Important SailPoint IdentityIQ-Associate Exam Questions

Answer: A

Explanation:

Yes. This is a primary use of the entitlement catalog in SailPoint IdentityIQ. Entitlements aggregated from target applications are often technical values, such as group names, permission codes, directory groups, database roles, or application-specific access identifiers. These values may be meaningful to administrators but unclear to business reviewers, requesters, managers, or access approvers. The entitlement catalog enriches those technical access values with governance metadata, including user-friendly display names, descriptions, ownership, classification, requestability, and other attributes used across IdentityIQ.

This enriched entitlement data improves decision quality in access requests, certifications, and reports. During an access request, a requester can search and select understandable access items. During a certification, a reviewer can make better approve-or-revoke decisions because the entitlement is presented with meaningful business context. In reporting, catalog metadata makes access analysis clearer and more usable for audit and compliance teams.

Therefore, providing user-friendly entitlement display names for access requests, reports, and certifications is a correct entitlement catalog function. Reference topics: Access Modeling --- entitlement catalog purpose; Governance --- certifications and review context; User-Driven Requests --- access request display; Applications --- entitlement aggregation from group/account schemas.

Answer: A

Explanation:

Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed identifies that attribute as governance-relevant access data. This is commonly applied to attributes that contain entitlement-like values, such as groups, roles, permissions, or application access assignments. When the attribute is managed, IdentityIQ can create and maintain managed attribute records for the values discovered during aggregation, allowing those values to be represented in the entitlement catalog with business metadata such as display name, description, owner, requestability, and classification.

This managed designation supports governance processes, including certifications. In an access review, reviewers need to evaluate meaningful access items rather than raw account data. Managed entitlement values can therefore be surfaced as reviewable access so managers, application owners, or entitlement owners can approve, revoke, or otherwise act on them during certification campaigns.

This does not mean the attribute itself is simply editable in IdentityIQ; editability is controlled separately through provisioning policies, forms, workflows, and connector support. The managed flag is primarily about governing the attribute's values as access.

Reference topics: Applications --- schema attribute properties; Access Modeling --- entitlement catalog; Governance --- certification review items.

Answer: B

Explanation:

No. This statement more accurately describes IdentityIQ connector technology, not Lifecycle Manager. In IdentityIQ, connectors and application definitions are responsible for communicating with external systems such as enterprise applications, cloud platforms, directories, databases, operating systems, and other infrastructure components. They support activities such as account aggregation, entitlement collection, schema handling, and, where supported, provisioning operations back to the target system.

Lifecycle Manager is a functional area of IdentityIQ focused on managing access changes through controlled business processes. It supports access requests, approvals, lifecycle events, self-service actions, provisioning policy evaluation, and fulfillment of approved changes. Lifecycle Manager may use connectors during provisioning, but it is not itself the technology that performs collection of identity access data from external applications.

The distinction is important: aggregation and connectivity belong to applications/connectors, while Lifecycle Manager governs request-driven and event-driven access changes. Therefore, the provided description does not correctly describe Lifecycle Manager. Reference topics: Foundational Concepts, IdentityIQ components, Applications and connectors, User-Driven Requests, Lifecycle Events, and Provisioning.

Answer: B

Explanation:

The statement is false. IdentityIQ does not apply a universal rule that removes uncorrelated IdentityCubes after 30 days. Uncorrelated accounts or uncorrelated identity records result from aggregation and correlation processing when IdentityIQ cannot confidently associate an account from an application with an existing IdentityCube. These records remain available for administrative review and remediation until they are resolved through correlation logic, manual correlation, re-aggregation, identity refresh activity, or configured cleanup processes.

The key point is that retention and removal behavior is configuration-driven, not controlled by a fixed 30-day product rule. Administrators may use tasks, aggregation settings, pruning behavior, or lifecycle processes to clean up stale identity or account data, but such actions depend on implementation choices and task configuration. IdentityIQ preserves uncorrelated data because it may represent a real account requiring governance, certification, policy evaluation, or investigation.

Therefore, the assertion that uncorrelated IdentityCubes are automatically removed after 30 days is incorrect. Reference topics: Applications, uncorrelated account resolution, correlation configuration, aggregation results, IdentityCube association, identity refresh, and administrative cleanup tasks.

Answer: A

Explanation:

Yes. Lifecycle Events in SailPoint IdentityIQ are defined to detect significant identity changes and trigger the appropriate business process in response. Organizations commonly use them to automate joiner, mover, and leaver scenarios. A joiner event may be triggered when a new identity is created or becomes active. A mover event may be triggered by changes such as department, job title, manager, location, or business unit. A leaver event may be triggered when an identity's employment status or lifecycle state indicates termination.

The lifecycle event configuration defines the condition to monitor and the business process or workflow to execute when that condition is met. This allows IdentityIQ to automate access provisioning, role assignment, account creation, access removal, account disablement, approvals, notifications, and other lifecycle-driven actions.

Therefore, the statement is accurate. Lifecycle Events are specifically used to define what identity data changes should initiate joiner, mover, or leaver processing.

Reference topics: Provisioning, Lifecycle Events, joiner-mover-leaver processing, identity attribute changes, business processes, workflows, and event-driven provisioning.