SailPoint IdentityIQ Engineer Certification Sample Questions

01. An account aggregation against one application fails. The task result shows the connector connected and read account objects without complaint, then was refused when it attempted to read the group objects. Nothing in IdentityIQ was changed before the run.
What does that pattern indicate, and where does the fix belong?
a) The group schema no longer matches what the target system exposes, so the schema has to be re-discovered and the entitlement mapping rebuilt from the objects it returns
b) The stored credential has expired, so the connection settings have to be re-entered and the aggregation repeated before anything can be concluded from this result
c) The account IdentityIQ connects with is authenticated but not authorized on the group objects, so the refusal goes to the target system's administrator
d) The connector type chosen for this application is the wrong one and should be replaced

02. An engineer has just deployed IdentityIQ to a rebuilt application server node and initialized it. The login page renders and an administrative account can sign in. What is the strongest next check that the deployment is actually working, rather than merely serving pages?
a) Run a small platform task, then read its task result to confirm the application can reach the database and schedule work.
b) Confirm the login page loads over the load balancer from outside the data center, which proves the deployed application is reachable by its users.
c) Open a certification campaign and confirm reviewers can see their items, since that exercises the widest set of the product's features in one step.
d) Check the application server log for stack traces and warnings and, finding none, record the deployment as verified.

03. A configuration change tested successfully in a lower environment behaves differently after its XML objects were imported into another environment. The import reported no error. What should be established first?
a) Whether the change ought to be hand-built in the target, rather than imported at all
b) Whether the target environment is running the same IdentityIQ build as the source, since a difference there would account for any change in behavior and has to be settled before the objects themselves are examined
c) Whether the objects were exported through the console rather than the user interface, which changes what an export contains
d) Which values inside the imported objects are environment-specific and whether they were carried across from the source environment unchanged

04. An engineer has onboarded a new application and run an account aggregation. Accounts now appear on the correlated identity cubes, but none of the target system's groups are available to model entitlements from. What explains this?
a) Groups appear only after an identity refresh promotes them onto the cubes
b) Groups are read by a separate group aggregation over the application's group schema
c) Account aggregation reads groups as well, so the application's group schema must be defined incorrectly
d) Groups are produced in IdentityIQ by role mining once enough accounts exist

05. A team is onboarding a payroll application. Its owners have offered to enable single sign-on for IdentityIQ's own users and have asked whether anything else is needed. What does IdentityIQ actually require from them?
a) Confirmation that the payroll system supports more than one identity provider
b) A list of the users who should hold access to it
c) An account on the payroll system whose privileges are sufficient for the connector to read the accounts and groups it must aggregate
d) A federation trust between the payroll system and the identity provider IdentityIQ uses

06. An auditor asks for evidence of who approved a named access request and when, covering the previous quarter. Which record answers that question?
a) The system events the platform wrote over that period, covering its own components' errors and restarts.
b) The audit records covering the governance actions taken on the request.
c) The application server log for the quarter, filtered to the component that dispatched the approval work item.
d) The task results of the identity refreshes that ran during the quarter, read for the approvals they recorded.

07. A campaign is configured so that each identity reviews the access on their own accounts, on the grounds that they know best what they use. What is the governance problem with that design?
a) The reviewers will not be able to interpret entitlements named after system objects
b) The decisions cannot be recorded against the identity, so there is no evidence of the review
c) Revocations raised by the identity themselves cannot be remediated automatically
d) The access is not attested by anyone independent of the person holding it

08. An environment runs several IdentityIQ application server nodes against one relational database. After a scheduled aggregation is added, an engineer notices it runs once per cycle rather than once per node, while a configuration change made through the user interface on one node is visible immediately from the others.
What best explains both observations?
a) Configuration is shared through the database while scheduling is per-node, and the task appears to run once only because the other nodes' runs find nothing to do
b) Each node holds its own copy of the configuration and its own scheduler, and the nodes reconcile with each other at the end of every cycle, which is why the change appears everywhere and the task runs once
c) Configuration and scheduled work both live in the shared database, and the nodes coordinate there so one node takes each task
d) The load balancer pins the scheduler to a single node and replicates configuration changes to the other nodes' caches as they are made

09. A hospital provisions every new clinician's baseline access with no action from the clinician, and separately lets clinicians ask for additional ward systems themselves, with the ward manager approving those. Which pairing of Lifecycle Manager mechanisms fits?
a) Both from a lifecycle event, with the extra ward systems chosen inside the event's workflow by the clinician.
b) Baseline access from a provisioning policy on each ward system, and additional access from a certification campaign.
c) Both from an access request, with the baseline raised automatically on the clinician's behalf at hire.
d) Baseline access from a lifecycle event, and additional access from an approved access request.

10. An engineer has been given credentials and network access for a new application that will be brought under IdentityIQ. Which action comes first?
a) Choose the connector for the application and configure its connection settings
b) Schedule the recurring account aggregation task
c) Map the application's entitlements onto the IT roles through which they will be requested
d) Define the correlation configuration that attaches the aggregated accounts to identities