Last Attempt IdentityIQ-Engineer Questions

No. A ManagedAttribute in IdentityIQ represents a managed value of an application attribute, most commonly an entitlement or account-group value that IdentityIQ can govern, certify, request, or provision. It is not the object used to define the “type” of an account, such as service account or privileged account. Account information aggregated from an application is represented through Link objects associated with an Identity. The Application object defines the connected system, schema, connector configuration, and aggregation/provisioning behavior. A Bundle represents a role. ManagedAttribute objects are typically used when an application schema attribute is marked as managed, such as group membership, permission, role, or entitlement values. Account type classifications may be represented as attributes on a Link or through identity/account metadata, but calling that a ManagedAttribute definition is technically wrong. This question tests whether the engineer understands the IdentityIQ object model and does not confuse entitlements with account records. References/topics: IdentityIQ Engineer — Application object, Identity object, Link object, Bundle/role object, ManagedAttribute entitlement model.

Yes. The requirement explicitly says the value must be listed as an entitlement on Identity Cubes. In IdentityIQ attribute configuration, marking an attribute as an entitlement-type attribute is what allows the value to be treated and displayed in entitlement/access contexts rather than merely as ordinary profile data. The rest of the requirements describe source mappings and usability: Workday is authoritative, Contractor file is fallback, the value should be usable in rules, and it should appear as an Advanced Analytics option. Those needs may require additional configuration such as source mappings, searchable/indexed behavior, and edit-mode considerations. However, the specific proposed option is “Entitlement,” and that maps directly to Usage 4. Without setting the attribute appropriately, the value may exist on the identity but not appear as an entitlement on the Identity Cube. Therefore, this configuration option is needed. References/topics: IdentityIQ Engineer — identity attribute configuration, entitlement flag, Identity Cube display, Advanced Analytics, source mappings.

In SailPoint IdentityIQ, every Link object, which represents an account on an application for an identity, must be associated with an Identity object. The Link object is inherently tied to an identity, as it is a representation of that identity’s account on a target system. Without this association, the Link would not have context within IdentityIQ. This is a fundamental aspect of IdentityIQ ' s data model. Refer to the SailPoint IdentityIQ Data Model documentation for detailed information on the relationships between Link objects and Identity objects.

The best policy types for defining each access policy are as follows:

Users cannot be members of the AccountsPayable group in AD and have the CreateVendor access right in the Vendor System application at the same time.Answer: Entitlement SOD

This policy deals with conflicting access rights at the entitlement level (i.e., group membership and specific access rights). " Entitlement Separation of Duties " (SOD) ensures that users don ' t have access to conflicting entitlements.

Users can have two accounts on a given system, but no more.Answer: Account

This policy pertains to the number of accounts a user can have on a system. The " Account " policy type manages restrictions on how many accounts users can possess.

Users who have either the VPN role or the Travel role cannot also be in the Contractor role.Answer: Role SOD

This policy involves conflicting roles. " Role Separation of Duties " (Role SOD) ensures that users cannot have conflicting roles, such as VPN and Contractor, or Travel and Contractor.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Entitlement SOD: This policy prevents users from having conflicting access rights. In this case, being in the AccountsPayable group while also having access to create vendors creates a potential conflict. IdentityIQ uses Entitlement SOD to handle these scenarios by preventing such combinations of entitlements.

Account: This type of policy limits the number of accounts users can have on a given system. By setting up an Account policy, IdentityIQ ensures that a user cannot exceed the set number of accounts (e.g., two accounts on a system).

Role SOD: When dealing with conflicting roles (such as VPN or Travel role conflicting with a Contractor role), Role SOD policies ensure that users do not end up in roles that violate governance or security policies. This type of policy ensures role-based access conflicts are mitigated in IdentityIQ.

SailPoint IdentityIQ Compliance Manager Guide (section on defining and managing Separation of Duties (SOD) policies).