SailPoint IdentityIQ-Associate Practice Exam Questions & Answers

The statement is false. In SailPoint IdentityIQ, account attributes are updated through application aggregation, not through the Identity Refresh task. Account attributes belong to account links for a specific application and are defined in that application's account schema. When an aggregation task runs, IdentityIQ connects to the target application using the application definition and connector configuration, reads account data, and updates the account/link attributes stored in IdentityIQ.

The Identity Refresh task performs a different function. It operates on IdentityCubes and recalculates identity-level information using data already present in the IdentityIQ repository. Identity Refresh can update identity attributes, refresh role assignments, evaluate policies, process lifecycle events, update manager relationships, and recalculate governance state. It does not directly re-read account attribute values from connected systems.

This distinction is central to IdentityIQ's data model: account attributes describe accounts on applications, while identity attributes describe the consolidated user identity. Therefore, account attribute updates come from aggregation, while identity attribute updates may occur during Identity Refresh.

Reference topics: Applications --- application account schema and aggregation; Identity Modeling --- identity attributes versus account attributes; Identity Refresh task options.

Yes. In SailPoint IdentityIQ provisioning, the system evaluates the requested access change in the context of the identity's existing application accounts. When a provisioning request requires a modification on an application, IdentityIQ must determine whether the identity already has an account, represented by a Link, on that application. If no existing account is available and the requested change requires one, IdentityIQ can include account creation as part of the provisioning activity before applying attribute or entitlement modifications.

This behavior is central to request-based provisioning. For example, if a user requests an entitlement on an application where they do not yet have an account, IdentityIQ cannot simply add the entitlement to a nonexistent account. The provisioning process must first establish the account, collect required values through provisioning policies, and then apply the requested access. The provisioning plan may therefore be expanded or adjusted during compilation and fulfillment.

Therefore, the statement is true: IdentityIQ can determine whether an account must be created before modification. Reference topics: Provisioning, provisioning plan processing, account requests, provisioning policies, account creation, entitlement modification, and plan compilation.

Yes. The Identity Warehouse in SailPoint IdentityIQ is used to display identity-centered information from the IdentityCube and related IdentityIQ object relationships. In addition to core identity attributes, accounts, roles, entitlements, manager relationships, and direct reports, IdentityIQ can show objects for which the identity is designated as the owner. Ownership is an important governance concept because owners may be responsible for approving access, maintaining roles, reviewing entitlements, managing applications, or participating in certification and remediation processes.

An object owner in IdentityIQ may be associated with configurable objects such as roles, applications, managed attributes, policies, or other governance-related items. Displaying owned objects from the identity view helps administrators and governance users understand the responsibilities assigned to that identity, not just the access held by the identity. This distinction matters because IdentityIQ models both ''what access the identity has'' and ''what governance responsibilities the identity owns.''

Therefore, a list of objects the user owns is appropriately displayed in the Identity Warehouse when ownership relationships exist and the viewer has sufficient permission. Reference topics: Identity Modeling, IdentityCube contents, Identity Warehouse, object ownership, manager relationships, and governance responsibility modeling.

Yes. In SailPoint IdentityIQ, connector selection determines not only how IdentityIQ communicates with the target application, but also which operations the connector is capable of supporting. The connector featureString identifies connector capabilities exposed to IdentityIQ. These capabilities can include whether the connector supports account aggregation, group aggregation, schema discovery, provisioning, password management, authentication, or other connector-specific functions.

This is important because IdentityIQ uses connector capabilities to determine which configuration options and operational behaviors are valid for the application. For example, a connector that supports provisioning can write account or entitlement changes back to the managed system through provisioning plans. A read-only connector, by contrast, may support aggregation but not allow IdentityIQ to create, modify, disable, or delete accounts on the target. Therefore, the featureString helps define whether the connector can perform write operations against the application.

The statement is accurate because the connector's advertised features directly describe functional capabilities, including the ability to write changes where supported. Reference topics: Applications, connector selection, application definition, connector-dependent settings, provisioning support, aggregation behavior, and connector capabilities.

The statement is false. Preventive policy checking in SailPoint IdentityIQ is not limited only to self-service requests. Preventive policy evaluation is used to identify policy violations before access changes are completed. This can occur during access request processing, provisioning-related activity, or other configured request paths where IdentityIQ evaluates proposed changes against defined policies before allowing the transaction to proceed.

A self-service request is only one possible entry point. IdentityIQ access requests may be submitted by an end user, a manager, an administrator, or another authorized requester depending on QuickLink Population rules, request configuration, and access-request permissions. Preventive policy checking evaluates the requested access change itself, not merely the fact that the request was self-initiated. If the proposed access would violate a separation-of-duty, risk, or other governance policy, IdentityIQ can warn, require additional handling, or block the request depending on policy and workflow configuration.

Therefore, the word ''only'' makes the statement incorrect. Preventive policy checking is a governance control applied to configured access-change activity, not exclusively to self-service actions. Reference topics: Governance, policy detection, preventive policy checking, access request policy evaluation, User-Driven Requests, and provisioning request control.

Yes. Lifecycle Events in SailPoint IdentityIQ are defined to detect significant identity changes and trigger the appropriate business process in response. Organizations commonly use them to automate joiner, mover, and leaver scenarios. A joiner event may be triggered when a new identity is created or becomes active. A mover event may be triggered by changes such as department, job title, manager, location, or business unit. A leaver event may be triggered when an identity's employment status or lifecycle state indicates termination.

The lifecycle event configuration defines the condition to monitor and the business process or workflow to execute when that condition is met. This allows IdentityIQ to automate access provisioning, role assignment, account creation, access removal, account disablement, approvals, notifications, and other lifecycle-driven actions.

Therefore, the statement is accurate. Lifecycle Events are specifically used to define what identity data changes should initiate joiner, mover, or leaver processing.

Reference topics: Provisioning, Lifecycle Events, joiner-mover-leaver processing, identity attribute changes, business processes, workflows, and event-driven provisioning.

The statement is accurate. In SailPoint IdentityIQ LifeCycle Manager, the Manage Accounts feature is used for account-level request operations. It allows authorized users to request account changes on connected applications, including requesting an additional account when the target application and IdentityIQ configuration support multiple or additional accounts for the same identity.

This capability is controlled through the application definition, request configuration, QuickLink availability, provisioning policies, and workflow approvals. When an application supports additional accounts, IdentityIQ can present account-request options that allow the requester to create another account rather than only modifying or removing an existing one. The request is then converted into a provisioning plan, routed through configured approval logic, and fulfilled either automatically through the connector or manually through a work item.

This is different from requesting entitlements alone. Manage Accounts focuses on account lifecycle operations such as create, modify, delete, enable, disable, or unlock, depending on connector and application support. Therefore, allowing users to request additional accounts on applications configured to support them is a valid Manage Accounts function.

Reference topics: User-Driven Requests --- account request types and operations; Provisioning --- provisioning plans and provisioning policies; Applications --- application configuration and connector support.