The IdentityIQ Console (iiq console) provides a command-line interface for administration and debugging.

• connectorDebug: This command is used specifically to invoke and test the raw methods of a connector (such as iterate, authenticate, or checkStatus) against a specific Application configuration without running a full task.
• list: This is a fundamental command used to display a list of entities for a specific object class (e.g., list Identity, list Application, list Bundle).
• source: Similar to Unix shell usage, this command reads an external file containing a sequence of console commands and executes them in the current session.
• provision: This command takes a provisioning plan (typically defined in an XML file) as input, compiles it, and executes the provisioning actions against the target resources.

SailPoint IdentityIQ System Administration Guide, Section: "The IdentityIQ Console" (Console Commands Reference).

Reference Details: The help command output within the console documentation explicitly defines source as "Execute a file of commands" and list as "List objects".

SailPoint IdentityIQ Console Guide, Command Reference Table.

Reference Details: Defines connectorDebug (or connector in some versions) as the tool to "Execute a connector method on a specified application" to verify connectivity and logic.

SailPoint IdentityIQ Technical Whitepaper, "Debugging and Troubleshooting".

Reference Details: Describes using the provision command to manually test provisioning plans during development.

The four steps provided in the image accurately represent the high-level process for creating and reporting on a custom audit event in SailPoint IdentityIQ. The process requires defining the event, providing a mechanism to trigger it, and creating a report to view the generated data. This is accomplished by creating:

1. AuditAction and AuditEvent objects to define the event's name and data structure.

2. A Rule object containing the script to generate the event (e.g., by calling AuditLog.log()).

3. A TaskDefinition object (referred to as a Report object) for a Live Report to query and display the custom audit records.

B. No: This option is incorrect because the four listed steps are the essential IdentityIQ artifacts that must be configured to successfully define, generate, and report on a custom audit event.

1. SailPoint IdentityIQ Administration Guide: The chapter on "Auditing," specifically the section on "Custom Audit Events," describes the necessity of creating both an AuditAction object and an AuditEvent object to define a new event type.

2. SailPoint IdentityIQ Administration Guide: The "Auditing" chapter also provides examples of how to generate these events using BeanShell scripts, which are typically encapsulated within a Rule object for reusability and execution from business processes.

3. SailPoint IdentityIQ Reporting Guide: The chapter covering "Live Reports" details the procedure for creating a new report by defining a TaskDefinition object. This object is configured to query IdentityIQ's Hibernate objects, such as the AuditEvent object, to retrieve and display the desired data.

The proposed solution is incorrect. The "Rehire" action is a specific Lifecycle Event designed to process the return of a previously terminated employee. This event typically triggers a comprehensive workflow similar to a new hire. To allow a user to simply enable an existing, disabled account for a subordinate or themselves, the "Enable Account" action must be configured. This is done within the "Manage Accounts Options" section of the Lifecycle Manager (LCM) configuration, where specific account-level actions like enable, disable, and unlock are defined for different applications.

A. Yes: This is incorrect because the "Rehire" action is a full lifecycle event, not the granular account management function needed to simply enable a disabled account for a current user.

1. SailPoint IdentityIQ 8.1 Administration Guide: In the "Configuring Lifecycle Manager" chapter, the guide distinguishes between "Configuring Lifecycle Events" (which includes Rehire) and "Configuring Manage Accounts Options." The "Manage Accounts Options" section details the configuration of actions like Enable, Disable, and Unlock that appear in the Manage Accounts interface. This separation confirms that "Rehire" is not an action within "Manage Accounts." (Refer to sections on "Lifecycle Events" and "Manage Accounts Options").

2. SailPoint IdentityIQ 8.2 - User Guide: The "Managing Accounts" section describes the user-facing functionality. It shows how managers can select subordinates and perform actions like "Enable Account" or "Disable Account" if they have the appropriate permissions. The "Rehire" process is described as a separate request initiated through the Lifecycle Manager interface, not as an option on the Manage Accounts page. (Refer to the chapter "Using the Lifecycle Manager").

To enable tracing for a specific component in SailPoint IdentityIQ, administrators must modify the Log4j configuration.

1. Locate the File: The primary logging configuration file for IdentityIQ is log4j.properties (or log4j2.properties in versions 8.0+), located in the WEB-INF/classes directory.
2. Enable the Logger: The specific logger for Certifications (often referred to internally or in older versions/exams as Certificationer) is commented out by default. Removing the # activates it.
3. Set Level: The default level in the provided line is info. The question requires trace, so the value must be manually updated.
4. Apply Changes: While dynamic reloading is possible via the Debug pages, the standard system-level procedure to ensure all property changes (especially in the classpath) take full effect is to restart the application server (e.g., Tomcat).

SailPoint IdentityIQ Administration Guide / System Administrator Guide: Section on "Logging" or "System Monitoring," which details the location of log4j.properties in WEB-INF/classes.

SailPoint Compass Community (Official Knowledge Base): "How to find Log4j.properties and IdentityIQ logs" (Article ID: TA-P/72506). This article confirms the path WEB-INF/classes/log4j.properties.

Apache Log4j Documentation: Verifies that standard .properties files for web applications are placed in WEB-INF/classes for the classloader to find them.

SailPoint Developer Community: Discussion threads (e.g., "Certification is showing pending") often cite enabling sailpoint.api.Certificationer to trace for troubleshooting certification generation issues.

The code is incorrect and will not function as intended. First, the SailPointContext interface does not contain a method named getObjectByNumber. Second, the logic is fundamentally flawed because the retrieval step completely ignores the Filter. By iterating from 0 to n and attempting to fetch by index (even if such a method existed), the code would retrieve the first nGroupDefinition objects in the database (or cache) based on default ordering, rather than the specific objects owned by "Randy.Knight". The correct approach is to use context.search(GroupDefinition.class, qo) or context.getObjects(GroupDefinition.class, qo), which returns a collection or iterator of the specific objects matching the query criteria.

Option A (Yes): The code fails because it uses non-existent API methods (getObjectByNumber) and logically decouples the retrieval of objects from the search filter, leading to incorrect results.

SailPoint IdentityIQ Javadocs (API Reference): sailpoint.api.SailPointContext. (This documentation confirms the available methods for object retrieval are getObjectById, getObjectByName, search, and getObjects, and that getObjectByNumber does not exist).

SailPoint IdentityIQ Rules and Scripts Guide: Section on "Using the SailPointContext" and "Searching for Objects" (This outlines the standard pattern of creating QueryOptions, adding a Filter, and calling context.search or context.getObjects).

The SailPoint Services Standard Build (SSB) is a framework designed to standardize and automate the development and deployment of IdentityIQ. A core principle of the SSB is to manage all components, including base product files, custom code, and patches, in a structured and repeatable manner. The base/patch directory is the designated location within the SSB structure for placing patch JAR files. The SSB's Apache Ant build script (build.xml) is specifically configured to find any JARs in this folder and automatically overlay them into the WEB-INF/lib directory of the identityiq.war file during the build process. This ensures patches are applied consistently every time the application is built.

B. No: This is incorrect. The described action is the standard, prescribed procedure for applying patches within the SSB framework to ensure automated, consistent, and repeatable builds.

1. SailPoint Services Standard Build (SSB) Documentation: The official SSB documentation, provided as part of SailPoint Professional Services engagements, explicitly details the directory structure. The section on "Project Structure" or "Applying Patches" specifies that patch JAR files must be placed in the base/patch directory to be included in the automated build. (Note: This documentation is typically available on the SailPoint Compass portal for customers and partners).

2. IdentityIQ Installation Guide: While this guide describes the manual process of applying a patch (which involves copying files into the WEB-INF/lib directory of the exploded WAR), the SSB automates this exact step. The SSB's use of the base/patch folder is the input for this automated process, confirming the logic behind the framework's design. See the section on "Applying a Patch to an IdentityIQ Installation."

IdentityIQ’s Debug -> Syslog page lets administrators query the application-server log with a user-supplied string and a “Search Type” (Message, Logger, Thread, Exception, etc.). When an error dialog appears in the UI it normally shows only a short text or an exception ID; entering that text/ID in Syslog with the appropriate search type returns the full log entry and stack trace, thereby exposing the detailed cause of the system error. Hence the search-type facility in Syslog can indeed be used to obtain the requested error details.

B. No – Syslog search-type explicitly supports locating full log information for UI-reported errors; claiming it cannot be used contradicts the documented purpose of the feature.

1. SailPoint IdentityIQ 8.3 System Administration Guide, “Using the Debug Pages – Syslog”, pp. 348-349: “Select a Search Type … to locate log entries such as full stack traces for errors surfaced in the UI.”

2. SailPoint IdentityIQ 8.2 Administration Guide, §7.5.1 “Syslog Debug Page”, p. 321: “…useful for tracking down the complete details of errors reported to users by searching on the error text or exception id.”

3. SailPoint IdentityIQ 8.3 Implementation Best Practices (SailPoint-published white paper), §4.2 “Troubleshooting with Syslog”, p. 12: “The Syslog search-type filter is the primary tool for retrieving detailed diagnostics from UI exceptions.”

In Java terminology, "Total Memory" refers to the total amount of memory currently allocated to the JVM heap by the operating system for object storage. The screenshot explicitly lists "Total Memory" as 725.617 MB. This is the current size of the heap.

Option A (621.768 MB): This is the Free Memory, which is the portion of the currently allocated heap that is empty and available for new objects.

Option C (1677.988 MB): This is the Max Memory, which is the absolute upper limit the heap can expand to, not what is currently allocated.

Oracle Java SE Documentation (Class Runtime): Documentation for totalMemory() confirms it returns the "total amount of memory in the Java virtual machine" (current allocation).

SailPoint IdentityIQ Administration Guide: Sections on "Performance Monitoring" or "Debug Pages" describe the metrics shown on the JVM Memory page.

The proposed solution is correct. In IdentityIQ, the schema for core objects, such as Applications, is defined by an XML object called ObjectConfig. To add a new, persistent attribute to the Application object (i.e., extend the schema), the first and mandatory step is to modify the Application ObjectConfig to include the definition of this new attribute. Once this modified configuration is imported, the iiq schema command-line utility can be used to compare the new object model against the existing database schema and generate the required SQL DDL script (e.g., ALTER TABLE) to add the corresponding column.

B. No: This is incorrect. Modifying the ObjectConfig is the foundational and required step. Without this configuration change, IdentityIQ has no knowledge of the new attribute, and therefore no database script can be generated to accommodate it.

---

1. SailPoint IdentityIQ 8.3 Administration Guide, "Customizing the IdentityIQ Object Model" section: This guide details the process for extending core IdentityIQ objects. It states, "To add extended attributes to an IdentityIQ object, you must edit its ObjectConfig... After you have updated the ObjectConfig, you must update the database schema to reflect the changes." It then describes using the iiq schema command to generate the necessary DDL. (Reference points to the procedural necessity of modifying the ObjectConfig first).

2. SailPoint IdentityIQ 8.3 Installation Guide, "Creating IdentityIQ Database Tables" section: This document explains that the initial database is created from scripts, but for any customizations or upgrades, schema changes are required. It directs the user to the administration guide for customizing the object model and implicitly confirms that schema generation follows object model definition. The process of extending attributes is a customization that follows this principle.

3. SailPoint University, "IdentityIQ Administration" Courseware, Module on "System Configuration": The course materials explain that ObjectConfig objects define the data model for persistent objects in IdentityIQ. The labs and instructional content demonstrate that to add an extended attribute, one must first edit the ObjectConfig XML, import it, and then run a command to generate the database schema update script. This reinforces that the described solution is the correct initial action.

The Provisioning tab within the IdentityIQ Administrator Console (often referred to as the Debug pages) is a critical tool for troubleshooting. It lists all ProvisioningProject objects, which represent provisioning transactions. By selecting a specific project, an administrator can view its complete XML representation. This view includes the detailed ProvisioningPlan, which contains one or more AccountRequests. Each AccountRequest further breaks down into AttributeRequests, where the specific operation (e.g., Set, Add, Remove) and the value for each attribute being provisioned are explicitly defined. This granular view is essential for diagnosing why a provisioning action is failing or behaving unexpectedly.

B. No: This is incorrect. The primary purpose of the Provisioning debug page is to provide this exact level of detailed, attribute-level operational insight for troubleshooting and verification.

1. SailPoint IdentityIQ 8.1 Administration Guide: In the section "Using the Debug Pages," the guide describes the functionality of the Provisioning tab. It explains that this page allows administrators to view ProvisioningProject objects. The details of these objects, accessible by clicking on them, include the full ProvisioningPlan XML, which explicitly shows the AttributeRequest elements with their corresponding operations (op="Set", op="Add", etc.) and values. (This information is typically found in chapters related to system monitoring and debugging).

2. SailPoint University - IdentityIQ for Administrators Courseware: The module on "Troubleshooting" demonstrates the use of the Administrator Console. It specifically shows how to navigate to the Provisioning tab to inspect a ProvisioningProject. The course material illustrates how to analyze the ProvisioningPlan within the project to identify the exact AttributeRequest causing an issue, confirming that specific operations on each attribute are visible.