The action "Schedule Policy Composition Certification" is not a valid remediation option for a policy violation owner. This type of certification is an administrative task used to review and validate the definition and rules of the policy itself, not to act upon a specific instance of a violation for a user. The standard remediation options available to a policy violation owner are focused on the violation itself, such as remediating the access (e.g., revoking a role), allowing a temporary exception, or forwarding the violation to another user for a decision.

A. Yes: This is incorrect because the action addresses the policy's definition, not the specific user's violation. The violation owner's responsibility is to manage the violation instance, not the policy's composition.

1. SailPoint IdentityIQ 8.2 - User Guide for Certifications, Compliance, and Reports, "Policy Composition Certification," Page 10: "Policy composition certifications are used to review the details of a policy to ensure that it is still valid and accurate. For example, you might create a policy composition certification to review the rules associated with a separation of duties policy." This confirms the action is for reviewing the policy's definition.

2. SailPoint IdentityIQ 8.2 - Administrator Guide, "Managing Policy Violations," Page 421: This section details the actions available from the Policy Violations page. The standard actions listed for a violation owner are "Remediate," "Allow Exception," and "Forward." The option to "Schedule Policy Composition Certification" is not listed as a direct remediation action for a violation.

Scenario 1 (Entitlement SOD): This rule identifies a "toxic combination" between specific system permissions: membership in an Active Directory group (an entitlement) and a specific access right in an application (another entitlement). Since it restricts the combination of distinct entitlements, it is an Entitlement Separation of Duties (SOD) policy.

Scenario 2 (Account): This rule imposes a constraint on the account entity itself—specifically, the cardinality (quantity) of accounts a single identity is permitted to hold on a target application. Policies governing account attributes, ownership, or quantity fall under the Account policy type.

Scenario 3 (Role SOD): This rule explicitly defines mutual exclusivity between high-level business roles (VPN/Travel Role vs. Contractor Role). When a policy restricts users from holding conflicting functional roles simultaneously, it is defined as a Role Separation of Duties (SOD) policy.

SailPoint IdentityIQ Administration Guide, Section: Policies. Defines Entitlement SOD Policies as those used to "prevent users from having conflicting entitlements" and Role SOD Policies as those used to "prevent users from having conflicting roles."

SailPoint IdentityIQ Administration Guide, Section: Account Policies. States that Account Policies are used to enforce constraints on account attributes or specific account criteria (e.g., checking for multiple accounts or specific attribute states).

SailPoint IdentityIQ User Guide, Section: Define a Policy. Details the distinction between Advanced Policies (complex logic/rules) versus standard SOD configurations.

The statement is false. In SailPoint IdentityIQ, the Application object is a mandatory prerequisite for aggregating account information from any external source. This object serves as the blueprint for the connection, defining the connector type, connection parameters (e.g., host, credentials), and the schema for the data to be imported. The Account Aggregation task, which performs the data loading, must be configured to run against a specific Application object. Without it, IdentityIQ has no knowledge of the target system, how to connect to it, or how to interpret the data it receives.

A. Yes: This is incorrect. Aggregation is impossible without an Application object to define the target system and its associated connection and schema details.

1. SailPoint IdentityIQ 8.3 Administration Guide, "Chapter 4: Onboarding Applications": This chapter explicitly states, "The first step in bringing data from a new application into IdentityIQ is to define the application in IdentityIQ." This establishes the Application object as the foundational element before any data aggregation can occur.

2. SailPoint IdentityIQ 8.3 Connectors Administration and Configuration Guide, "Introduction to Connectors": The guide explains that a connector is configured within an Application object. It details that "IdentityIQ uses connectors to load (aggregate) data from your native applications into the IdentityIQ repository." This directly links the aggregation process to a configured Application object.

3. SailPoint IdentityIQ 8.3 Technical Whitepaper: The Identity Cube: This document describes the Identity Cube's composition. It explains that Link objects (accounts) are associated with an Application and an Identity. The document's model shows that Links are populated through aggregation from a source system, which is defined in IdentityIQ as an Application. This architectural description confirms the Application object's essential role.

The proposed solution is incorrect. A PostIterate rule is executed after the connector has processed all provisioning requests for a single identity. It does not have direct access to the ProvisioningResult object of each individual operation, which contains the specific status and error messages.

The correct rule for this requirement is an AfterProvisioning rule. This rule is triggered after each individual provisioning transaction is attempted. It is passed the ProvisioningResult object, which can be inspected to check for a failure status. If a failure is detected, the rule can then access the error message from the result and create a custom AuditEvent.

A (Yes): This is incorrect. The PostIterate rule is designed for cleanup or finalization after all provisioning for an identity is complete, not for handling the outcome of individual failed operations.

1. SailPoint IdentityIQ 8.3 Administration Guide: In the section on "Provisioning Rules," the AfterProvisioning rule is described as being "run after a provisioning transaction is attempted for a specific application." It explicitly states that the rule is passed the ProvisioningResult object, which is essential for determining the outcome of the operation. (Reference specific section on "Rule Type: AfterProvisioning").

2. SailPoint IdentityIQ 8.3 Technical Whitepaper: Rules and Scripts in IdentityIQ: This document details the arguments available to different rule types. For the AfterProvisioning rule, the signature includes (plan, request, result), where result is the ProvisioningResult object. In contrast, the PostIterate rule signature is (plan, connector), which lacks the specific operation result needed to capture the error message. (Reference section detailing rule signatures and arguments).

IdentityIQ ships standard message-bundle (.properties) files for the user interface. Administrators may (1) add additional language bundles and (2) override or even directly edit the vendor-supplied bundles, although direct editing is discouraged because upgrades overwrite those files. Because modification is technically allowed, the statement that the “out-of-the-box supplied message files cannot be modified” is false.

A. Yes – Wrong. Vendor documentation states the shipped bundles can be edited or overridden; they are not immutable.

1. SailPoint IdentityIQ 8.3 Administration Guide, “Localization and Internationalization,” Sect. 27.3, pp. 465-466: “You can override the default text by editing the shipped message bundles or by adding a higher-priority custom bundle.”

2. SailPoint IdentityIQ 7.3 Implementation Guide, Sect. “Customizing Message Bundles,” p. 342: “Although you may modify IdentityIQ-supplied .properties files, best practice is to create a custom copy so upgrades do not overwrite your changes.”

3. SailPoint IdentityIQ Developer Training Courseware, Module ‘I18N Basics’, slide 18: “Two options: 1) edit base bundles; 2) supply custom.properties to override defaults.”

The primary purpose of an IdentityIQ certification, also known as an access review or attestation, is to have a designated individual (e.g., a manager or application owner) formally review and validate a user's access rights to systems and applications. By approving an access item during a certification campaign, the reviewer is officially attesting that the access is appropriate, necessary for the user's job function, and compliant with business policies. This creates an auditable record for governance and compliance purposes, confirming that access has been periodically verified by a responsible party.

B. No: This is incorrect. The term "attestation" is often used interchangeably with "certification" in the context of identity governance. The core function of this process is for a reviewer to attest to the validity of a user's access.

---

1. SailPoint IdentityIQ 8.1 Administration Guide, Document Version: 8.1, "Chapter 13: Certification", Page 341: "Certifications are the primary mechanism for reviewing and verifying user access to applications and data within IdentityIQ. During a certification process, reviewers are presented with a list of user access privileges and must either approve (certify) or revoke the access."

2. SailPoint IdentityIQ 8.1 User Guide, Document Version: 8.1, "Understanding Access Reviews", Page 11: "Access reviews, also called certifications or attestations, are the process of validating that users have the appropriate access to the appropriate resources at a specific point in time."

3. SailPoint Compass Documentation, "Certifications" article: "Certifications are a key component of identity governance. They are the principal means by which organizations can review and validate user access to applications and their entitlements... The reviewer must make a decision for each item to either approve or revoke it." This decision-making process is the act of attestation.

A Business Role is a standard, out-of-the-box role type in SailPoint IdentityIQ designed to model a user's business function (e.g., "Accounts Payable Clerk"). These roles bundle the necessary access (IT roles and entitlements) required for that function. A primary purpose of Business Roles is to simplify access management by allowing non-technical users, such as managers, to request access in understandable business terms. Therefore, a manager requesting a Business Role to extend an employee's access is a default and intended use case within the IdentityIQ access request process.

B. No: This is incorrect. The core design of Business Roles in IdentityIQ is to serve as user-friendly, requestable units of access that align with business functions, making them a default option in the access request system for managers.

1. SailPoint IdentityIQ 8.1 - Role Management Guide, Page 9, "Role Types": "Business roles are typically used to model job functions or positions within an organization, such as 'Accountant' or 'Sales Manager.' ... Business roles are often made requestable by end users." This confirms that Business Roles are a standard type designed to be requestable.

2. SailPoint IdentityIQ 8.0 - Administration Guide, Page 423, "Managing Access Requests": The guide details the Lifecycle Manager component, which facilitates access requests. It states, "Users can request that roles or entitlements be added to or removed from their own accounts or from the accounts of other users they are authorized to manage." Business Roles are a primary type of "role" available in this process.

3. SailPoint University, "IdentityIQ Role-Based Access Control (RBAC)": Course materials consistently describe the role model hierarchy where Business Roles are at the top, designed for request by business users. The model's intent is to abstract technical IT Roles and entitlements into logical, job-related Business Roles that managers can easily understand and request for their direct reports.

IdentityIQ supports “Admin Roles.”

An Admin Role is a normal Role object that is configured to hold one or more IdentityIQ capabilities; any identity that receives the role inherits all of those capabilities. Therefore, configuring a role to include a set of IdentityIQ capabilities is a fully-supported and valid role option.

B. No – Roles can be flagged as Admin Roles and populated with capability names, so the statement is valid; selecting “No” contradicts documented product functionality.

1. SailPoint IdentityIQ 8.3 Administration Guide, “Managing Capabilities and Admin Roles,” pp. 130-134: “Admin roles bundle one or more capabilities. When the role is assigned to a user, the capabilities are automatically granted.”

2. SailPoint IdentityIQ 8.3 Concepts Guide, Section “Role Types,” p. 45: “Admin Role – a role that grants IdentityIQ capabilities to its members.”

3. SailPoint IdentityIQ 8.2 Security Model Reference, Section 2.3 “Capabilities,” para 4: “Capabilities may be assigned directly to an identity or indirectly through an Admin Role that contains a capability list.”

The Rapid Setup interface is a streamlined configuration wizard designed for common, high-level IdentityIQ setup tasks. While IdentityIQ's underlying business process engine is capable of reassigning object ownership to a manager during a Leaver event, this specific logic is not exposed as a configurable option within the Rapid Setup UI. This level of customization requires direct modification of the Lifecycle - Leaver business process (workflow) in the expert configuration mode, which is outside the scope of Rapid Setup's simplified interface.

A. Yes: This is incorrect because the Rapid Setup UI is limited to basic configurations and does not provide the granular controls needed to define the logic for reassigning object ownership.

1. SailPoint IdentityIQ 8.3 Administration Guide: The "Rapid Setup" chapter details the features available through the wizard. It describes the configuration of Lifecycle Events at a high level, such as enabling events and configuring manager certifications, but makes no mention of configuring the logic for reassigning owned objects. This contrasts with the "Business Processes" chapter, which describes the detailed customization of workflows like Lifecycle - Leaver.

2. SailPoint IdentityIQ 8.3 Technical Whitepaper: Lifecycle Manager: This document explains that complex actions within lifecycle events are handled by business processes. The "Leaver" event process includes a step for reassigning owned items, but its configuration (e.g., defining the new owner as the manager) is managed by editing the workflow arguments or the workflow XML itself, not through a simplified UI like Rapid Setup.

Yes, "Entitlement Role" is a standard, out-of-the-box role type in SailPoint IdentityIQ. It is the most granular role, representing a single entitlement on a single application (e.g., a specific group in Active Directory). Entitlement roles serve as the fundamental building blocks for more complex roles within the IdentityIQ role model. They are typically discovered through role mining or created manually and then nested within IT Roles, which are in turn nested within Business Roles to model user access based on job functions.

B. No: This is incorrect because official SailPoint IdentityIQ documentation explicitly defines "Entitlement Role" as one of the four default role types available in the platform.

1. SailPoint IdentityIQ 8.3 - Role Management Guide: In the "Introduction to Roles" chapter, the section titled "Role Types" states, "IdentityIQ supports four types of roles: business roles, IT roles, entitlement roles, and organizational roles." It proceeds to describe an Entitlement Role as a "low-level role that represents a single entitlement on a single application."

2. SailPoint IdentityIQ 8.2 - Administrator's Guide: The "Managing Roles" section details the process for creating and managing roles. It includes specific instructions for creating each of the default role types, including Entitlement Roles, confirming their status as a standard feature.