IdentityIQ-Associate Exam Questions & Answers

Yes. In SailPoint IdentityIQ aggregation, correlation is attempted first to match an aggregated account to an existing IdentityCube. Correlation may use configured attribute mappings, correlation rules, or other application correlation logic. If IdentityIQ cannot correlate the account to an existing identity, the application's creation rule, when configured, can be invoked to determine how IdentityIQ should handle identity creation for that uncorrelated account.

This is especially relevant for authoritative applications, where aggregated account records may represent people who should exist as identities in IdentityIQ. The creation rule can control identity creation behavior, populate required identity attributes, and apply implementation-specific logic when standard correlation does not find a match. Without appropriate creation behavior, the account may remain uncorrelated and require later remediation through corrected correlation logic, re-aggregation, or manual correlation.

Therefore, the statement is accurate: the creation rule is associated with the aggregation and correlation process and is used when an account cannot be matched to an existing IdentityCube. Reference topics: Applications, BeanShell rules, account aggregation, correlation logic, identity creation rules, authoritative applications, and uncorrelated account handling.

The statement is inaccurate. In SailPoint IdentityIQ, certifications are not modeled as having only two phases called ''active'' and ''inactive.'' A certification has a defined lifecycle that controls how review items are generated, reviewed, challenged, remediated, and closed. ''Active'' may describe a certification that is currently open for reviewer decisions, but ''inactive'' is not a corresponding certification phase that completes the lifecycle model.

A typical IdentityIQ certification process includes review activity where certifiers approve, revoke, delegate, or otherwise act on access items. Depending on configuration, the certification may also include challenge and remediation behavior, allowing affected users or responsible parties to respond to revocation decisions and enabling fulfillment of required access removals. After review and required processing are complete, the certification is signed off or closed.

Therefore, reducing certification behavior to only ''active'' and ''inactive'' misrepresents IdentityIQ's access review model. Certifications are governance workflows with multiple operational states and review phases, not a binary status flag. Reference topics: Governance, access reviews, certification lifecycle, certification phases, challenge period, remediation, revocation processing, and certification sign-off.

No. BeanShell rules are not required to implement aggregation in SailPoint IdentityIQ. Aggregation is a standard IdentityIQ function performed through an application definition, connector configuration, schema definition, correlation settings, and aggregation task execution. Many common connectors can aggregate accounts and groups without any custom rule because the connector and schema configuration provide the required instructions for reading objects from the source system.

Rules are used when additional customization is needed. For example, an aggregation rule may transform incoming attribute values, filter records, normalize data, customize correlation behavior, or handle source-specific logic that cannot be expressed through standard configuration. However, this makes rules optional extension points, not mandatory components of aggregation.

A properly configured application can aggregate accounts using its connector settings, account schema, group schema, and aggregation task options alone. Rules should be introduced only when the standard connector behavior and configuration do not satisfy the implementation requirements.

Reference topics: Applications, aggregation tasks, connector configuration, account schema, group schema, correlation options, application rules, connector rules, and IdentityIQ extensibility through BeanShell rules.

The statement is true in the context of IdentityIQ manager correlation. IdentityIQ does not infer an identity's manager relationship without source data that identifies the manager. The authoritative application, typically an HR or personnel source, provides the trusted identity records and should include a manager reference attribute, such as manager ID, employee number, username, distinguished name, or another value that can be correlated to an existing IdentityIQ identity.

During aggregation and identity refresh, IdentityIQ uses configured manager correlation logic to resolve that manager reference to an IdentityCube representing the manager. Once resolved, the manager relationship can support governance functions such as manager certifications, access request approvals, lifecycle approvals, escalations, and reporting hierarchy-based controls. Without a manager reference from the authoritative source, IdentityIQ may still contain identities, accounts, and access, but it cannot reliably establish reporting relationships for those identities through standard manager correlation.

This is distinct from manually assigning relationships or using custom logic; the standard governance model expects manager data to originate from the authoritative identity source. Reference topics: Identity Modeling --- manager correlation, IdentityCube attributes, authoritative identity data; Governance --- manager-based certifications and approvals; User-Driven Requests --- manager approval routing.

No. Lifecycle Events in SailPoint IdentityIQ are not limited only to data changes aggregated from authoritative applications. They are configured to respond to qualifying changes on an identity, typically evaluated during identity refresh processing. Authoritative application data is a common source of lifecycle-driving attributes, such as employee status, hire date, termination date, department, location, or manager. However, the event mechanism is based on the identity data change and the configured event condition, not exclusively on whether the change originated from an authoritative source.

Identity attributes can be updated through aggregation, correlation, refresh logic, rules, manual administrative changes, or other configured processes. When the relevant identity state changes and the Lifecycle Event condition is met, IdentityIQ can launch the associated business process or workflow. For example, a mover event may be based on department or manager change, while a leaver event may be based on lifecycle state or employment status.

Therefore, ''only'' makes the statement incorrect. Authoritative applications are frequently used for lifecycle events, but they are not the sole possible trigger source. Reference topics: Provisioning, Lifecycle Events, identity refresh, identity attribute changes, business process execution, and event-driven provisioning.