SailPoint Certified IdentityIQ Associate IdentityIQ-Associate Exam Questions

Answer : A

Yes. This is a primary use of the entitlement catalog in SailPoint IdentityIQ. Entitlements aggregated from target applications are often technical values, such as group names, permission codes, directory groups, database roles, or application-specific access identifiers. These values may be meaningful to administrators but unclear to business reviewers, requesters, managers, or access approvers. The entitlement catalog enriches those technical access values with governance metadata, including user-friendly display names, descriptions, ownership, classification, requestability, and other attributes used across IdentityIQ.

This enriched entitlement data improves decision quality in access requests, certifications, and reports. During an access request, a requester can search and select understandable access items. During a certification, a reviewer can make better approve-or-revoke decisions because the entitlement is presented with meaningful business context. In reporting, catalog metadata makes access analysis clearer and more usable for audit and compliance teams.

Therefore, providing user-friendly entitlement display names for access requests, reports, and certifications is a correct entitlement catalog function. Reference topics: Access Modeling --- entitlement catalog purpose; Governance --- certifications and review context; User-Driven Requests --- access request display; Applications --- entitlement aggregation from group/account schemas.

Answer : B

No. Reviewing an identity's access during a certification campaign is not provisioning. In SailPoint IdentityIQ, certification campaigns are part of governance and access review functionality. Their purpose is to allow designated reviewers, such as managers, application owners, role owners, or other certifiers, to examine existing access and decide whether it should be approved, revoked, delegated, or otherwise acted upon.

Provisioning is different. Provisioning refers to the fulfillment of access changes, such as creating accounts, modifying account attributes, adding or removing entitlements, disabling accounts, deleting accounts, or executing manual fulfillment work items when direct connector-based provisioning is unavailable. A certification decision may later trigger provisioning if a reviewer revokes access and IdentityIQ generates a remediation or deprovisioning action. However, the review activity itself is governance, not provisioning.

Therefore, ''reviewing an identity's access during a certification campaign'' is an access review action, not a provisioning action. Reference topics: Governance, certifications, access reviews, remediation, revocation decisions, Provisioning, provisioning plans, and deprovisioning fulfillment.

Answer : B

The statement is false. The Identity Refresh task does not execute aggregation rules configured on an application definition. Aggregation rules are part of the application aggregation process, where IdentityIQ connects to a source system, reads account or group data, applies connector and application-level processing, and stores account links, entitlement values, and related data in the IdentityIQ repository.

The Identity Refresh task operates after data is already present in IdentityIQ. Its function is to update IdentityCubes and recalculate identity-level governance information. Depending on selected options, Identity Refresh may update identity attributes, refresh role assignments, detect assigned or detected roles, evaluate policies, process lifecycle events, refresh manager relationships, or recalculate risk and access-related identity state.

Application aggregation and identity refresh are separate task functions. Aggregation obtains and normalizes data from applications; Identity Refresh interprets and recalculates identity governance state using that aggregated data. Therefore, rules tied specifically to aggregation on the application definition are execute during aggregation, not during Identity Refresh.

Reference topics: Identity Modeling --- Identity Refresh task options; Applications --- aggregation rules and application definitions; Foundational Concepts --- tasks and workflows.

Answer : A

Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed identifies that attribute as governance-relevant access data. This is commonly applied to attributes that contain entitlement-like values, such as groups, roles, permissions, or application access assignments. When the attribute is managed, IdentityIQ can create and maintain managed attribute records for the values discovered during aggregation, allowing those values to be represented in the entitlement catalog with business metadata such as display name, description, owner, requestability, and classification.

This managed designation supports governance processes, including certifications. In an access review, reviewers need to evaluate meaningful access items rather than raw account data. Managed entitlement values can therefore be surfaced as reviewable access so managers, application owners, or entitlement owners can approve, revoke, or otherwise act on them during certification campaigns.

This does not mean the attribute itself is simply editable in IdentityIQ; editability is controlled separately through provisioning policies, forms, workflows, and connector support. The managed flag is primarily about governing the attribute's values as access.

Reference topics: Applications --- schema attribute properties; Access Modeling --- entitlement catalog; Governance --- certification review items.

Answer : B

No. This definition does not describe an Identity Cube. In SailPoint IdentityIQ, an Identity Cube is the central identity record that represents a person or identity within IdentityIQ. It consolidates identity attributes, correlated application accounts, entitlements, assigned roles, detected roles, manager relationship, policy violations, lifecycle state, and other governance-relevant information. The Identity Cube is the primary object used by IdentityIQ to understand who a user is and what access that user has across connected systems.

The statement given describes provisioning, not an Identity Cube. Provisioning is the process of adding, removing, or modifying a user's access on an application. Examples include creating an account, changing account attributes, adding an entitlement, removing group membership, disabling an account, or deleting an account.

Therefore, the definition is inaccurate because it describes an access-change process, while an Identity Cube is an identity data model. Reference topics: Identity Modeling, IdentityCube contents, application account correlation, entitlements, roles, Provisioning, account requests, and access-change fulfillment.

Answer : A

Yes. In SailPoint IdentityIQ, correlation logic can be specified for authoritative applications. An authoritative application is commonly used as a trusted source for identity data, such as HR or another system of record. During aggregation, IdentityIQ reads account or source records from the application and uses correlation logic to determine whether each record should be linked to an existing IdentityCube or used in identity creation and update processing.

Correlation logic may be configured using account attributes, identity attributes, or correlation rules. For example, an authoritative source may correlate records by employee ID, user name, email address, or another unique identifier. This ensures that incoming authoritative data updates the correct identity instead of creating duplicates or leaving records uncorrelated.

The authoritative nature of the application does not eliminate the need for correlation. It defines the trust level and identity-data role of the source, while correlation defines how records from that source are matched to identities in IdentityIQ.

Reference topics: Applications, authoritative applications, correlation options, account aggregation, IdentityCube creation, identity attribute mapping, and uncorrelated account resolution.

Answer : B

No. BeanShell rules are not required to implement aggregation in SailPoint IdentityIQ. Aggregation is a standard IdentityIQ function performed through an application definition, connector configuration, schema definition, correlation settings, and aggregation task execution. Many common connectors can aggregate accounts and groups without any custom rule because the connector and schema configuration provide the required instructions for reading objects from the source system.

Rules are used when additional customization is needed. For example, an aggregation rule may transform incoming attribute values, filter records, normalize data, customize correlation behavior, or handle source-specific logic that cannot be expressed through standard configuration. However, this makes rules optional extension points, not mandatory components of aggregation.

A properly configured application can aggregate accounts using its connector settings, account schema, group schema, and aggregation task options alone. Rules should be introduced only when the standard connector behavior and configuration do not satisfy the implementation requirements.

Reference topics: Applications, aggregation tasks, connector configuration, account schema, group schema, correlation options, application rules, connector rules, and IdentityIQ extensibility through BeanShell rules.