A customer wants to make changes in their IdentitylQ user interface. Consider branding and other IdentitylQ Ul changes. Is this statement valid?

Solution: The sets of columns displayed in most tables in the IdentitylQ user interface are controlled by entries in the ColumnConfig elements of the UlConfig object.

Is the following statement about workflow step types and their usage true?

Solution: When a wait step is encountered in a foreground workflow, the user will notice this, because the screen will freeze for the specified number of seconds.

Assuming that the policy violation owner has the necessary permissions, is this a valid option for the policy violation owner to use when acting on a policy violation of type ' Account Policy ' ?

Proposed Solution:

Allow

Is this statement true about identitylQ ' s syslog event storage?

Solution: IdentitylQ logging events are stored in a database table in addition to log files.

Is the following statement about IdentitylQ rule inputs and outputs correct?

Solution: The lypical input variables for a rule are listed in the BeanShell rule editor in IdentitylQ, based on the rule registry.

Is the following statement about workflows and sub-workflows (subprocesses) true?

Proposed Solution:

Many standard LCM sub-workflows can be leveraged in custom workflows, with their behavior controlled via input variables.

Can the following action be performed using Rapid Setup application onboarding?

Solution: Specify account correlation by mapping an identity attribute to an account attribute.

Is this statement valid regarding the control and usability of the Debug pages in IdentityIQ?

Proposed Solution:

The Debug Logging page has the location of the current loaded log4j file.

Is the following statement true?

Solution: Every Link object must be associated to an Identity object

Is the following true of Identity Provisioning Policies?

Proposed Solution:

A self-service Registration Identity Provisioning Policy is required to support the self-service registration workflow (LCM Registration).

Can the Environment tab under ‘Administrator Console’ be used to do the following task?

Proposed Solution:

View status of installed SailPoint modules/extensions.

Is this a correct procedure for testing generated emails in a non-production system?

Solution: Change the Email Notification Type to Redirect to file using FTP protocol under Global Settings > Configure IdentitylQ Settings > Mail Settings, run the test scenario, and verify that the email text saved to the redirected file.

Can the search type in Identity be used to accomplish this result?

Proposed Solution:

Identifying details of a system error presented in the UI

An organization is making a change at the regional level.

Many users of a financial system have incorrect entitlements. Some users are missing entitlements, and some users have excess entitlements. Work needs to be performed to clean up access.

Is this one of the IdentityIQ batch request types that can help meet this goal?

Proposed Solution:

Add Entitlement

An engineer needs to first create a custom audit event and then set up an associated report.

What are four steps to accomplish this goal?

Proposed Solution:

Set up a new AuditAction in the AuditConfig object XML:

< AuditAction displayName= " Custom New Audit Event " enabled= " true " name= " actionname " / >

Is this statement true about identitylQ ' s syslog event storage?

Solution: IdentitylQ logging and auditing both require extra function calls within the application and will generate data that can be compressed to avoid any storage and Improve overall performance.

An implementation engineer needs to perform an upgrade of IdentitylQ between releases. Is the following statement true?

Solution: Every version release (excluding patch releases) between the current version of IdentitylQ and the target version of IdentitylQ must be installed in sequential order for an upgrade.

Is this statement valid regarding the control and usability of the Debug pages in IdentitylQ?

Solution: The application server must be restarted after reloading the logging file through the Debug-Logging page.

Is this what should be performed in order to generate the database script to extend Application attributes in the IdentitylQ database on the initial installation?

Solution: Add the new object attribute to the Application ObjectConfig in IdentitylQ.

An engineer needs to first create a custom audit event and then set up an associated report.

What are four steps to accomplish this goal?

Proposed Solution:

Create a Custom Certification Event Schedule and associated ruleRunner task.

Is this a valid step to take when importing SailPoint XML file objects into IdentitylQ?

Solution: Import the XML object through the IdentitylQ console.

An organization is making a change at the regional level.

Many users of a financial system have incorrect entitlements. Some users are missing entitlements, and some users have excess entitlements. Work needs to be performed to clean up access.

Is this one of the IdentityIQ batch request types that can help meet this goal?

Proposed Solution:

Create Entitlement

Is this statement true about the Application, Identity, ManageAttribute, Bundle, and Link objects in IdentitylQ?

Solution: An Application object is not required to aggregate external user account information into IdentitylQ.

IdentityIQ has been installed and set up with the contents of IdentityExtended.hbm.xml as follows:

Is this a correct statement about the installation?

Proposed Solution:

IdentityIQ comes with firstname, lastname, email, display name, and manager as the searchable attributes that are defined out of the box.

An implementation engineer needs to perform an upgrade of IdentityIQ between releases. Is the following statement true?

Proposed Solution:

When a method is deprecated in the upgraded IdentityIQ version, the method references in custom code will be automatically updated.

Is this a purpose of an IdentitylQ certification?

Solution: to attest to a user ' s integrity

Is this statement valid regarding the control and usability of the Debug pages in IdentitylQ?

Solution: The Debug-Logging page does not have to be reloaded when the log4j file is altered while the application server is running.

Is this configuration option required when an engineer sets up any application?

Proposed Solution:

Create Policy

Is this statement true about email templates or behavior within them?

Proposed Solution:

Consider the syntax in the following VTL variable examples: $identityName, ${identityName}, $!identityName. The { syntax allows concatenation with other text and the ! syntax suppresses printing when the variable is null.

Is this statement valid regarding the control and usability of the Debug pages in IdentityIQ?

Proposed Solution:

Changing an object ' s name and saving the object is the correct way to create a new copy of the object.

Is this statement true about certifications?

Proposed Solution:

Only the accounts that a user holds can be certified in an Account Owner certification.

An engineer is assigned to configure an account attribute. The requirements are:

Purpose: Flag privileged accounts

Read from: Financial application, privileged attribute

Calculate from: Keystore application, responsibility-code attribute

Usage 1: Display as option in Advanced Analytics

Usage 2: Use when writing rules

Usage 3: Include in policies

Does the engineer need to set this configuration option on the account attribute to meet the requirements?

Proposed Solution:

Attribute Name

For a user who wants to be able to unlock an account for a subordinate or themselves through Manage Accounts, does this configuration need to be performed in Lifecycle Manager (LCM)?

Proposed Solution:

Select " Allow managing existing accounts " in the Manage Accounts QuickLink configuration for the user ' s QuickLink population.

Is this statement true about certifications?

Proposed Solution:

A challenge period allows a reviewer ' s manager to challenge the decisions made by the reviewer.

Is the following statement about workflows and sub-workflows (subprocesses) true?

Proposed Solution:

It is best practice to leverage standard LCM sub-workflows as much as possible for custom provisioning workflows.

Can the following action be performed using Rapid Setup application onboarding?

Solution: Specify account correlation using a rule.

IdentitylQ is using emails to notify users about completion of steps within a process, or actions that need to be addressed.

To ensure this notification is working, a main configuration must be set up in IdentitylQ to provide mail server and mail server authentication details.

Is this a required setting that an engineer must set up in IdentitylQ in order to ensure successful communication with the SMTP server?

Solution: Email Protocol

Can a Account Group be used for the following scenario?

Proposed Solution:

Representing a specific type of entitlement associated to an account on a target system.

Is the following statement about IdentityIQ rule inputs and outputs correct?

Proposed Solution:

The default description of a Rule, which originates from the Rule Registry, usually provides information about the Rule ' s purpose and its expected output.

Is this configuration option required when an engineer sets up an Active Directory application?

Proposed Solution:

Name

Is this a true statement about localization support in IdentitylQ?

Solution: Message files may be added to support additional languages, but the out-of-the-box supplied message files cannot be modified.

Assuming that the policy violation owner has the necessary permissions, is this a valid option for the policy violation owner to use when acting on a policy violation of type ' Role SOD Policy?

Solution: Schedule Policy Composition Certification

Is this a piece of information that an engineer needs when initially setting up a new IdentityIQ sandbox environment?

Proposed Solution:

the IdentityIQ version

An engineer is developing an instance of IdentitylQ using the Services Standard Build (SSB) for a client. Is this a valid action the engineer can perform when setting up or using the SSB?

Solution: Place the patch jar file in the build ' s base/patch folder that matches the patch version the client is using

Can the following be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows?

Proposed Solution:

Treat the provisioning process as a successful event when it is in a queued status.

An engineer is assigned to configure an account attribute. The requirements are:

Purpose: Flag privileged accounts

Read from: Financial application, privileged attribute

Calculate from: Keystore application, responsibility-code attribute

Usage 1: Display as option in Advanced Analytics

Usage 2: Use when writing rules

Usage 3: Include in policies

Does the engineer need to set this configuration option on the account attribute to meet the requirements?

Proposed Solution:

Attribute Type: string

IdentityIQ has been installed and set up with the contents of IdentityExtended.hbm.xml as follows:

Is this a correct statement about the installation?

Proposed Solution:

Only two identity attributes have been defined in this scenario: employeeId and status. This installation will not have necessary attributes, such as firstname and lastname.

An implementation engineer needs to perform an upgrade of IdentityIQ between releases. Is the following statement true?

Proposed Solution:

IQService is automatically upgraded when upgrading IdentityIQ.

Is this statement true about IdentityIQ ' s syslog event searching capabilities?

Proposed Solution:

When searching the syslog events from the Advanced Analytics page, it is not possible to search syslog events by attributes other than an Incident Code.

An engineer needs to trigger a workflow when a Division attribute changes from IT to Senior IT, but only when the user is a manager.

Is this a valid process that the engineer could use to launch a workflow for a lifecycle event?

Proposed Solution:

Create a trigger with an event type of create.

Is the following statement true?

Proposed Solution:

A Bundle profile must be associated to an Identity object.

An engineer is developing an instance of IdentitylQ using the Services Standard Build (SSB) for a client. Is this a valid action the engineer can perform when setting up or using the SSB?

Solution: Place the client ' s identityiq. War file in the home directory of the build.

IdentityIQ has been installed and set up with the contents of IdentityExtended.hbm.xml.

Is this a correct statement about the installation?

Proposed Solution:

An unlimited number of additional searchable placeholder extended attributes can be added to this installation beyond the 10 shown.

Is the following statement true?

Proposed Solution:

All ManagedAttribute objects must be associated to an Application object.

The engineer uses the sailpoint.api.IdentityService in a BeanShell method to look up and return all account names for an identity on the application ' MagicBox ' . Is this a correct implementation?

Proposed Solution:

import sailpoint.api.IdentityService;

import sailpoint.api.SailPointContext;

import sailpoint.object.Application;

import sailpoint.object.Identity;

import sailpoint.object.Link;

import sailpoint.tools.GeneralException;

public List getAccountNames(SailPointContext context, Identity identity) throws GeneralException {

Application application = context.getObjectByName(Application.class, " MagicBox " );

IdentityService service = new IdentityService(context);

List < String > accountNames = new ArrayList < String > ();

List < Link > links = service.getLinks(identity, application);

if (links != null) {

for (Link link : links) {

accountNames.add(link.getNativeIdentity());

}

}

return accountNames;

}

An engineer is assigned to configure an account attribute. The requirements are:

Purpose: Flag privileged accounts

Read from: Financial application, privileged attribute

Calculate from: Keystore application, responsibility-code attribute

Usage 1: Display as option in Advanced Analytics

Usage 2: Use when writing rules

Usage 3: Include in policies

Does the engineer need to set this configuration option on the account attribute to meet the requirements?

Solution: Source Mappings: Application Rule

Can the search type in Syslog be used to accomplish this result?

Solution: Identifying details of a system error presented in the Ul

Can the following action be performed using Rapid Setup application onboarding?

Solution: Specify the account attribute and value filter that identifies a secondary account.

For a user who already has an account on an application and wants to be able to request access to a new account through Manage User Access, does this configuration need to be performed in Lifecycle Manager (LCM)?

Proposed Solution:

Select “Allow requesting new accounts” in the Manage Accounts QuickLink configuration for the user’s QuickLink population.

Is this a default functionality of the Lifecycle Manager (LCM) module?

Solution: Define Application

Is this what should be performed in order to generate the database script to extend Application attributes in the IdentitylQ database on the initial installation?

Solution: Run the command iiq extendedSchema in the IIQ_Home/WEB-INF/bin directory.

An implementation engineer needs to perform an initial installation of identitylQ.

Drag the options from the left into the answer area on the right, and place them in the correct order.

The business analysts for a large hospital need to confirm that their role assignment rules are working correctly. They are performing a final test on the production system by certifying the users who have been assigned the role. The access reviews should be sent to the security team for final sign-off.

Will this certification type achieve the goal?

Proposed Solution:

Role Membership Certification

A bank is two years into an ongoing project to provide all access through roles. The bank is actively using roles and actively adding to their role model. They need to ensure that all roles include the correct entitlements.

Will this certification type achieve the goal?

Solution: Application Owner Certification

The engineer needs to write some ad-hoc BeanShell code to search for GroupDefmition objects owned by Randy.Knight and print their names. Is this BeanShell code correct as written?

Solution:

Is this a correct procedure for testing generated emails in a non-production system?

Proposed Solution:

Change the Email Notification Type to IMAP under Global Settings > Configure IdentityIQ Settings > Mail Settings, run the test scenario, and verify if the emails were successfully delivered to mailboxes specified on Identity objects.

Is this statement true about identitylQ ' s syslog event storage?

Solution: Both logging and auditing can have a negative influence on performance. Logging and auditing both require extra function calls within The application and will generate data that will need to be stored.

An engineer needs to first create a custom audit event and then set up an associated report. What are four steps to accomplish this goal?

Solution: Create a Data Export task.

Can the Provisioning tab under " Administrator Console " be used to do the following task?

Proposed Solution:

View all failed, pending, successful provisioning transactions.

Is this what should be performed in order to generate the database script to extend Application attributes in the IdentitylQ database on the initial installation?

Solution: Run a build with the updated schema placed inside it.

Can a Workgroup be used for the following scenario?

Solution: Automatically creating multiple groups based on the values of a single identity attribute.

A client needs a custom quicklink, which only managers can launch, in order to launch a simple workflow. Is this a valid step to take during the development of this custom quicklink?

Solution: Insert the " Managers " quicklink population as the dynamic scope in the quicklink object.

A customer wants to make changes in their IdentityIQ user interface.

Consider branding and other IdentityIQ UI changes. Is this statement valid?

Proposed Solution:

The original HTML file is updated to change the settings.

Is this statement true about certifications?

Proposed Solution:

A certification cannot be signed off until after the challenge period ends.

Can an Escalation Rule be used to handle this scenario?

Solution: Automatically reassign parts of an access review to a different certifier.

A manager wants to extend the access granted to an employee.

Is this a default role type that is available for the manager to request in IdentitylQ during the access request process?

Solution: Business Role

Is this statement true about the IdentitylQ Audit functionality and/or options?

Solution: The built-in auditing options are immutable; they are always recorded. However, custom audits can be turned on or off.

An engineer needs to first create a custom audit event and then set up an associated report.

What are four steps to accomplish this goal?

Proposed Solution:

From the Intelligence > Reports page, configure and schedule the newly-created report.

Can this be achieved using Rapid Setup user interface configuration options?

Solution: Disable an account and remove all its entitlements on a particular application during Leaver events.

Can the Provisioning tab under " Administrator Console " be used to do the following task?

Proposed Solution:

View the connection status of the application the provisioning status is associated to.