SailPoint Updated IdentityIQ-Associate Exam Questions and Answers by alisha

The statement is true. In SailPoint IdentityIQ, account correlation is the process used to associate an application account, represented as a Link, with the appropriate IdentityCube. Correlation logic is configured on the application and may use account attributes, identity attributes, or correlation rules to determine ownership. When that logic is changed, a subsequent account aggregation can evaluate account data against the updated correlation configuration and adjust account-to-identity associations where the aggregation process is configured to perform correlation.

This is important when accounts were previously uncorrelated, incorrectly correlated, or correlated under outdated matching criteria. For example, if an application originally correlated accounts by user name but is later changed to correlate by employee ID, aggregation can apply the new logic so that accounts align with the correct identities. Manual correlation is therefore not the only remediation path; proper correlation configuration followed by aggregation is a standard way to resolve or correct account ownership.

The behavior depends on the aggregation and correlation configuration, but the principle is accurate: aggregation can apply changed correlation logic to account correlations. Reference topics: Applications, correlation options, account aggregation, uncorrelated account resolution, Link-to-IdentityCube association, and Identity Modeling.

The statement is not accurate as written. In IdentityIQ LifeCycle Manager, allowing users to request a new account on an application does not automatically mean they can request an additional account on that same application. These are related but distinct account request scenarios. A new account request typically applies when an identity does not already have an account on the target application. An additional account request applies when an identity already has an account and the application is configured to support more than one account for the same identity.

Whether additional accounts are available depends on the application’s account model, connector support, application configuration, request configuration, and provisioning policy behavior. Some applications support only one account per identity; in those cases, IdentityIQ may allow creation of the initial account but not allow a second or additional account. Manage Accounts can expose account lifecycle actions such as create, modify, enable, disable, unlock, delete, or request additional accounts, but only when the underlying application and IdentityIQ configuration support those operations.

Reference topics: User-Driven Requests — account request types and operations; Applications — connector and application settings; Provisioning — provisioning policies and account creation behavior.

No. In SailPoint IdentityIQ, tasks are used to execute defined system operations, often as background or scheduled processes. Common task usage includes account aggregation, identity refresh, entitlement aggregation, maintenance activities, report execution, role processing, and other repeatable administrative operations. A task may calculate, update, import, refresh, or process data, but it does not itself perform the governance decision of confirming whether access in a role is correct.

Confirming that the correct access is included in a role is a governance review function, most closely associated with role certification, especially role composition certification. In that process, a role owner or designated certifier reviews the access profiles, entitlements, permissions, or requirements contained in a role and decides whether they are appropriate. The confirmation requires business judgment and reviewer action, not merely task execution.

A task may support role governance indirectly by refreshing role data or generating background processing, but the validation of role contents belongs to certifications and access governance. Therefore, this statement is not accurate for the use of tasks. Reference topics: Foundational Concepts, tasks versus workflows, Governance, role composition certification, Access Modeling, and role governance.

Yes. In SailPoint IdentityIQ, an entitlement represents an access right, permission, privilege, group membership, role membership, or similar access-granting value on an application. Entitlements are discovered from application account data during aggregation and are commonly modeled in IdentityIQ through schema attributes marked as entitlement attributes. Once aggregated, these values may appear in the entitlement catalog as managed attributes, where they can be reviewed, requested, certified, governed by policies, and associated with roles.

The definition “an access right on an application” is accurate because entitlements describe what an identity’s account is allowed to do or access within a connected system. Examples include Active Directory group membership, database roles, application permissions, cloud groups, or other system-specific access values. IdentityIQ uses entitlements as core governance objects for certifications, access requests, policy checks, role modeling, and provisioning.

This definition is intentionally broad because different target systems represent access differently. IdentityIQ normalizes those application-specific access values into entitlement concepts for identity governance.

Reference topics: Access Modeling, entitlement catalog, managed attributes, application schema, entitlement aggregation, certifications, access requests, and provisioning.

‘