Identity Security Engineer IdentityIQ-Engineer Updated Exam

A Role Membership Certification is appropriate for this requirement because the hospital is trying to confirm that users assigned to a role are correct. The test is not about whether the role contains the right entitlements; that would point to Role Composition Certification. It is also not primarily about application ownership or account group membership. The wording says the business analysts want to verify the role assignment rules by certifying the users who have been assigned the role. That maps directly to a membership review: who is in the role, whether each membership is valid, and whether the assignment rule is producing the expected population. The security team can be configured as the certifier, final reviewer, or sign-off participant depending on certification ownership and sign-off configuration. Therefore, the proposed certification type achieves the stated goal. References/topics: IdentityIQ Engineer — Role Membership Certification, role assignment rules, certification ownership, sign-off, access review routing.

No. The key phrase is “inherited from an assigned Business Role.” IdentityIQ distinguishes between roles that are directly requestable and technical access that an identity receives because another role requires or contains it.

An IT Role can certainly be part of the IdentityIQ role model and can provide technical entitlement access. A Business Role can also be related to lower-level roles through required or permitted role relationships. However, when an IT Role is inherited automatically because an assigned Business Role requires it, that inherited access is not independently presented as a new role for the manager to request—the Business Role assignment is what drives the inherited role relationship.

Permitted roles are different because they can define additional role access that becomes eligible or meaningful in the context of another role. That distinction between automatic inheritance and requestability is important in access-model design.

The Word bank already contains the same manager-request stem with Business Role, which it marks valid, and another with HR Role, which it marks invalid. This inherited-IT-role proposition is separate.

References/topics: IdentityIQ Engineer — Business Roles, IT Roles, required roles, permitted roles, inherited role access, access requests.

=======

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.

The " Name " configuration option is required when setting up a SCIM 2.0 application in SailPoint IdentityIQ. The " Name " field is a mandatory identifier for the application within IdentityIQ. This name is used throughout the system to reference the application and is critical for configuration, management, and integration processes. Without specifying a name, IdentityIQ cannot properly identify and interact with the SCIM 2.0 application.

SailPoint IdentityIQ SCIM 2.0 Application Configuration Guide

SailPoint IdentityIQ Administration Guide (Application Setup and Naming Conventions)