SailPoint Updated IdentityIQ-Engineer Exam Questions and Answers by richard

The statement is incorrect. Email templates in SailPoint IdentityIQ are not restricted to just Identity object attributes or methods. They can access attributes and methods of any object passed to the template through its input arguments, including WorkItems, CertificationItems, and others. The template system allows the use of various objects’ properties as long as they are properly referenced within the script or template context.

Yes. IdentityIQ provides several core identity properties that are directly available as standard search criteria without requiring them to be implemented as customer-defined extended searchable attributes. These include First Name, Last Name, Display Name, Email, and Manager . Identity Search exposes these properties separately from the configurable section called Searchable Attributes , which contains additional identity attributes created and designated as searchable during deployment.

This distinction is important when interpreting IdentityExtended.hbm.xml. The extended Hibernate mapping is primarily concerned with additional database-backed attributes that a customer wants to search efficiently. It does not mean that every searchable identity property must consume one of the numbered extended1, extended2, and similar columns.

Current IdentityIQ documentation lists Last Name, First Name, Display Name, Email, and Manager directly among Identity Search criteria, with separately configured searchable attributes presented in their own category. Therefore, the proposed solution correctly identifies standard searchable identity information supplied by IdentityIQ.

References/topics: IdentityIQ Engineer — Identity Search, Identity Mapping, standard identity attributes, searchable extended attributes, IdentityExtended.hbm.xml.

=======

No. An individual SPRight is a granular IdentityIQ product right, but roles do not normally grant an arbitrary standalone SPRight directly as a role entitlement. IdentityIQ groups SPRights into Capabilities , which provide logical collections of rights associated with administrative or functional job responsibilities.

The Role Editor provides a Granted IdentityIQ User Rights section where an engineer can associate IdentityIQ capabilities and scopes with a role. When that role is assigned and role provisioning is processed through Identity Refresh, the corresponding capabilities and scopes can be granted to the identity. This is the supported role-level abstraction.

The distinction matters because an SPRight controls granular access to specific IdentityIQ UI functions, tools, pages, or operations, while a Capability groups one or more SPRights into a maintainable authorization construct. Directly treating a single SPRight as an ordinary role option bypasses the intended rights-to-capability model.

Therefore, although a role can grant IdentityIQ user rights indirectly through configured capabilities, the proposed statement that the role is configured to include a single SPRight object is not the valid role configuration model.

References/topics: IdentityIQ Engineer — SPRight, Capability, Granted IdentityIQ User Rights, Role Editor, authorization model.

=======

An Account Group Membership Certification is designed to certify group memberships within accounts, typically focusing on the validation of access within specific account groups (e.g., Active Directory groups).

This type of certification does not directly address the accuracy of role composition or the correctness of entitlements assigned within roles. Since the bank ' s goal is to ensure that all roles include the correct entitlements, an Account Group Membership Certification is not suitable for this purpose.

Thus, the correct answer is B. No.