Free IdentityIQ-Engineer Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The IdentityIQ Console (iiq console) provides a command-line interface for administration and debugging.

• connectorDebug: This command is used specifically to invoke and test the raw methods of a connector (such as iterate, authenticate, or checkStatus) against a specific Application configuration without running a full task.
• list: This is a fundamental command used to display a list of entities for a specific object class (e.g., list Identity, list Application, list Bundle).
• source: Similar to Unix shell usage, this command reads an external file containing a sequence of console commands and executes them in the current session.
• provision: This command takes a provisioning plan (typically defined in an XML file) as input, compiles it, and executes the provisioning actions against the target resources.

SailPoint IdentityIQ System Administration Guide, Section: "The IdentityIQ Console" (Console Commands Reference).

Reference Details: The help command output within the console documentation explicitly defines source as "Execute a file of commands" and list as "List objects".

SailPoint IdentityIQ Console Guide, Command Reference Table.

Reference Details: Defines connectorDebug (or connector in some versions) as the tool to "Execute a connector method on a specified application" to verify connectivity and logic.

SailPoint IdentityIQ Technical Whitepaper, "Debugging and Troubleshooting".

Reference Details: Describes using the provision command to manually test provisioning plans during development.

The four steps provided in the image accurately represent the high-level process for creating and reporting on a custom audit event in SailPoint IdentityIQ. The process requires defining the event, providing a mechanism to trigger it, and creating a report to view the generated data. This is accomplished by creating:

1. AuditAction and AuditEvent objects to define the event's name and data structure.

2. A Rule object containing the script to generate the event (e.g., by calling AuditLog.log()).

3. A TaskDefinition object (referred to as a Report object) for a Live Report to query and display the custom audit records.

B. No: This option is incorrect because the four listed steps are the essential IdentityIQ artifacts that must be configured to successfully define, generate, and report on a custom audit event.

1. SailPoint IdentityIQ Administration Guide: The chapter on "Auditing," specifically the section on "Custom Audit Events," describes the necessity of creating both an AuditAction object and an AuditEvent object to define a new event type.

2. SailPoint IdentityIQ Administration Guide: The "Auditing" chapter also provides examples of how to generate these events using BeanShell scripts, which are typically encapsulated within a Rule object for reusability and execution from business processes.

3. SailPoint IdentityIQ Reporting Guide: The chapter covering "Live Reports" details the procedure for creating a new report by defining a TaskDefinition object. This object is configured to query IdentityIQ's Hibernate objects, such as the AuditEvent object, to retrieve and display the desired data.

The proposed solution is incorrect. The "Rehire" action is a specific Lifecycle Event designed to process the return of a previously terminated employee. This event typically triggers a comprehensive workflow similar to a new hire. To allow a user to simply enable an existing, disabled account for a subordinate or themselves, the "Enable Account" action must be configured. This is done within the "Manage Accounts Options" section of the Lifecycle Manager (LCM) configuration, where specific account-level actions like enable, disable, and unlock are defined for different applications.

A. Yes: This is incorrect because the "Rehire" action is a full lifecycle event, not the granular account management function needed to simply enable a disabled account for a current user.

1. SailPoint IdentityIQ 8.1 Administration Guide: In the "Configuring Lifecycle Manager" chapter, the guide distinguishes between "Configuring Lifecycle Events" (which includes Rehire) and "Configuring Manage Accounts Options." The "Manage Accounts Options" section details the configuration of actions like Enable, Disable, and Unlock that appear in the Manage Accounts interface. This separation confirms that "Rehire" is not an action within "Manage Accounts." (Refer to sections on "Lifecycle Events" and "Manage Accounts Options").

2. SailPoint IdentityIQ 8.2 - User Guide: The "Managing Accounts" section describes the user-facing functionality. It shows how managers can select subordinates and perform actions like "Enable Account" or "Disable Account" if they have the appropriate permissions. The "Rehire" process is described as a separate request initiated through the Lifecycle Manager interface, not as an option on the Manage Accounts page. (Refer to the chapter "Using the Lifecycle Manager").

To enable tracing for a specific component in SailPoint IdentityIQ, administrators must modify the Log4j configuration.

1. Locate the File: The primary logging configuration file for IdentityIQ is log4j.properties (or log4j2.properties in versions 8.0+), located in the WEB-INF/classes directory.
2. Enable the Logger: The specific logger for Certifications (often referred to internally or in older versions/exams as Certificationer) is commented out by default. Removing the # activates it.
3. Set Level: The default level in the provided line is info. The question requires trace, so the value must be manually updated.
4. Apply Changes: While dynamic reloading is possible via the Debug pages, the standard system-level procedure to ensure all property changes (especially in the classpath) take full effect is to restart the application server (e.g., Tomcat).

SailPoint IdentityIQ Administration Guide / System Administrator Guide: Section on "Logging" or "System Monitoring," which details the location of log4j.properties in WEB-INF/classes.

SailPoint Compass Community (Official Knowledge Base): "How to find Log4j.properties and IdentityIQ logs" (Article ID: TA-P/72506). This article confirms the path WEB-INF/classes/log4j.properties.

Apache Log4j Documentation: Verifies that standard .properties files for web applications are placed in WEB-INF/classes for the classloader to find them.

SailPoint Developer Community: Discussion threads (e.g., "Certification is showing pending") often cite enabling sailpoint.api.Certificationer to trace for troubleshooting certification generation issues.

The code is incorrect and will not function as intended. First, the SailPointContext interface does not contain a method named getObjectByNumber. Second, the logic is fundamentally flawed because the retrieval step completely ignores the Filter. By iterating from 0 to n and attempting to fetch by index (even if such a method existed), the code would retrieve the first nGroupDefinition objects in the database (or cache) based on default ordering, rather than the specific objects owned by "Randy.Knight". The correct approach is to use context.search(GroupDefinition.class, qo) or context.getObjects(GroupDefinition.class, qo), which returns a collection or iterator of the specific objects matching the query criteria.

Option A (Yes): The code fails because it uses non-existent API methods (getObjectByNumber) and logically decouples the retrieval of objects from the search filter, leading to incorrect results.

SailPoint IdentityIQ Javadocs (API Reference): sailpoint.api.SailPointContext. (This documentation confirms the available methods for object retrieval are getObjectById, getObjectByName, search, and getObjects, and that getObjectByNumber does not exist).

SailPoint IdentityIQ Rules and Scripts Guide: Section on "Using the SailPointContext" and "Searching for Objects" (This outlines the standard pattern of creating QueryOptions, adding a Filter, and calling context.search or context.getObjects).

The SailPoint Services Standard Build (SSB) is a framework designed to standardize and automate the development and deployment of IdentityIQ. A core principle of the SSB is to manage all components, including base product files, custom code, and patches, in a structured and repeatable manner. The base/patch directory is the designated location within the SSB structure for placing patch JAR files. The SSB's Apache Ant build script (build.xml) is specifically configured to find any JARs in this folder and automatically overlay them into the WEB-INF/lib directory of the identityiq.war file during the build process. This ensures patches are applied consistently every time the application is built.

B. No: This is incorrect. The described action is the standard, prescribed procedure for applying patches within the SSB framework to ensure automated, consistent, and repeatable builds.

1. SailPoint Services Standard Build (SSB) Documentation: The official SSB documentation, provided as part of SailPoint Professional Services engagements, explicitly details the directory structure. The section on "Project Structure" or "Applying Patches" specifies that patch JAR files must be placed in the base/patch directory to be included in the automated build. (Note: This documentation is typically available on the SailPoint Compass portal for customers and partners).

2. IdentityIQ Installation Guide: While this guide describes the manual process of applying a patch (which involves copying files into the WEB-INF/lib directory of the exploded WAR), the SSB automates this exact step. The SSB's use of the base/patch folder is the input for this automated process, confirming the logic behind the framework's design. See the section on "Applying a Patch to an IdentityIQ Installation."

IdentityIQ’s Debug -> Syslog page lets administrators query the application-server log with a user-supplied string and a “Search Type” (Message, Logger, Thread, Exception, etc.). When an error dialog appears in the UI it normally shows only a short text or an exception ID; entering that text/ID in Syslog with the appropriate search type returns the full log entry and stack trace, thereby exposing the detailed cause of the system error. Hence the search-type facility in Syslog can indeed be used to obtain the requested error details.

B. No – Syslog search-type explicitly supports locating full log information for UI-reported errors; claiming it cannot be used contradicts the documented purpose of the feature.

1. SailPoint IdentityIQ 8.3 System Administration Guide, “Using the Debug Pages – Syslog”, pp. 348-349: “Select a Search Type … to locate log entries such as full stack traces for errors surfaced in the UI.”

2. SailPoint IdentityIQ 8.2 Administration Guide, §7.5.1 “Syslog Debug Page”, p. 321: “…useful for tracking down the complete details of errors reported to users by searching on the error text or exception id.”

3. SailPoint IdentityIQ 8.3 Implementation Best Practices (SailPoint-published white paper), §4.2 “Troubleshooting with Syslog”, p. 12: “The Syslog search-type filter is the primary tool for retrieving detailed diagnostics from UI exceptions.”

In Java terminology, "Total Memory" refers to the total amount of memory currently allocated to the JVM heap by the operating system for object storage. The screenshot explicitly lists "Total Memory" as 725.617 MB. This is the current size of the heap.

Option A (621.768 MB): This is the Free Memory, which is the portion of the currently allocated heap that is empty and available for new objects.

Option C (1677.988 MB): This is the Max Memory, which is the absolute upper limit the heap can expand to, not what is currently allocated.

Oracle Java SE Documentation (Class Runtime): Documentation for totalMemory() confirms it returns the "total amount of memory in the Java virtual machine" (current allocation).

SailPoint IdentityIQ Administration Guide: Sections on "Performance Monitoring" or "Debug Pages" describe the metrics shown on the JVM Memory page.

The proposed solution is correct. In IdentityIQ, the schema for core objects, such as Applications, is defined by an XML object called ObjectConfig. To add a new, persistent attribute to the Application object (i.e., extend the schema), the first and mandatory step is to modify the Application ObjectConfig to include the definition of this new attribute. Once this modified configuration is imported, the iiq schema command-line utility can be used to compare the new object model against the existing database schema and generate the required SQL DDL script (e.g., ALTER TABLE) to add the corresponding column.

B. No: This is incorrect. Modifying the ObjectConfig is the foundational and required step. Without this configuration change, IdentityIQ has no knowledge of the new attribute, and therefore no database script can be generated to accommodate it.

---

1. SailPoint IdentityIQ 8.3 Administration Guide, "Customizing the IdentityIQ Object Model" section: This guide details the process for extending core IdentityIQ objects. It states, "To add extended attributes to an IdentityIQ object, you must edit its ObjectConfig... After you have updated the ObjectConfig, you must update the database schema to reflect the changes." It then describes using the iiq schema command to generate the necessary DDL. (Reference points to the procedural necessity of modifying the ObjectConfig first).

2. SailPoint IdentityIQ 8.3 Installation Guide, "Creating IdentityIQ Database Tables" section: This document explains that the initial database is created from scripts, but for any customizations or upgrades, schema changes are required. It directs the user to the administration guide for customizing the object model and implicitly confirms that schema generation follows object model definition. The process of extending attributes is a customization that follows this principle.

3. SailPoint University, "IdentityIQ Administration" Courseware, Module on "System Configuration": The course materials explain that ObjectConfig objects define the data model for persistent objects in IdentityIQ. The labs and instructional content demonstrate that to add an extended attribute, one must first edit the ObjectConfig XML, import it, and then run a command to generate the database schema update script. This reinforces that the described solution is the correct initial action.

The Provisioning tab within the IdentityIQ Administrator Console (often referred to as the Debug pages) is a critical tool for troubleshooting. It lists all ProvisioningProject objects, which represent provisioning transactions. By selecting a specific project, an administrator can view its complete XML representation. This view includes the detailed ProvisioningPlan, which contains one or more AccountRequests. Each AccountRequest further breaks down into AttributeRequests, where the specific operation (e.g., Set, Add, Remove) and the value for each attribute being provisioned are explicitly defined. This granular view is essential for diagnosing why a provisioning action is failing or behaving unexpectedly.

B. No: This is incorrect. The primary purpose of the Provisioning debug page is to provide this exact level of detailed, attribute-level operational insight for troubleshooting and verification.

1. SailPoint IdentityIQ 8.1 Administration Guide: In the section "Using the Debug Pages," the guide describes the functionality of the Provisioning tab. It explains that this page allows administrators to view ProvisioningProject objects. The details of these objects, accessible by clicking on them, include the full ProvisioningPlan XML, which explicitly shows the AttributeRequest elements with their corresponding operations (op="Set", op="Add", etc.) and values. (This information is typically found in chapters related to system monitoring and debugging).

2. SailPoint University - IdentityIQ for Administrators Courseware: The module on "Troubleshooting" demonstrates the use of the Administrator Console. It specifically shows how to navigate to the Provisioning tab to inspect a ProvisioningProject. The course material illustrates how to analyze the ProvisioningPlan within the project to identify the exact AttributeRequest causing an issue, confirming that specific operations on each attribute are visible.

The action "Schedule Policy Composition Certification" is not a valid remediation option for a policy violation owner. This type of certification is an administrative task used to review and validate the definition and rules of the policy itself, not to act upon a specific instance of a violation for a user. The standard remediation options available to a policy violation owner are focused on the violation itself, such as remediating the access (e.g., revoking a role), allowing a temporary exception, or forwarding the violation to another user for a decision.

A. Yes: This is incorrect because the action addresses the policy's definition, not the specific user's violation. The violation owner's responsibility is to manage the violation instance, not the policy's composition.

1. SailPoint IdentityIQ 8.2 - User Guide for Certifications, Compliance, and Reports, "Policy Composition Certification," Page 10: "Policy composition certifications are used to review the details of a policy to ensure that it is still valid and accurate. For example, you might create a policy composition certification to review the rules associated with a separation of duties policy." This confirms the action is for reviewing the policy's definition.

2. SailPoint IdentityIQ 8.2 - Administrator Guide, "Managing Policy Violations," Page 421: This section details the actions available from the Policy Violations page. The standard actions listed for a violation owner are "Remediate," "Allow Exception," and "Forward." The option to "Schedule Policy Composition Certification" is not listed as a direct remediation action for a violation.

Scenario 1 (Entitlement SOD): This rule identifies a "toxic combination" between specific system permissions: membership in an Active Directory group (an entitlement) and a specific access right in an application (another entitlement). Since it restricts the combination of distinct entitlements, it is an Entitlement Separation of Duties (SOD) policy.

Scenario 2 (Account): This rule imposes a constraint on the account entity itself—specifically, the cardinality (quantity) of accounts a single identity is permitted to hold on a target application. Policies governing account attributes, ownership, or quantity fall under the Account policy type.

Scenario 3 (Role SOD): This rule explicitly defines mutual exclusivity between high-level business roles (VPN/Travel Role vs. Contractor Role). When a policy restricts users from holding conflicting functional roles simultaneously, it is defined as a Role Separation of Duties (SOD) policy.

SailPoint IdentityIQ Administration Guide, Section: Policies. Defines Entitlement SOD Policies as those used to "prevent users from having conflicting entitlements" and Role SOD Policies as those used to "prevent users from having conflicting roles."

SailPoint IdentityIQ Administration Guide, Section: Account Policies. States that Account Policies are used to enforce constraints on account attributes or specific account criteria (e.g., checking for multiple accounts or specific attribute states).

SailPoint IdentityIQ User Guide, Section: Define a Policy. Details the distinction between Advanced Policies (complex logic/rules) versus standard SOD configurations.

The statement is false. In SailPoint IdentityIQ, the Application object is a mandatory prerequisite for aggregating account information from any external source. This object serves as the blueprint for the connection, defining the connector type, connection parameters (e.g., host, credentials), and the schema for the data to be imported. The Account Aggregation task, which performs the data loading, must be configured to run against a specific Application object. Without it, IdentityIQ has no knowledge of the target system, how to connect to it, or how to interpret the data it receives.

A. Yes: This is incorrect. Aggregation is impossible without an Application object to define the target system and its associated connection and schema details.

1. SailPoint IdentityIQ 8.3 Administration Guide, "Chapter 4: Onboarding Applications": This chapter explicitly states, "The first step in bringing data from a new application into IdentityIQ is to define the application in IdentityIQ." This establishes the Application object as the foundational element before any data aggregation can occur.

2. SailPoint IdentityIQ 8.3 Connectors Administration and Configuration Guide, "Introduction to Connectors": The guide explains that a connector is configured within an Application object. It details that "IdentityIQ uses connectors to load (aggregate) data from your native applications into the IdentityIQ repository." This directly links the aggregation process to a configured Application object.

3. SailPoint IdentityIQ 8.3 Technical Whitepaper: The Identity Cube: This document describes the Identity Cube's composition. It explains that Link objects (accounts) are associated with an Application and an Identity. The document's model shows that Links are populated through aggregation from a source system, which is defined in IdentityIQ as an Application. This architectural description confirms the Application object's essential role.

The proposed solution is incorrect. A PostIterate rule is executed after the connector has processed all provisioning requests for a single identity. It does not have direct access to the ProvisioningResult object of each individual operation, which contains the specific status and error messages.

The correct rule for this requirement is an AfterProvisioning rule. This rule is triggered after each individual provisioning transaction is attempted. It is passed the ProvisioningResult object, which can be inspected to check for a failure status. If a failure is detected, the rule can then access the error message from the result and create a custom AuditEvent.

A (Yes): This is incorrect. The PostIterate rule is designed for cleanup or finalization after all provisioning for an identity is complete, not for handling the outcome of individual failed operations.

1. SailPoint IdentityIQ 8.3 Administration Guide: In the section on "Provisioning Rules," the AfterProvisioning rule is described as being "run after a provisioning transaction is attempted for a specific application." It explicitly states that the rule is passed the ProvisioningResult object, which is essential for determining the outcome of the operation. (Reference specific section on "Rule Type: AfterProvisioning").

2. SailPoint IdentityIQ 8.3 Technical Whitepaper: Rules and Scripts in IdentityIQ: This document details the arguments available to different rule types. For the AfterProvisioning rule, the signature includes (plan, request, result), where result is the ProvisioningResult object. In contrast, the PostIterate rule signature is (plan, connector), which lacks the specific operation result needed to capture the error message. (Reference section detailing rule signatures and arguments).

IdentityIQ ships standard message-bundle (.properties) files for the user interface. Administrators may (1) add additional language bundles and (2) override or even directly edit the vendor-supplied bundles, although direct editing is discouraged because upgrades overwrite those files. Because modification is technically allowed, the statement that the “out-of-the-box supplied message files cannot be modified” is false.

A. Yes – Wrong. Vendor documentation states the shipped bundles can be edited or overridden; they are not immutable.

1. SailPoint IdentityIQ 8.3 Administration Guide, “Localization and Internationalization,” Sect. 27.3, pp. 465-466: “You can override the default text by editing the shipped message bundles or by adding a higher-priority custom bundle.”

2. SailPoint IdentityIQ 7.3 Implementation Guide, Sect. “Customizing Message Bundles,” p. 342: “Although you may modify IdentityIQ-supplied .properties files, best practice is to create a custom copy so upgrades do not overwrite your changes.”

3. SailPoint IdentityIQ Developer Training Courseware, Module ‘I18N Basics’, slide 18: “Two options: 1) edit base bundles; 2) supply custom.properties to override defaults.”

The primary purpose of an IdentityIQ certification, also known as an access review or attestation, is to have a designated individual (e.g., a manager or application owner) formally review and validate a user's access rights to systems and applications. By approving an access item during a certification campaign, the reviewer is officially attesting that the access is appropriate, necessary for the user's job function, and compliant with business policies. This creates an auditable record for governance and compliance purposes, confirming that access has been periodically verified by a responsible party.

B. No: This is incorrect. The term "attestation" is often used interchangeably with "certification" in the context of identity governance. The core function of this process is for a reviewer to attest to the validity of a user's access.

---

1. SailPoint IdentityIQ 8.1 Administration Guide, Document Version: 8.1, "Chapter 13: Certification", Page 341: "Certifications are the primary mechanism for reviewing and verifying user access to applications and data within IdentityIQ. During a certification process, reviewers are presented with a list of user access privileges and must either approve (certify) or revoke the access."

2. SailPoint IdentityIQ 8.1 User Guide, Document Version: 8.1, "Understanding Access Reviews", Page 11: "Access reviews, also called certifications or attestations, are the process of validating that users have the appropriate access to the appropriate resources at a specific point in time."

3. SailPoint Compass Documentation, "Certifications" article: "Certifications are a key component of identity governance. They are the principal means by which organizations can review and validate user access to applications and their entitlements... The reviewer must make a decision for each item to either approve or revoke it." This decision-making process is the act of attestation.

A Business Role is a standard, out-of-the-box role type in SailPoint IdentityIQ designed to model a user's business function (e.g., "Accounts Payable Clerk"). These roles bundle the necessary access (IT roles and entitlements) required for that function. A primary purpose of Business Roles is to simplify access management by allowing non-technical users, such as managers, to request access in understandable business terms. Therefore, a manager requesting a Business Role to extend an employee's access is a default and intended use case within the IdentityIQ access request process.

B. No: This is incorrect. The core design of Business Roles in IdentityIQ is to serve as user-friendly, requestable units of access that align with business functions, making them a default option in the access request system for managers.

1. SailPoint IdentityIQ 8.1 - Role Management Guide, Page 9, "Role Types": "Business roles are typically used to model job functions or positions within an organization, such as 'Accountant' or 'Sales Manager.' ... Business roles are often made requestable by end users." This confirms that Business Roles are a standard type designed to be requestable.

2. SailPoint IdentityIQ 8.0 - Administration Guide, Page 423, "Managing Access Requests": The guide details the Lifecycle Manager component, which facilitates access requests. It states, "Users can request that roles or entitlements be added to or removed from their own accounts or from the accounts of other users they are authorized to manage." Business Roles are a primary type of "role" available in this process.

3. SailPoint University, "IdentityIQ Role-Based Access Control (RBAC)": Course materials consistently describe the role model hierarchy where Business Roles are at the top, designed for request by business users. The model's intent is to abstract technical IT Roles and entitlements into logical, job-related Business Roles that managers can easily understand and request for their direct reports.

IdentityIQ supports “Admin Roles.”

An Admin Role is a normal Role object that is configured to hold one or more IdentityIQ capabilities; any identity that receives the role inherits all of those capabilities. Therefore, configuring a role to include a set of IdentityIQ capabilities is a fully-supported and valid role option.

B. No – Roles can be flagged as Admin Roles and populated with capability names, so the statement is valid; selecting “No” contradicts documented product functionality.

1. SailPoint IdentityIQ 8.3 Administration Guide, “Managing Capabilities and Admin Roles,” pp. 130-134: “Admin roles bundle one or more capabilities. When the role is assigned to a user, the capabilities are automatically granted.”

2. SailPoint IdentityIQ 8.3 Concepts Guide, Section “Role Types,” p. 45: “Admin Role – a role that grants IdentityIQ capabilities to its members.”

3. SailPoint IdentityIQ 8.2 Security Model Reference, Section 2.3 “Capabilities,” para 4: “Capabilities may be assigned directly to an identity or indirectly through an Admin Role that contains a capability list.”

The Rapid Setup interface is a streamlined configuration wizard designed for common, high-level IdentityIQ setup tasks. While IdentityIQ's underlying business process engine is capable of reassigning object ownership to a manager during a Leaver event, this specific logic is not exposed as a configurable option within the Rapid Setup UI. This level of customization requires direct modification of the Lifecycle - Leaver business process (workflow) in the expert configuration mode, which is outside the scope of Rapid Setup's simplified interface.

A. Yes: This is incorrect because the Rapid Setup UI is limited to basic configurations and does not provide the granular controls needed to define the logic for reassigning object ownership.

1. SailPoint IdentityIQ 8.3 Administration Guide: The "Rapid Setup" chapter details the features available through the wizard. It describes the configuration of Lifecycle Events at a high level, such as enabling events and configuring manager certifications, but makes no mention of configuring the logic for reassigning owned objects. This contrasts with the "Business Processes" chapter, which describes the detailed customization of workflows like Lifecycle - Leaver.

2. SailPoint IdentityIQ 8.3 Technical Whitepaper: Lifecycle Manager: This document explains that complex actions within lifecycle events are handled by business processes. The "Leaver" event process includes a step for reassigning owned items, but its configuration (e.g., defining the new owner as the manager) is managed by editing the workflow arguments or the workflow XML itself, not through a simplified UI like Rapid Setup.

Yes, "Entitlement Role" is a standard, out-of-the-box role type in SailPoint IdentityIQ. It is the most granular role, representing a single entitlement on a single application (e.g., a specific group in Active Directory). Entitlement roles serve as the fundamental building blocks for more complex roles within the IdentityIQ role model. They are typically discovered through role mining or created manually and then nested within IT Roles, which are in turn nested within Business Roles to model user access based on job functions.

B. No: This is incorrect because official SailPoint IdentityIQ documentation explicitly defines "Entitlement Role" as one of the four default role types available in the platform.

1. SailPoint IdentityIQ 8.3 - Role Management Guide: In the "Introduction to Roles" chapter, the section titled "Role Types" states, "IdentityIQ supports four types of roles: business roles, IT roles, entitlement roles, and organizational roles." It proceeds to describe an Entitlement Role as a "low-level role that represents a single entitlement on a single application."

2. SailPoint IdentityIQ 8.2 - Administrator's Guide: The "Managing Roles" section details the process for creating and managing roles. It includes specific instructions for creating each of the default role types, including Entitlement Roles, confirming their status as a standard feature.