The SailPoint Certified IdentityIQ Engineer (IdentityIQ-Engineer)

No. Out-of-the-box LCM workflow control variables govern the runtime behavior of an LCM process , not the population of users authorized to launch the entry point. Control variables can influence processing such as approvals, notifications, policy checking, provisioning behavior, background/foreground execution, templates, and other workflow decisions.

Determining who can launch an LCM operation belongs at the authorization and QuickLink layer. IdentityIQ commonly controls QuickLink availability through QuickLink populations, capabilities, dynamic scopes, and related visibility or access configuration. Once an authorized user launches the operation, the associated LCM workflow executes using its configured control variables.

This architectural distinction matters. A workflow variable can change what happens after invocation, but it should not be confused with the security mechanism that decides whether a particular identity is permitted to invoke that functionality in the first place.

The question bank itself distinguishes this design layer in related LCM propositions: workflow variables control execution behavior, while application or UI eligibility is configured elsewhere.

References/topics: IdentityIQ Engineer — LCM workflow control variables, QuickLinks, QuickLink populations, capabilities, workflow authorization, dynamic scopes.

=======

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.

Running a build with the updated schema placed inside it is not the correct procedure to generate the database script to extend Application attributes in the IdentityIQ database during the initial installation. To extend the schema, you typically need to define the changes in a specific XML schema file and then generate the corresponding database scripts using IdentityIQ tools designed for schema extension. A build process does not inherently generate the required database scripts for extending attributes.

SailPoint IdentityIQ Schema Configuration Guide

SailPoint IdentityIQ Installation and Setup Guide

Yes. A Boolean datatype is appropriate because the stated purpose is to flag privileged accounts . A flag normally represents a binary condition: the account either satisfies the privileged-account criteria or it does not. Consequently, true and false accurately represent the resulting classification.

The engineer can derive this Boolean from the Financial application ' s privileged attribute and/or calculate the result through logic involving the Keystore application ' s responsibility-code attribute. Once populated, the Boolean value can be referenced reliably from rules and policy conditions and can participate in searchable/analytics configuration when the associated attribute is configured appropriately.

This distinction also resolves the earlier Attribute Type: string proposition. A String could technically hold textual values, but the requirement here is specifically a Boolean privilege flag. Therefore, for this DOMC scenario, Boolean is the configuration that matches the requirement , while String should be answered No.

The bank already tests source mapping and edit mode for the same scenario but does not contain this Boolean proposition.

References/topics: IdentityIQ Engineer — account schema, Boolean attributes, privileged-account classification, source mapping, rules, policies.

=======

Yes, disabling all notifications can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In SailPoint IdentityIQ, most workflows, including those in LCM, use control variables to manage various settings, such as whether notifications should be sent. By setting the appropriate control variable (e.g., disabling email notifications) within the workflow configuration, you can effectively suppress all notifications related to that workflow.

Therefore, the correct answer is A. Yes.

The scenario describes triggering a workflow when a " Division " attribute changes from a specific value to " Senior IT, " but only when the user is a manager. The proposed solution suggests creating a trigger with an event type of " rule " that checks the previous and new values of the " Division " attribute.

However, this approach has a couple of issues:

Trigger Configuration: In SailPoint IdentityIQ, a lifecycle event trigger typically operates on changes in identity attributes, but it’s not standard to define this trigger using a rule that directly inspects the previous and new values. Instead, the lifecycle event would usually be configured in the context of the application or identity to directly listen to specific changes without needing to define the logic in a custom rule.

Condition Validation: The condition of checking if the user is a manager should ideally be integrated within the workflow itself or the lifecycle event configuration, not just as part of a rule in the trigger.

While a rule can be used to define complex conditions, the correct way to implement this in IdentityIQ would involve setting up the lifecycle event trigger specifically for the attribute change and managing any additional conditions (like checking if the user is a manager) within the workflow or using an appropriate script/rule in that context.

Therefore, while partially correct in approach, the described solution is not the best practice or a valid process in IdentityIQ, so the correct answer is B. No.

No. QuickLink population membership is not an exclusive one-population relationship. IdentityIQ can evaluate an identity against multiple QuickLink population definitions, and the same identity can satisfy the membership criteria for multiple populations.

QuickLink populations are used to govern which QuickLinks users can access and, for “For Others” use cases, which target identities they may act upon. Populations can be based on identity attributes, capabilities, workgroups, individual identities, or other configured membership logic. Because those criteria can overlap, there is no general requirement that an identity belong to only one population.

For example, the same employee could satisfy a Managers population, a particular geographic population, and another population associated with access-request functionality. IdentityIQ evaluates the applicable configuration rather than forcing those groups to be mutually exclusive.

The Word bank itself contains examples where QuickLink population configuration controls access to manager-only QuickLinks, reinforcing that populations represent authorization groupings rather than a single-valued classification.

Therefore, “at most one QuickLink population” is false.

References/topics: IdentityIQ Engineer — QuickLink populations, authentication and authorization, population membership, capabilities, workgroups, QuickLink visibility.

=======

In SailPoint IdentityIQ, the configuration in IdentityExtended.hbm.xml file as shown in the image indeed outlines the use of extended identity attributes. These attributes (extended1, extended2, etc.) are custom attributes that are appended to the standard identity object model to store additional identity-related data.

According to the official SailPoint IdentityIQ documentation, when defining identity mappings under Global Settings > Identity Attributes, only up to 12 additional attributes can be made searchable within the IdentityIQ system. This limitation is crucial because it directly impacts the efficiency of search operations in large environments, where making too many attributes searchable can significantly slow down performance.

Once you define these 12 searchable attributes, any additional attributes can still be added, but they will not be indexed for search operations. This means that while the data in these attributes can be used in workflows, reports, and other operations, they cannot be used in search filters in the IdentityIQ user interface.

This limitation is particularly important when planning the design of the identity schema, as it affects both performance and usability. Therefore, the statement in question is correct and accurately reflects the constraints imposed by SailPoint IdentityIQ in terms of searchable identity attributes.

Yes, Identity Provisioning Policies can indeed be used to include allowed-values definitions or validation logic on fields within SailPoint IdentityIQ. This ensures that only valid or authorized values can be specified for certain fields, such as when using the " Create Identity " feature to add a new identity. This functionality helps enforce data integrity and compliance with organizational policies by restricting the inputs to predefined or validated options.

SailPoint IdentityIQ Administration Guide (Sections on Identity Provisioning Policies and Field Validation)

SailPoint IdentityIQ Configuration Guide (Policy Enforcement and Validation)