The SailPoint Certified IdentityNow Engineer (IdentityNow-Engineer)

Yes, this correctly describes Manager Correlation in SailPoint IdentityNow. Manager Correlation is the process of linking the manager of a given identity based on the value of an attribute in an account or identity profile, such as an employee ' s manager attribute . This allows the system to automatically identify and associate the correct manager for an identity, which can be important for tasks like access approvals and certification reviews.

Key Reference from SailPoint Documentation:

Manager Correlation Process: Manager correlation involves linking an identity to its manager based on specific attributes in the identity or account, such as the managerId or similar fields.

No, microservice architecture does not inherently make identities take up less space in the cloud. Microservices are primarily focused on improving scalability, resilience, and modularity by breaking down an application into smaller, independent services. While this architecture may optimize resource usage and improve performance, it does not specifically reduce the storage space required for identities or data. Data storage concerns are more related to optimization techniques like data deduplication or compression rather than the architecture style itself.

References:

SailPoint IdentityNow Microservices Architecture Guide.

SailPoint IdentityNow Cloud Storage and Data Management Documentation.

No, the OpenLDAP Connector is not suitable for this use case. OpenLDAP is designed for integrating with LDAP-based directories, and the system described is a cloud-based web application that uses a SCIM 2.0 interface with OAuth 2.0 for authentication. Since the system supports SCIM, the correct connector would be the SCIM 2.0 Connector, which is tailored for cloud-based systems with SCIM interfaces.

References:

SailPoint IdentityNow OpenLDAP Connector Guide.

SailPoint IdentityNow SCIM 2.0 Connector Documentation.

SailPoint IdentityNow APIs are not authenticated using client certificates. Instead, they use OAuth 2.0 for secure authentication and authorization. API consumers are required to obtain an access token, which is used to authenticate requests made to the IdentityNow API. The token is typically obtained by sending client credentials (client ID and client secret) to the IdentityNow authorization server, which grants the token for API access.

Key Reference from SailPoint Documentation:

API Authentication: SailPoint IdentityNow uses OAuth 2.0 for API authentication rather than client certificates. Detailed steps on how to implement OAuth-based authentication are available in SailPoint’s API documentation.

Yes, the search syntax @accounts( source.name: " AD " AND state: " disabled " ) is correct, as it matches the necessary criteria for finding disabled AD accounts. This query searches for accounts in the AD source where the account state is set to " disabled, " which effectively filters for the desired result.

Key Reference from SailPoint Documentation:

Correct Syntax for Disabled Accounts: The search correctly identifies accounts with a disabled state using this syntax.

Yes, an access profile allows the definition of an approval process. When an access profile is created, administrators can configure specific approval workflows that must be followed before the access is granted. This includes designating approvers or specifying multiple levels of approval, depending on the organization ' s policies. This capability is useful for ensuring that sensitive access requests are properly reviewed and approved.

References:

SailPoint IdentityNow Access Request and Approval Workflow Guide.

SailPoint IdentityNow Access Profile Configuration Documentation.

Yes, password interception is available for the Active Directory (AD) source in SailPoint IdentityNow. Password interception allows IdentityNow to capture password changes made on the AD source so that it can synchronize the new passwords across other connected systems and applications. This feature ensures password consistency and compliance across the organization’s identity infrastructure.

Key Reference from SailPoint Documentation:

Password Interceptor for AD: SailPoint supports password interception for Active Directory, enabling the platform to capture and synchronize password changes from AD to other systems in real time.

The configuration provided is not valid due to an error in the server specification for Domain B . The server for Domain B (domainb.com) is incorrectly set to server.domaina.com , which is not correct. Each domain in the Active Directory (AD) forest should have its own respective server. For Domain B, the correct server should be something like server.domainb.com , assuming that there are distinct domain controllers for each domain.

Additionally, the search DN for Domain A appears to be valid as it correctly filters for employees with (employeeType=employee). The search DN for Domain B seems to be partially correct, as it targets the OU=Contingent Workers , but the issue lies with the incorrect server assignment.

Key Reference from SailPoint Documentation:

Active Directory Configuration: Each domain in a forest should be connected to its respective server, and incorrect server assignments between domains can cause LDAP search and synchronization issues. Proper domain controller assignment for both domaina.com and domainb.com is required.

Yes, the Active Directory connector can run on the Virtual Appliance (VA). The VA is responsible for hosting connectors that communicate with various target systems, including Active Directory. The connector establishes the communication between IdentityNow and the target Active Directory instance for operations such as provisioning, deprovisioning, and account synchronization. The VA acts as the bridge between IdentityNow ' s cloud service and the on-premises AD environment, enabling secure communication through the connector.

References:

SailPoint IdentityNow Active Directory Connector Configuration Guide.

SailPoint IdentityNow Virtual Appliance Architecture and Setup Documentation.