The SailPoint Certified IdentityIQ Engineer (IdentityIQ-Engineer)

The Create Identity Provisioning Policy in SailPoint IdentityIQ is designed to apply specific provisioning rules and actions during the creation of identities, especially when aggregating data from authoritative sources. These policies ensure that newly created identities have valid and authorized attribute values based on organizational rules and compliance requirements.

During identity aggregation from an authoritative source, the provisioning policy can enforce rules such as role assignments, attribute validation, and other actions necessary to ensure that the identity is created correctly and securely.

Therefore, the correct answer is A. Yes.

Yes, disabling all notifications can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In SailPoint IdentityIQ, most workflows, including those in LCM, use control variables to manage various settings, such as whether notifications should be sent. By setting the appropriate control variable (e.g., disabling email notifications) within the workflow configuration, you can effectively suppress all notifications related to that workflow.

Therefore, the correct answer is A. Yes.

This proposed implementation is not valid as written. The logic is conceptually understandable, but the XML structure is not the correct IdentityIQ workflow transition pattern. In IdentityIQ workflows, transitions are normally declared using < Transition > elements with a destination, such as to= " StepName " , and optional conditional logic through a when expression or scripted evaluation. A raw < Source > block directly inside < Transition > returning destination names is not the standard structure for expressing multiple workflow routing paths after a form step. The engineer’s requirement is to route to Stop when the reject/back action is used, route to Audit when approval occurs and the comment variable is populated, and route to Provision as the fallback. That should be implemented as separate transition definitions with explicit destination steps and conditions. The proposed XML does not properly bind the returned values to valid transition destinations in the expected workflow syntax. References/topics: IdentityIQ Engineer — workflow XML, transition elements, form step routing, BeanShell expressions, Business Process Editor.

Owner is a required and important application configuration element in IdentityIQ. Application ownership establishes accountability for the connected system and is used across governance operations such as access reviews, application owner certifications, approval routing, policy handling, and administrative responsibility. IdentityIQ’s governance model depends heavily on ownership metadata because applications are not merely technical connector records; they are governed objects. Assigning an owner allows IdentityIQ to determine who is responsible for application access, certification decisions, and operational oversight. While some low-level object imports may technically create incomplete objects, from the application setup perspective an engineer should treat Owner as required. Without an owner, downstream governance functions become weak or ambiguous because IdentityIQ cannot reliably route application-specific reviews or approvals to the responsible business or technical authority. The proposed option is therefore valid as a required setup item. References/topics: IdentityIQ Engineer — application definition, application owner, governance accountability, certification ownership, access approval routing.

This is not a joiner lifecycle event. The person already existed in the organization and previously had accounts. The scenario says their access was disabled and now needs to be reinstated, which is a rehire or reactivation process. In IdentityIQ, that is fundamentally different from onboarding a brand-new employee. A joiner process generally provisions new access and new accounts for a person who is newly hired or newly introduced to the identity-governance system. A rehire or reinstatement process should evaluate prior access, reactivate appropriate accounts, restore or recalculate roles, and avoid re-enabling access that is no longer valid. The phrase “previous accounts enabled” is the key clue: existing accounts are being reactivated, not newly created. Therefore, this proposed scenario should not be classified as a joiner lifecycle event. References/topics: IdentityIQ Engineer — joiner/mover/leaver model, rehire processing, account reactivation, LCM workflow routing, disabled account enablement.

In SailPoint IdentityIQ, the specific configuration that allows a user to enable an account for themselves or a subordinate through the " Manage Accounts " option does not necessarily need to be configured in Lifecycle Manager (LCM) alone. While LCM does provide extensive capabilities for account management actions like provisioning, rehire, and more, enabling an account is primarily tied to the permissions and entitlements granted to the user through their role, capabilities, and access profiles.

To address the specific functionality described:

Manage Accounts is typically a part of IdentityIQ’s broader account management capabilities, which are not exclusively tied to LCM. The ability to enable or disable accounts can be governed by rules and workflows within IdentityIQ, and these may or may not be linked directly to LCM configurations.

Rehire Action in LCM: The " Rehire " action within LCM Configuration is specific to processes related to reactivating an employee’s identity when they are rehired. This does not directly relate to enabling an account from the " Manage Accounts " screen. Rehire workflows typically involve reinstating the user’s previous access, which could include enabling accounts, but this is a broader process.

Permissions and Roles: The ability to enable accounts is often governed by the permissions assigned to a user’s role within IdentityIQ. These permissions may be granted outside of LCM configurations and handled by IdentityIQ’s access governance framework.

Workflow Configurations: Enabling or disabling an account could also be tied to specific workflows, which can be configured separately from LCM, using IdentityIQ’s workflow engine. These workflows determine the steps and approvals required to perform such actions.

SailPoint IdentityIQ Configuration Guide: Account Management

SailPoint IdentityIQ Lifecycle Manager Configuration Guide

SailPoint IdentityIQ Administration Guide (Sections on Roles and Permissions, Workflow Configurations)

The statement " All Identity Mappings must use a rule to set the identity attribute " is incorrect. While source mapping rules can be used to populate identity attributes dynamically, it is not mandatory for all identity mappings to rely on a rule. Identity mappings can also be configured using direct mappings, where attributes from a source are directly mapped to IdentityIQ attributes without any rule-based logic.

Therefore, the correct answer is B. No.

Yes. The Environment area under the Administrator Console is intended for administrative visibility into the running IdentityIQ environment, including product/environment details and installed components or extensions where exposed by the platform. Viewing the status or presence of installed SailPoint modules/extensions is consistent with environment inspection. This is very different from controlling the application server itself. The engineer can use IdentityIQ administrative pages to understand what is installed, enabled, or available in the current deployment, which helps during troubleshooting, patch verification, upgrade planning, and support analysis. In multi-node deployments, this kind of environment visibility is useful because module or extension inconsistencies can cause unpredictable behavior. However, viewing status does not imply the Environment tab can install, uninstall, start, or stop all components. The proposed action is read/inspection-oriented, so it fits the purpose of the tab. References/topics: IdentityIQ Engineer — Administrator Console, Environment tab, installed modules, extensions, environment validation, upgrade/troubleshooting checks.

Yes, this action can be performed as part of configuring an application definition in IdentityIQ. When defining an application, you can specify provisioning policies, including which users should be provisioned with a basic account as part of a joiner event. This is typically done by setting up account creation rules or provisioning policies that trigger when a new user (joiner) is detected, ensuring they receive the necessary basic accounts and entitlements.

Therefore, the correct answer is A. Yes.