits, searchable attributes, database schema design.

=======

This implementation is not correct. The requirement is to return all account names for an identity on the application MagicBox, but the code retrieves only a single Link by calling service.getLink(identity, " MagicBox " ). Even worse, the while (link != null) loop never changes the link variable, so if a link is found, the loop becomes infinite and repeatedly adds the same native identity. A correct implementation must retrieve the application object, obtain all matching Link objects for the identity and application, iterate over that list, and add each link’s native identity once. There is also no visible import for ArrayList or List, although BeanShell environments may sometimes tolerate imports differently. The fatal issue remains the flawed loop and single-link retrieval. IdentityIQ account data is represented by Link objects, and multiple accounts may exist for the same identity on the same application depending on connector and policy design. References/topics: IdentityIQ Engineer — IdentityService, Link objects, native identity, BeanShell API usage, account lookup logic.

This is a valid implementation pattern. The workflow requirement has three routing outcomes, and the proposed solution expresses them as three explicit transition elements. The first transition routes to Stop when the approval flag is false, which corresponds to the Reject or back action. The second transition routes to Audit when the comment variable is not null or empty, using sailpoint.tools.Util.isNotNullOrEmpty(comment). That satisfies the condition that the Approve action was used and the returned form field has a value. The final transition to Provision has no condition, making it the default fallback when the prior transition conditions are not satisfied. This is the correct style for workflow routing because the destination steps are explicitly declared through the to attribute, and the conditional routing is attached to each transition rather than relying on an invalid free-form return block. References/topics: IdentityIQ Engineer — workflow transitions, when conditions, script expressions, form approval routing, default workflow transition behavior.

Yes. This implementation follows the essential IdentityIQ transaction-locking pattern for modifying a persistent SailPoint object. ObjectUtil.transactionLock() retrieves the named Policy object while obtaining a transaction-level database lock. A transaction lock is appropriate when processing needs exclusive access to an object for the duration of a short transaction and must prevent another transaction from updating the same object simultaneously.

After obtaining the locked Policy object, the engineer performs the required changes and then calls context.saveObject(object). saveObject() persists changes to an object derived from SailPointObject; however, persistence is not complete until the transaction is committed. The subsequent context.commitTransaction() therefore completes the modification and releases the transaction-level database lock as the transaction finishes.

SailPoint ' s documented transaction-lock example follows essentially the same sequence: obtain the object using ObjectUtil.transactionLock, modify it, invoke context.saveObject, and commit. Calling context.decache(object) afterward may be useful to remove the object from the context cache, particularly in longer-running processing, but its omission does not invalidate this basic implementation.

References/topics: IdentityIQ Engineer — ObjectUtil, transaction locking, Policy objects, SailPointContext persistence, object save/commit lifecycle.

=======

Yes. Rapid Setup supports standard lifecycle-event actions for Leaver processing, including application-specific account actions and delayed account deletion. This enables an implementation to disable an account when the Leaver event occurs and configure account deletion for a later point, such as 30 days afterward.

This pattern is useful because many organizations do not immediately delete accounts when employment ends. Immediate disablement blocks interactive access while preserving the account temporarily for investigation, handover, retention, reconciliation, or recovery requirements. After the retention interval expires, deletion can remove the target-system account according to the configured lifecycle policy.

The important distinction is that this is a standard timing sequence for the same lifecycle population , rather than complex branching where different categories of users receive entirely different actions. The Word bank already contains a different Rapid Setup proposition involving disabling accounts for one group while deleting accounts for another group during termination, and marks that more complex population-dependent scenario invalid. It also separately tests disable-plus-entitlement-removal during Leaver.

Therefore, this delayed-delete Leaver proposition is unique and valid.

References/topics: IdentityIQ Engineer — Rapid Setup, Leaver events, Disable Account, Delete Account, delayed deletion, lifecycle configuration.

=======

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide