Yes. Rapid Setup application onboarding can be used for common onboarding configuration, including account classification logic such as identifying service accounts based on an account attribute and value. Service accounts often need to be distinguished from normal human accounts because they may have different ownership, certification, correlation, requestability, password, and governance treatment. A typical configuration uses an account schema attribute and a value or pattern to flag accounts that should be treated as service accounts. This fits Rapid Setup’s purpose: allowing engineers to configure standard onboarding behavior without writing custom connector logic for every common case. The capability is still limited compared with full custom rules or advanced application configuration. If the service-account identification logic requires complex multi-attribute conditions, external lookups, or custom transformations, a rule or deeper application configuration may be needed. But the proposed action itself is a valid Rapid Setup onboarding configuration. References/topics: IdentityIQ Engineer — Rapid Setup, application onboarding, account classification, service accounts, account attribute filters.

Yes. Hierarchy is a valid relationship concept for IdentityIQ roles when a role model has a multiple-level structure. IdentityIQ roles are not limited to flat entitlement collections. Role models can be built with layered relationships, where higher-level roles represent broader business access and lower-level roles represent more technical or application-specific access. This is common in mature role-based access control designs: a business role may include IT roles, which in turn may include entitlements or application roles. A hierarchical structure allows organizations to express access in business terms while still mapping that access down to technical resources. The important engineering point is that the role model must be carefully designed to avoid circular dependencies, overbroad inheritance, and difficult certification outcomes. Hierarchical role relationships support maintainable access modeling when used properly, especially in enterprises that are actively using role-based provisioning and role reviews. References/topics: IdentityIQ Engineer — role hierarchy, role relationships, Bundle object, business roles, IT roles, role-based access model.

No. A ManagedAttribute in IdentityIQ represents a managed value of an application attribute, most commonly an entitlement or account-group value that IdentityIQ can govern, certify, request, or provision. It is not the object used to define the “type” of an account, such as service account or privileged account. Account information aggregated from an application is represented through Link objects associated with an Identity. The Application object defines the connected system, schema, connector configuration, and aggregation/provisioning behavior. A Bundle represents a role. ManagedAttribute objects are typically used when an application schema attribute is marked as managed, such as group membership, permission, role, or entitlement values. Account type classifications may be represented as attributes on a Link or through identity/account metadata, but calling that a ManagedAttribute definition is technically wrong. This question tests whether the engineer understands the IdentityIQ object model and does not confuse entitlements with account records. References/topics: IdentityIQ Engineer — Application object, Identity object, Link object, Bundle/role object, ManagedAttribute entitlement model.

The statement is false. The " Run Rule " feature on the Debug-Object page is not intended for creating, modifying, or deleting SailPoint database objects. Instead, it is used to execute specific rules for testing and debugging purposes. While it allows you to test the logic of a rule by running it in isolation, it does not directly manipulate database objects. For creating, modifying, or deleting database objects, administrators would typically use the appropriate IdentityIQ APIs or database scripts.

SailPoint IdentityIQ Administration Guide (Debugging and Rule Management Sections)

SailPoint IdentityIQ Developer Guide (Working with Rules and Debugging Tools)

In SailPoint IdentityIQ, the concept of a " role " is fundamental to the identity governance framework. The platform supports several default role types that are pre-configured to help organizations manage access effectively. The default role types include:

Business Role: Represents a collection of entitlements necessary for a specific job function within the organization.

IT Role: Aggregates technical entitlements that are typically assigned together, often linked to specific applications or systems.

Application Role: Tied to a specific application, representing roles within that application ' s context.

Composite Role: A combination of other roles, either business or IT, to form a higher-level role.

The term " Entitlement Role " is not recognized as a default role type in SailPoint IdentityIQ. While entitlements can be components of roles, " Entitlement Role " itself is not a predefined role type in the platform. Therefore, the correct answer is B. No.

This is not a valid process for the stated requirement. The business event that must launch the workflow is a change to the Division attribute from IT to Senior IT, not a change to managerStatus. The proposed trigger listens for managerStatus changing from true to false, which is both the wrong attribute and the wrong managerial condition. The requirement says the user must be a manager at the time the Division change occurs; it does not say the user stops being a manager. Adding an included identities rule for Division logic does not fix the trigger because the lifecycle event would only fire when the managerStatus attribute changes. A correct design would trigger on the Division attribute change and then apply an additional condition or rule to ensure managerStatus is true for the identity. This proposed setup would miss the intended event and could fire for the wrong population. References/topics: IdentityIQ Engineer — lifecycle event triggers, attribute-change events, included identities rules, identity refresh, workflow launch conditions.

This is not a valid step for creating a custom audit event and associated report. A Custom Certification Event Schedule relates to certification scheduling or certification-event processing, not to defining a new audit action in the audit framework. A ruleRunner task can execute a rule, but simply creating a certification event schedule and ruleRunner task does not establish a custom audit event type, does not register the event in AuditConfig, and does not create a report capable of querying that audit data. For a custom audit event, the engineer must define the audit action/event, ensure the code path writes the audit event with the appropriate attributes, and then create or configure a report that can retrieve and display those audit records. The proposed solution is pointed at the wrong subsystem. It confuses certification scheduling automation with audit event definition and reporting. References/topics: IdentityIQ Engineer — AuditConfig, AuditAction, custom audit events, audit reporting, ruleRunner task limitations.

Certifying user expense reports is not a purpose of IdentityIQ certification. IdentityIQ certifications are focused on access and identity governance, specifically reviewing and validating user access rights within systems. Expense report certification would be a different process, typically managed by financial or expense management systems, not by IdentityIQ.

SailPoint IdentityIQ Certification Guide

SailPoint IdentityIQ Governance Overview

Creating a custom audit event and setting up an associated report involves steps such as defining the audit event, modifying the audit configuration, and creating a custom report using the SailPoint IdentityIQ reporting framework. Simply creating a Data Export task does not fulfill these requirements. A Data Export task is used for exporting data from IdentityIQ and is unrelated to the creation of custom audit events or custom reports. Refer to the SailPoint IdentityIQ Reporting Guide and the IdentityIQ Audit Framework documentation for more information on correctly creating and configuring custom audit events and reports.

The proposed solution suggests changing the Email Notification Type to " Redirect to file using FTP protocol " under Global Settings > Configure IdentityIQ Settings > Mail Settings. However, IdentityIQ does not provide an option to redirect emails to a file using the FTP protocol directly through the Global Settings in the application.

Typically, to test generated emails in a non-production environment, you would change the Email Notification Type to " Redirect to File " (if the option is available) or configure an SMTP server with a different setup that captures emails in a file or a specific mailbox designed for testing purposes. The specific steps for testing email generation may vary, but the solution as stated does not align with standard IdentityIQ practices.

Thus, the correct answer is B. No.