Get SailPoint IdentityIQ-Associate Exam Practice Questions - Real and Updated

Answer : B

No. IdentityIQ capabilities are used to control what a user can do inside SailPoint IdentityIQ, not to grant elevated permissions on a connected target application. A capability defines access to IdentityIQ functions such as administration, reporting, certification management, policy management, role management, access request functions, or other internal product features. Capabilities are part of IdentityIQ's internal authorization model and determine which menus, pages, actions, and administrative operations a logged-in IdentityIQ user may perform.

Elevated permissions on a connected application must be granted through governed access, such as requesting or provisioning an account, entitlement, role, or permission on that target system. That process is handled through access requests, approval workflows, provisioning plans, connector operations, and application-specific provisioning policies. For example, adding a privileged group in Active Directory or assigning an administrative application role would be modeled as target-system access, not as an IdentityIQ capability.

Therefore, granting an IdentityIQ capability is appropriate when the user needs additional permissions within IdentityIQ itself, not when they need elevated access on an external connected application. Reference topics: Identity Modeling --- how IdentityIQ access is granted to users; User-Driven Requests --- access requests; Provisioning --- target application access fulfillment.

Answer : A

Yes. In SailPoint IdentityIQ, correlation logic can be specified for authoritative applications. An authoritative application is commonly used as a trusted source for identity data, such as HR or another system of record. During aggregation, IdentityIQ reads account or source records from the application and uses correlation logic to determine whether each record should be linked to an existing IdentityCube or used in identity creation and update processing.

Correlation logic may be configured using account attributes, identity attributes, or correlation rules. For example, an authoritative source may correlate records by employee ID, user name, email address, or another unique identifier. This ensures that incoming authoritative data updates the correct identity instead of creating duplicates or leaving records uncorrelated.

The authoritative nature of the application does not eliminate the need for correlation. It defines the trust level and identity-data role of the source, while correlation defines how records from that source are matched to identities in IdentityIQ.

Reference topics: Applications, authoritative applications, correlation options, account aggregation, IdentityCube creation, identity attribute mapping, and uncorrelated account resolution.

Answer : B

No. In SailPoint IdentityIQ, the provisioning plan is not necessarily static after it is initially created. A provisioning plan represents the requested account and access changes to be fulfilled, such as creating an account, modifying attributes, adding or removing entitlements, disabling an account, or deleting an account. During provisioning processing, IdentityIQ may update, expand, enrich, or transform the plan before fulfillment.

For example, provisioning policies may require additional data before a requested operation can be completed. Workflow logic, rules, approval outcomes, role expansion, dependency processing, and application-specific provisioning configuration can also affect the final provisioning instructions. IdentityIQ may compile the plan into executable provisioning activity, split requests by application, route items to connectors, or generate manual work items when direct connector provisioning is not available. These processing steps can alter what is ultimately sent to the target system or assigned for fulfillment.

Therefore, the statement that the provisioning plan will never be changed or updated is incorrect. Reference topics: Provisioning, provisioning plans, provisioning policies, plan compilation, workflows, connector provisioning, manual fulfillment, and application-specific provisioning behavior.

Answer : B

This is not a correct example of an IdentityIQ policy as stated. IdentityIQ policies are used to detect governance violations based on identity, account, entitlement, role, risk, or activity conditions. An account policy is concerned with whether an identity has an account, lacks a required account, or has an account that violates defined account-related criteria. It evaluates existing identity and account state after data is aggregated and correlated into IdentityIQ.

The phrase ''has requested the appropriate account'' describes an access request validation concept rather than a policy-detection use case. Requests are handled through the user-driven request and provisioning framework, including QuickLinks, request forms, approvals, workflows, provisioning policies, and provisioning plans. A request can be evaluated, approved, rejected, or fulfilled, but a governance policy is normally not defined to determine whether a request itself was ''appropriate.''

IdentityIQ policies detect violations against current or observed access conditions. Therefore, an account policy may check whether an identity has an inappropriate account, but not whether the identity requested the appropriate account. Reference topics: Governance --- common policy examples and policy detection; User-Driven Requests --- access requests; Provisioning --- provisioning process and provisioning policies.

Answer : B

The statement is false. The Identity Refresh task does not execute aggregation rules configured on an application definition. Aggregation rules are part of the application aggregation process, where IdentityIQ connects to a source system, reads account or group data, applies connector and application-level processing, and stores account links, entitlement values, and related data in the IdentityIQ repository.

The Identity Refresh task operates after data is already present in IdentityIQ. Its function is to update IdentityCubes and recalculate identity-level governance information. Depending on selected options, Identity Refresh may update identity attributes, refresh role assignments, detect assigned or detected roles, evaluate policies, process lifecycle events, refresh manager relationships, or recalculate risk and access-related identity state.

Application aggregation and identity refresh are separate task functions. Aggregation obtains and normalizes data from applications; Identity Refresh interprets and recalculates identity governance state using that aggregated data. Therefore, rules tied specifically to aggregation on the application definition are execute during aggregation, not during Identity Refresh.

Reference topics: Identity Modeling --- Identity Refresh task options; Applications --- aggregation rules and application definitions; Foundational Concepts --- tasks and workflows.