Free SailPoint Certified IdentityIQ Associate IdentityIQ-Associate Exam Questions

Yes. In SailPoint IdentityIQ, the Identity Warehouse presents identity-centered information collected and modeled inside the IdentityCube. Entitlements are part of that identity view because they represent the user's permissions or access rights on connected applications. During aggregation, IdentityIQ reads account data from applications, including entitlement-bearing attributes such as groups, roles, permissions, or other managed access values. These are stored on the identity's application accounts and surfaced in the Identity Warehouse so reviewers, administrators, and governance users can understand what access the identity currently has.

This is distinct from identity attributes such as department, manager, location, or lifecycle state. Entitlements describe access on target systems and are central to access reviews, policy evaluation, role modeling, and access request decisions. Displaying entitlements in the Identity Warehouse allows IdentityIQ to provide a complete access profile for the identity, including accounts, assigned roles, detected roles, policy violations, and application permissions.

Therefore, entitlements are displayed as part of the Identity Warehouse identity details. Reference topics: Identity Modeling, IdentityCube contents, Identity Warehouse, application accounts, entitlement aggregation, managed attributes, and access visibility.

No. IdentityIQ capabilities are used to control what a user can do inside SailPoint IdentityIQ, not to grant elevated permissions on a connected target application. A capability defines access to IdentityIQ functions such as administration, reporting, certification management, policy management, role management, access request functions, or other internal product features. Capabilities are part of IdentityIQ's internal authorization model and determine which menus, pages, actions, and administrative operations a logged-in IdentityIQ user may perform.

Elevated permissions on a connected application must be granted through governed access, such as requesting or provisioning an account, entitlement, role, or permission on that target system. That process is handled through access requests, approval workflows, provisioning plans, connector operations, and application-specific provisioning policies. For example, adding a privileged group in Active Directory or assigning an administrative application role would be modeled as target-system access, not as an IdentityIQ capability.

Therefore, granting an IdentityIQ capability is appropriate when the user needs additional permissions within IdentityIQ itself, not when they need elevated access on an external connected application. Reference topics: Identity Modeling --- how IdentityIQ access is granted to users; User-Driven Requests --- access requests; Provisioning --- target application access fulfillment.

No. An Identity Cube is not an IdentityIQ account. In SailPoint IdentityIQ, the Identity Cube is the central identity record that represents a person or identity being governed by the platform. It consolidates identity attributes, correlated application accounts, account links, entitlements, assigned roles, detected roles, manager relationship, lifecycle state, policy violations, and other governance-relevant information.

An ''IdentityIQ account'' usually refers to a login account or user object that allows someone to access the IdentityIQ application itself. That is different from the Identity Cube, which is used to model the user's enterprise identity and access across connected systems. For example, one Identity Cube may contain links to multiple accounts such as Active Directory, Workday, ServiceNow, database accounts, and cloud application accounts.

Therefore, the proposed definition is inaccurate because it confuses an application login account with the broader identity model used for governance. Reference topics: Identity Modeling, IdentityCube contents, identity attributes, application account links, entitlements, roles, manager correlation, and Identity Warehouse.

Yes. This is a primary use of the entitlement catalog in SailPoint IdentityIQ. Entitlements aggregated from target applications are often technical values, such as group names, permission codes, directory groups, database roles, or application-specific access identifiers. These values may be meaningful to administrators but unclear to business reviewers, requesters, managers, or access approvers. The entitlement catalog enriches those technical access values with governance metadata, including user-friendly display names, descriptions, ownership, classification, requestability, and other attributes used across IdentityIQ.

This enriched entitlement data improves decision quality in access requests, certifications, and reports. During an access request, a requester can search and select understandable access items. During a certification, a reviewer can make better approve-or-revoke decisions because the entitlement is presented with meaningful business context. In reporting, catalog metadata makes access analysis clearer and more usable for audit and compliance teams.

Therefore, providing user-friendly entitlement display names for access requests, reports, and certifications is a correct entitlement catalog function. Reference topics: Access Modeling --- entitlement catalog purpose; Governance --- certifications and review context; User-Driven Requests --- access request display; Applications --- entitlement aggregation from group/account schemas.

No. This statement more accurately describes IdentityIQ connector technology, not Lifecycle Manager. In IdentityIQ, connectors and application definitions are responsible for communicating with external systems such as enterprise applications, cloud platforms, directories, databases, operating systems, and other infrastructure components. They support activities such as account aggregation, entitlement collection, schema handling, and, where supported, provisioning operations back to the target system.

Lifecycle Manager is a functional area of IdentityIQ focused on managing access changes through controlled business processes. It supports access requests, approvals, lifecycle events, self-service actions, provisioning policy evaluation, and fulfillment of approved changes. Lifecycle Manager may use connectors during provisioning, but it is not itself the technology that performs collection of identity access data from external applications.

The distinction is important: aggregation and connectivity belong to applications/connectors, while Lifecycle Manager governs request-driven and event-driven access changes. Therefore, the provided description does not correctly describe Lifecycle Manager. Reference topics: Foundational Concepts, IdentityIQ components, Applications and connectors, User-Driven Requests, Lifecycle Events, and Provisioning.

The statement is false. In SailPoint IdentityIQ, the Application Name is a logical identifier used to label and distinguish the application object inside IdentityIQ. It does not determine which connector the application uses. The connector is selected separately as part of the application configuration, and that connector selection determines the available connection parameters, supported operations, schema behavior, aggregation capabilities, and provisioning capabilities.

For example, an application could be named ''HR System,'' ''Active Directory,'' or ''Corporate Accounts,'' but the name itself does not cause IdentityIQ to use an LDAP, JDBC, Delimited File, Web Services, or other connector. The selected connector type defines how IdentityIQ communicates with the source or target system. It also influences whether the application can aggregate accounts, discover schema, manage groups, perform provisioning, or write changes back to the managed system.

Therefore, the application name is descriptive metadata, while the connector type is the technical integration mechanism. Reference topics: Applications, application definition, connector selection, connector-dependent settings, schema configuration, aggregation, and provisioning support.

The statement is false. IdentityIQ does not apply a universal rule that removes uncorrelated IdentityCubes after 30 days. Uncorrelated accounts or uncorrelated identity records result from aggregation and correlation processing when IdentityIQ cannot confidently associate an account from an application with an existing IdentityCube. These records remain available for administrative review and remediation until they are resolved through correlation logic, manual correlation, re-aggregation, identity refresh activity, or configured cleanup processes.

The key point is that retention and removal behavior is configuration-driven, not controlled by a fixed 30-day product rule. Administrators may use tasks, aggregation settings, pruning behavior, or lifecycle processes to clean up stale identity or account data, but such actions depend on implementation choices and task configuration. IdentityIQ preserves uncorrelated data because it may represent a real account requiring governance, certification, policy evaluation, or investigation.

Therefore, the assertion that uncorrelated IdentityCubes are automatically removed after 30 days is incorrect. Reference topics: Applications, uncorrelated account resolution, correlation configuration, aggregation results, IdentityCube association, identity refresh, and administrative cleanup tasks.

No. Lifecycle Events in SailPoint IdentityIQ are not primarily defined to prevent users from violating policies. Lifecycle Events are configured to detect identity-related changes and trigger a business process or workflow in response. Typical examples include joiner, mover, leaver, rehire, or other lifecycle transitions based on changes to identity attributes such as lifecycle state, employment status, department, manager, location, or start and termination dates.

Preventing policy violations is handled through IdentityIQ's governance and policy framework, especially preventive policy checking during access request processing. Policies define prohibited access conditions, such as separation-of-duty conflicts, and IdentityIQ can warn, block, or route requests when a proposed access change would create a violation.

Lifecycle Events may indirectly support compliance by removing or adjusting access when a user changes status, but their purpose is event-driven lifecycle automation, not policy violation prevention itself. Therefore, this statement is not the correct reason for defining Lifecycle Events.

Reference topics: Provisioning, Lifecycle Events, joiner-mover-leaver processing, workflows, identity attribute changes, Governance, policy detection, and preventive policy checking.

No. In SailPoint IdentityIQ, tasks are execution mechanisms used to perform system operations such as aggregation, identity refresh, certification generation support, report execution, maintenance processing, and other repeatable administrative jobs. A task can collect data, refresh calculated identity information, process objects, or execute configured logic, but it does not itself provide the business review function of confirming whether an account group provides the correct access.

Confirming that an account group provides appropriate access is a governance activity. That type of validation is performed through access reviews or certifications, where a designated reviewer evaluates group membership, permissions, ownership, or entitlement meaning and decides whether the access remains appropriate. This requires human or configured governance judgment, not simply execution of a background task.

A task may support the process indirectly by aggregating current account group data or preparing certification data, but the actual confirmation of correctness belongs to certification and governance review functionality.

Reference topics: Foundational Concepts, tasks versus workflows, Governance, certifications, account group reviews, access reviews, and Access Modeling.

The statement is false. In IdentityIQ, an account attribute is defined within a specific application account schema and represents data stored on an account link for that application. Its value is obtained from the account data aggregated from that particular application connector. For example, an account attribute such as memberOf, department, title, or accountStatus belongs to the account schema of a defined application and is populated from that application's aggregation results.

The concept of sourcing values from several applications applies more directly to identity attributes, not account attributes. Identity attributes reside on the IdentityCube and may be derived from authoritative sources, account links, rules, mappings, or precedence logic across multiple applications. IdentityIQ uses identity attribute configuration to normalize data such as department, location, manager, email, or lifecycle state at the identity level.

Therefore, while multiple applications may contain similarly named account attributes, each account attribute value is tied to its own application account schema and account link. It is not a single shared account attribute sourced from several applications.

Reference topics: Applications --- account schema attributes; Identity Modeling --- identity attributes versus account attributes; Identity Refresh --- updating IdentityCube attributes.