View IdentityIQ-Associate Exam Question Dumps With Latest Demo [Sep 07, 2026]
Free IdentityIQ-Associate Test Questions Real Practice Test Questions
SailPoint IdentityIQ-Associate Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION # 28
Can this method be used to include entitlements or groups in the Entitlement Catalog?
Mark an attribute as multi-valued in the application schema and run an account aggregation.
- A. No
- B. Yes
Answer: A
Explanation:
No. Marking an attribute as multi-valued does not, by itself, cause IdentityIQ to treat that attribute as an entitlement or include its values in the Entitlement Catalog. In an application schema, the multi-valued setting only indicates that the account attribute can contain more than one value. It describes data structure, not governance meaning.
To include access values in the Entitlement Catalog, the relevant schema attribute must be configured as an entitlement-bearing attribute, or group objects must be properly configured and aggregated through the application's group schema where applicable. IdentityIQ then recognizes those values as governable access rights and can represent them as managed attributes in the Entitlement Catalog. Once cataloged, they can be reviewed, certified, requested, described, owned, risk-scored, and governed by policy.
For example, an account attribute such as "groups" may be multi-valued, but IdentityIQ must also know that those values represent access rights. Without entitlement configuration, the aggregation stores attribute values on the account but does not properly model them as catalog entitlements.
Reference topics: Access Modeling, Entitlement Catalog, managed attributes, application schema attributes, entitlement attribute configuration, group schema, and account aggregation.
NEW QUESTION # 29
Is this statement true about attributes in IdentityIQ?
Account attributes are updated through an identity refresh task.
- A. No
- B. Yes
Answer: A
Explanation:
The statement is false. In SailPoint IdentityIQ, account attributes are updated through application aggregation, not through the Identity Refresh task. Account attributes belong to account links for a specific application and are defined in that application's account schema. When an aggregation task runs, IdentityIQ connects to the target application using the application definition and connector configuration, reads account data, and updates the account/link attributes stored in IdentityIQ.
The Identity Refresh task performs a different function. It operates on IdentityCubes and recalculates identity- level information using data already present in the IdentityIQ repository. Identity Refresh can update identity attributes, refresh role assignments, evaluate policies, process lifecycle events, update manager relationships, and recalculate governance state. It does not directly re-read account attribute values from connected systems.
This distinction is central to IdentityIQ's data model: account attributes describe accounts on applications, while identity attributes describe the consolidated user identity. Therefore, account attribute updates come from aggregation, while identity attribute updates may occur during Identity Refresh.
Reference topics: Applications - application account schema and aggregation; Identity Modeling - identity attributes versus account attributes; Identity Refresh task options.
NEW QUESTION # 30
Is this a valid reason to grant an identity an IdentityIQ capability?
To give them elevated permissions on a connected application
- A. No
- B. Yes
Answer: A
Explanation:
No. IdentityIQ capabilities are used to control what a user can do inside SailPoint IdentityIQ, not to grant elevated permissions on a connected target application. A capability defines access to IdentityIQ functions such as administration, reporting, certification management, policy management, role management, access request functions, or other internal product features. Capabilities are part of IdentityIQ's internal authorization model and determine which menus, pages, actions, and administrative operations a logged-in IdentityIQ user may perform.
Elevated permissions on a connected application must be granted through governed access, such as requesting or provisioning an account, entitlement, role, or permission on that target system. That process is handled through access requests, approval workflows, provisioning plans, connector operations, and application- specific provisioning policies. For example, adding a privileged group in Active Directory or assigning an administrative application role would be modeled as target-system access, not as an IdentityIQ capability.
Therefore, granting an IdentityIQ capability is appropriate when the user needs additional permissions within IdentityIQ itself, not when they need elevated access on an external connected application. Reference topics:
Identity Modeling - how IdentityIQ access is granted to users; User-Driven Requests - access requests; Provisioning - target application access fulfillment.
NEW QUESTION # 31
Is this an accurate statement about access reviews and certifications?
Certifications can be manually created and executed for users of IdentityIQ.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. In SailPoint IdentityIQ, certifications are governance objects used to perform access reviews over identities, accounts, entitlements, roles, policy violations, and other reviewable access items. Certifications can be launched through scheduled campaigns, but they can also be manually created and executed by authorized users such as certification administrators or governance personnel. Manual creation is commonly used for targeted reviews, exception reviews, ad hoc compliance activity, application-specific reviews, manager reviews, or validation of a defined population of identities.
When a certification is created, IdentityIQ generates review items and assigns them to appropriate certifiers based on the certification type and configuration. The certification then proceeds through its lifecycle phases, which may include generation, active review, challenge, remediation, and sign-off. Reviewers can approve, revoke, delegate, or otherwise act on access items according to the certification configuration.
Therefore, the statement is accurate because IdentityIQ supports both scheduled and manually initiated certifications for reviewing user access. Reference topics: Governance, access reviews, certification creation, certification execution, certification phases, certifier assignment, and remediation processing.
NEW QUESTION # 32
Is this statement true for IdentityIQ application definitions?
Applications in IdentityIQ are named with the connector that is selected.
- A. No
- B. Yes
Answer: A
Explanation:
No. In SailPoint IdentityIQ, the application name is a configurable label assigned to the application object and does not have to match the connector selected. The application definition represents an external system or source, while the connector defines the technical integration method used to communicate with that system.
These are related configuration elements, but they are not the same field and one does not automatically name the other.
For example, an application could be named "Corporate Directory," "North America Active Directory," or
"HR Source," while using an LDAP, Active Directory, JDBC, Delimited File, Web Services, or another connector type. The connector selection determines available configuration settings, supported schema behavior, aggregation options, and provisioning capabilities. The application name is used for identification within IdentityIQ, reporting, certifications, requests, policies, and administrative configuration.
Therefore, the statement is incorrect because IdentityIQ applications are not named by the selected connector.
They are named by the administrator or implementer according to the business or system context. Reference topics: Applications, application definition, connector selection, connector-dependent settings, schemas, aggregation, and provisioning support.
NEW QUESTION # 33
Is this statement true about group factories and/or populations?
New groups are created as a result of executing a task.
- A. No
- B. Yes
Answer: B
Explanation:
The statement is true. In SailPoint IdentityIQ, group factories are used to generate identity groups dynamically based on identity attribute values or configured grouping logic. A group factory defines the rule or attribute basis for grouping identities, but the actual creation or refresh of the resulting groups occurs when the appropriate task is executed. For example, a group factory might be configured to create groups by department, location, cost center, or business unit. When the task runs, IdentityIQ evaluates identities against the factory definition and creates or updates the corresponding groups.
This differs from populations, which are typically defined sets of identities used for targeting, filtering, reporting, or governance scoping. Group factories are more generation-oriented because they can produce multiple group objects from identity data. The task execution step is important because it materializes the groups so they can be used in IdentityIQ operations.
Therefore, new groups can be created as a result of executing a task tied to group factory processing. Reference topics: Identity Modeling - groups and populations, group factories, identity grouping, and task-driven group creation.
NEW QUESTION # 34
Is this statement true for the Edit Identity QuickLink?
It is used to view details about an identity.
- A. No
- B. Yes
Answer: A
Explanation:
The statement is false. The Edit Identity QuickLink is not intended merely to view identity details; its purpose is to initiate an identity modification request. In IdentityIQ, QuickLinks are request-entry mechanisms that expose controlled actions to users based on QuickLink Population rules, capabilities, request configuration, and target permissions. The Edit Identity QuickLink allows an authorized user to update configured identity attributes, typically through a form-driven request process that may include validation, approval, audit tracking, and workflow execution.
Viewing identity details is a separate functional concept. Identity information is normally reviewed through identity search, identity warehouse views, certification access review context, or identity detail pages, where the user can inspect IdentityCube data such as attributes, accounts, roles, entitlements, manager, and policy violations. Edit Identity may display current values so the requester understands what is being changed, but display is contextual, not the primary function.
Therefore, "It is used to view details about an identity" describes a view-oriented function, not the Edit Identity QuickLink. Reference topics: User-Driven Requests, QuickLink Populations, create/edit/self-service identity requests, Identity Modeling, and IdentityCube usage.
NEW QUESTION # 35
Is this action an example of provisioning?
Reviewing an identity's access during a certification campaign
- A. No
- B. Yes
Answer: A
Explanation:
No. Reviewing an identity's access during a certification campaign is not provisioning. In SailPoint IdentityIQ, certification campaigns are part of governance and access review functionality. Their purpose is to allow designated reviewers, such as managers, application owners, role owners, or other certifiers, to examine existing access and decide whether it should be approved, revoked, delegated, or otherwise acted upon.
Provisioning is different. Provisioning refers to the fulfillment of access changes, such as creating accounts, modifying account attributes, adding or removing entitlements, disabling accounts, deleting accounts, or executing manual fulfillment work items when direct connector-based provisioning is unavailable. A certification decision may later trigger provisioning if a reviewer revokes access and IdentityIQ generates a remediation or deprovisioning action. However, the review activity itself is governance, not provisioning.
Therefore, "reviewing an identity's access during a certification campaign" is an access review action, not a provisioning action. Reference topics: Governance, certifications, access reviews, remediation, revocation decisions, Provisioning, provisioning plans, and deprovisioning fulfillment.
NEW QUESTION # 36
Is this statement true for the use of tasks?
They can be used to confirm that the correct access is included in a role.
- A. No
- B. Yes
Answer: A
Explanation:
No. In SailPoint IdentityIQ, tasks are used to execute defined system operations, often as background or scheduled processes. Common task usage includes account aggregation, identity refresh, entitlement aggregation, maintenance activities, report execution, role processing, and other repeatable administrative operations. A task may calculate, update, import, refresh, or process data, but it does not itself perform the governance decision of confirming whether access in a role is correct.
Confirming that the correct access is included in a role is a governance review function, most closely associated with role certification, especially role composition certification. In that process, a role owner or designated certifier reviews the access profiles, entitlements, permissions, or requirements contained in a role and decides whether they are appropriate. The confirmation requires business judgment and reviewer action, not merely task execution.
A task may support role governance indirectly by refreshing role data or generating background processing, but the validation of role contents belongs to certifications and access governance. Therefore, this statement is not accurate for the use of tasks. Reference topics: Foundational Concepts, tasks versus workflows, Governance, role composition certification, Access Modeling, and role governance.
NEW QUESTION # 37
Is this statement true about Rapid Setup?
It will create the application definitions.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. Rapid Setup in SailPoint IdentityIQ is designed to accelerate application onboarding by creating and configuring the application definitions required for IdentityIQ to manage data from connected systems. An application definition is the IdentityIQ object that represents an external source or target system and stores the connector selection, connectivity settings, schema information, aggregation behavior, correlation configuration, and related governance options.
Rapid Setup reduces the amount of manual configuration normally required when defining applications.
Instead of building every application definition entirely through the standard detailed configuration screens, Rapid Setup guides the administrator through a simplified setup path and creates the required IdentityIQ application objects from that configuration. Those application definitions can then be used for aggregation, correlation, entitlement discovery, access modeling, and downstream governance processes.
This does not mean Rapid Setup eliminates the need for validation. Administrators must still verify schemas, correlation rules, entitlement treatment, and provisioning behavior. However, the statement is accurate because creating application definitions is a core function of Rapid Setup.
Reference topics: Applications, Rapid Setup, application definitions, connector configuration, schema configuration, aggregation, correlation, and entitlement discovery.
NEW QUESTION # 38
Is this statement accurate about the BeanShell rules used in the aggregation process?
Rules are required to implement aggregation in IdentityIQ.
- A. No
- B. Yes
Answer: A
Explanation:
No. BeanShell rules are not required to implement aggregation in SailPoint IdentityIQ. Aggregation is a standard IdentityIQ function performed through an application definition, connector configuration, schema definition, correlation settings, and aggregation task execution. Many common connectors can aggregate accounts and groups without any custom rule because the connector and schema configuration provide the required instructions for reading objects from the source system.
Rules are used when additional customization is needed. For example, an aggregation rule may transform incoming attribute values, filter records, normalize data, customize correlation behavior, or handle source- specific logic that cannot be expressed through standard configuration. However, this makes rules optional extension points, not mandatory components of aggregation.
A properly configured application can aggregate accounts using its connector settings, account schema, group schema, and aggregation task options alone. Rules should be introduced only when the standard connector behavior and configuration do not satisfy the implementation requirements.
Reference topics: Applications, aggregation tasks, connector configuration, account schema, group schema, correlation options, application rules, connector rules, and IdentityIQ extensibility through BeanShell rules.
NEW QUESTION # 39
Is this statement true about group factories and/or populations?
Groups and populations can be assigned as object owners in IdentityIQ.
- A. No
- B. Yes
Answer: A
Explanation:
The statement is false. In SailPoint IdentityIQ, groups and populations are used to classify, filter, and organize identities for governance, reporting, certifications, and targeted user experiences. A population is a defined collection of identities, and group factories can dynamically create identity groups based on configured identity attributes. These constructs are useful for segmentation, analysis, and campaign targeting, but they are not the standard objects assigned as owners of IdentityIQ objects.
Ownership in IdentityIQ is normally assigned to an identity or to a workgroup. A workgroup is used when ownership or responsibility must be shared by multiple users, such as application owners, certification owners, entitlement owners, or approval groups. This distinction matters because ownership drives accountability, work item assignment, approvals, escalations, and administrative responsibility. Populations and generated groups do not function as accountable owners in the same way workgroups do.
Therefore, while groups and populations can influence governance scope and visibility, they are not assigned as object owners. Reference topics: Identity Modeling - groups and populations; Foundational Concepts - common objects and usage; Governance - ownership, certifications, and work item responsibility.
NEW QUESTION # 40
Does this statement accurately describe how roles are acquired by users in the default role model configuration?
Business roles can only be requested by managers.
- A. No
- B. Yes
Answer: A
Explanation:
No. This statement does not accurately describe role acquisition in IdentityIQ. Business roles are not restricted to being requested only by managers. In IdentityIQ, roles may be acquired through role assignment logic, role detection, access requests, or administrative action, depending on the role configuration and the organization's request model.
A business role commonly represents access associated with a business function, job, department, location, or organizational responsibility. Users may receive business roles automatically when their identity attributes satisfy configured role profiles or assignment rules, typically recalculated during Identity Refresh. Separately, roles may be made requestable through Lifecycle Manager and exposed through QuickLinks, where request eligibility is controlled by QuickLink Populations, request configuration, and workflow rules.
Managers may be allowed to request roles for direct reports, but that is only one possible configuration.
IdentityIQ can also allow users to request roles for themselves, allow delegated requesters to request for others, or restrict requests to specific populations.
Therefore, "only requested by managers" is too narrow and incorrect. Reference topics: Access Modeling, business roles, role assignment, role detection, Identity Refresh, User-Driven Requests, QuickLink Populations, and role request configuration.
NEW QUESTION # 41
Is this statement about aggregation task options true?
Aggregation partitioning allows aggregation tasks to be split into smaller pieces so that data processing can be split across multiple hosts, as well as across multiple threads per host.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. Aggregation partitioning in SailPoint IdentityIQ is a performance and scalability option used to divide a large aggregation workload into smaller units of work. Instead of processing the entire aggregation as one continuous task on a single execution thread, IdentityIQ can partition the work so multiple task executors can process different portions of the aggregation workload concurrently.
This is especially useful in large environments where applications contain many accounts, groups, or entitlement records. Partitioning can improve throughput by distributing processing across multiple hosts in an IdentityIQ deployment and by allowing multiple threads per host to participate in the aggregation workload. The goal is to reduce total aggregation runtime while maintaining controlled processing of account and entitlement data.
Partitioning is not the same as connector-based delta processing. Delta processing depends on connector support for identifying changed records, while partitioning concerns how the aggregation workload is divided and executed. Therefore, the statement is accurate.
Reference topics: Applications, aggregation task options, aggregation partitioning, account aggregation, performance optimization, task execution, and multi-host processing.
NEW QUESTION # 42
Is this definition of Identity Cube accurate?
The process of adding to, removing from, or changing a user's access to an application
- A. No
- B. Yes
Answer: A
Explanation:
No. This definition does not describe an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the central identity record that represents a person or identity within IdentityIQ. It consolidates identity attributes, correlated application accounts, entitlements, assigned roles, detected roles, manager relationship, policy violations, lifecycle state, and other governance-relevant information. The Identity Cube is the primary object used by IdentityIQ to understand who a user is and what access that user has across connected systems.
The statement given describes provisioning, not an Identity Cube. Provisioning is the process of adding, removing, or modifying a user's access on an application. Examples include creating an account, changing account attributes, adding an entitlement, removing group membership, disabling an account, or deleting an account.
Therefore, the definition is inaccurate because it describes an access-change process, while an Identity Cube is an identity data model. Reference topics: Identity Modeling, IdentityCube contents, application account correlation, entitlements, roles, Provisioning, account requests, and access-change fulfillment.
NEW QUESTION # 43
Is this an accurate statement about the Manage Accounts feature in LifeCycle Manager?
It allows users to request additional accounts on applications that support additional accounts.
- A. No
- B. Yes
Answer: B
Explanation:
The statement is accurate. In SailPoint IdentityIQ LifeCycle Manager, the Manage Accounts feature is used for account-level request operations. It allows authorized users to request account changes on connected applications, including requesting an additional account when the target application and IdentityIQ configuration support multiple or additional accounts for the same identity.
This capability is controlled through the application definition, request configuration, QuickLink availability, provisioning policies, and workflow approvals. When an application supports additional accounts, IdentityIQ can present account-request options that allow the requester to create another account rather than only modifying or removing an existing one. The request is then converted into a provisioning plan, routed through configured approval logic, and fulfilled either automatically through the connector or manually through a work item.
This is different from requesting entitlements alone. Manage Accounts focuses on account lifecycle operations such as create, modify, delete, enable, disable, or unlock, depending on connector and application support. Therefore, allowing users to request additional accounts on applications configured to support them is a valid Manage Accounts function.
Reference topics: User-Driven Requests - account request types and operations; Provisioning - provisioning plans and provisioning policies; Applications - application configuration and connector support.
NEW QUESTION # 44
Is this displayed in the Identity Warehouse?
List of the user's direct reports (for manager identities)
- A. No
- B. Yes
Answer: B
Explanation:
Yes. In SailPoint IdentityIQ, the Identity Warehouse is used to review identity-centric information stored in the IdentityCube. For identities that are managers, IdentityIQ can display the list of identities that report to that manager. This information is derived from the manager relationship established during identity aggregation, correlation, and identity refresh processing.
The direct-report relationship is not an application account attribute by itself once modeled in IdentityIQ; it becomes part of the identity model. IdentityIQ uses manager correlation to associate each identity with its manager, and when those relationships are resolved, the manager identity can show its subordinate identities as direct reports. This is important for governance because managers are frequently used as certifiers, approvers, and reviewers in access review and request workflows.
The display of direct reports depends on the identity data being populated correctly and the viewer having permission to access the identity details. However, as a functional capability of the Identity Warehouse, direct reports for manager identities are part of the identity information that can be displayed.
Reference topics: Identity Modeling, IdentityCube contents, manager correlation, Identity Warehouse, identity refresh, and governance reviewer relationships.
NEW QUESTION # 45
Is this statement true for IdentityIQ application definitions?
Correlation logic can be specified for authoritative applications.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. In SailPoint IdentityIQ, correlation logic can be specified for authoritative applications. An authoritative application is commonly used as a trusted source for identity data, such as HR or another system of record.
During aggregation, IdentityIQ reads account or source records from the application and uses correlation logic to determine whether each record should be linked to an existing IdentityCube or used in identity creation and update processing.
Correlation logic may be configured using account attributes, identity attributes, or correlation rules. For example, an authoritative source may correlate records by employee ID, user name, email address, or another unique identifier. This ensures that incoming authoritative data updates the correct identity instead of creating duplicates or leaving records uncorrelated.
The authoritative nature of the application does not eliminate the need for correlation. It defines the trust level and identity-data role of the source, while correlation defines how records from that source are matched to identities in IdentityIQ.
Reference topics: Applications, authoritative applications, correlation options, account aggregation, IdentityCube creation, identity attribute mapping, and uncorrelated account resolution.
NEW QUESTION # 46
Is this statement true for IdentityIQ application definitions?
Application definitions contain the connectivity information IdentityIQ uses to communicate with the application.
- A. No
- B. Yes
Answer: B
Explanation:
Yes. In SailPoint IdentityIQ, an application definition represents an external system or managed source and contains the configuration IdentityIQ needs to connect to and interact with that system. The selected connector determines which connectivity settings are required, and the application definition stores those values. Examples can include server host, port, credentials, JDBC URL, file path, API endpoint, tenant information, authentication parameters, or other connector-specific settings.
This connectivity information enables IdentityIQ to perform operations such as account aggregation, group aggregation, schema discovery, entitlement collection, and provisioning where the connector supports write operations. The exact fields vary by connector type, which is why an LDAP, JDBC, Delimited File, Active Directory, or Web Services application may expose different configuration requirements.
Therefore, the statement is accurate: application definitions contain the communication and connectivity configuration used by IdentityIQ to access the application. Reference topics: Applications, application definition, connector selection, connector-dependent settings, account aggregation, schema configuration, and provisioning support.
NEW QUESTION # 47
Is this statement true about Rapid Setup?
Rapid Setup birthright roles are requestable.
- A. No
- B. Yes
Answer: A
Explanation:
No. In IdentityIQ, a birthright role is intended to represent access that is automatically assigned to identities based on defined business criteria, such as lifecycle state, department, location, job function, or other identity attributes. The purpose of a birthright role is automatic access assignment, not user-driven request selection. Rapid Setup can help configure common access-modeling and application-onboarding elements more efficiently, including birthright access patterns, but the birthright concept remains assignment-based rather than request-based.
Requestable access is handled through the access request model, where users select roles, entitlements, or other access items made available through request configuration and QuickLinks. Birthright access is different because it is granted when an identity satisfies the role assignment criteria and is recalculated through identity refresh and role evaluation. Making birthright roles requestable would undermine their purpose as standard baseline access automatically derived from identity data.
Therefore, the statement is inaccurate. Rapid Setup birthright roles are used for automated assignment and baseline access, not as requestable access items. Reference topics: Applications, Rapid Setup, Access Modeling, birthright roles, role assignment, identity refresh, and User-Driven Requests.
NEW QUESTION # 48
Is this statement true about attributes in IdentityIQ?
The value for a specific account attribute can be sourced from several applications.
- A. No
- B. Yes
Answer: A
Explanation:
The statement is false. In IdentityIQ, an account attribute is defined within a specific application account schema and represents data stored on an account link for that application. Its value is obtained from the account data aggregated from that particular application connector. For example, an account attribute such asmemberOf,department,title, oraccountStatusbelongs to the account schema of a defined application and is populated from that application's aggregation results.
The concept of sourcing values from several applications applies more directly to identity attributes, not account attributes. Identity attributes reside on the IdentityCube and may be derived from authoritative sources, account links, rules, mappings, or precedence logic across multiple applications. IdentityIQ uses identity attribute configuration to normalize data such as department, location, manager, email, or lifecycle state at the identity level.
Therefore, while multiple applications may contain similarly named account attributes, each account attribute value is tied to its own application account schema and account link. It is not a single shared account attribute sourced from several applications.
Reference topics: Applications - account schema attributes; Identity Modeling - identity attributes versus account attributes; Identity Refresh - updating IdentityCube attributes.
NEW QUESTION # 49
......
View All IdentityIQ-Associate Actual Free Exam Questions Updated: https://www.exam4free.com/IdentityIQ-Associate-valid-dumps.html
IdentityIQ-Associate Dumps Updated Sep 07, 2026 WIith 78 Questions: https://drive.google.com/open?id=1OwWrT0MQRH2OSRfsbZQ8YSfFEMWHRMxa
