No. To permit users to unlock accounts through the Manage Accounts interface, the relevant Lifecycle Manager configuration is the Unlock Manage Account Action. Selecting a Rehire action does not configure the account-unlock operation described in the requirement.

IdentityIQ ' s Lifecycle Manager Configuration includes explicit Manage Account Actions for Delete, Disable, Enable, and Unlock . Administrators choose which of these operations users can request for themselves and, where authorization permits, for subordinates. If Unlock is deselected, that type of Manage Accounts request is unavailable.

Rehire is a lifecycle concept associated with restoring access for an identity returning to the organization; it is not the configuration switch that enables an account-unlock request. Unlock specifically addresses a target account that is locked while otherwise remaining an existing account.

This question is easy to mistake for the existing Word-bank question because the proposition is identical. However, the existing item asks about enabling an account, not unlocking one. Under the required DOMC comparison, that change in the stem makes this a distinct question.

Therefore, the proposed Rehire configuration does not meet the unlock requirement.

References/topics: IdentityIQ Engineer — Lifecycle Manager Configuration, Manage Accounts, Unlock Account, Enable Account, account actions, subordinate account management.

The best policy types for defining each access policy are as follows:

Users cannot be members of the AccountsPayable group in AD and have the CreateVendor access right in the Vendor System application at the same time.Answer: Entitlement SOD

This policy deals with conflicting access rights at the entitlement level (i.e., group membership and specific access rights). " Entitlement Separation of Duties " (SOD) ensures that users don ' t have access to conflicting entitlements.

Users can have two accounts on a given system, but no more.Answer: Account

This policy pertains to the number of accounts a user can have on a system. The " Account " policy type manages restrictions on how many accounts users can possess.

Users who have either the VPN role or the Travel role cannot also be in the Contractor role.Answer: Role SOD

This policy involves conflicting roles. " Role Separation of Duties " (Role SOD) ensures that users cannot have conflicting roles, such as VPN and Contractor, or Travel and Contractor.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Entitlement SOD: This policy prevents users from having conflicting access rights. In this case, being in the AccountsPayable group while also having access to create vendors creates a potential conflict. IdentityIQ uses Entitlement SOD to handle these scenarios by preventing such combinations of entitlements.

Account: This type of policy limits the number of accounts users can have on a given system. By setting up an Account policy, IdentityIQ ensures that a user cannot exceed the set number of accounts (e.g., two accounts on a system).

Role SOD: When dealing with conflicting roles (such as VPN or Travel role conflicting with a Contractor role), Role SOD policies ensure that users do not end up in roles that violate governance or security policies. This type of policy ensures role-based access conflicts are mitigated in IdentityIQ.

SailPoint IdentityIQ Compliance Manager Guide (section on defining and managing Separation of Duties (SOD) policies).

This is a valid implementation pattern. The workflow requirement has three routing outcomes, and the proposed solution expresses them as three explicit transition elements. The first transition routes to Stop when the approval flag is false, which corresponds to the Reject or back action. The second transition routes to Audit when the comment variable is not null or empty, using sailpoint.tools.Util.isNotNullOrEmpty(comment). That satisfies the condition that the Approve action was used and the returned form field has a value. The final transition to Provision has no condition, making it the default fallback when the prior transition conditions are not satisfied. This is the correct style for workflow routing because the destination steps are explicitly declared through the to attribute, and the conditional routing is attached to each transition rather than relying on an invalid free-form return block. References/topics: IdentityIQ Engineer — workflow transitions, when conditions, script expressions, form approval routing, default workflow transition behavior.

The correct order for performing an initial installation of SailPoint IdentityIQ is:

Ensure all of the application servers are stopped.

Stopping all application servers is crucial to prevent any conflicts or transactional interference during the installation process.

Un-jar the IdentityIQ WAR file in the desired directory of each application server.

Extract the IdentityIQ WAR file in the appropriate location for the application server. This step deploys the IdentityIQ application code.

Configure iiq.properties file with database credentials and datasource.

The iiq.properties file must be updated with correct database credentials and datasource configurations to establish a connection to the IdentityIQ database.

Create the IdentityIQ database.

A new IdentityIQ database must be created for the system. This is the foundation where all IdentityIQ data will be stored.

Generate database schema to include custom attributes by executing ' iiq schema ' .

Use the iiq schema command to generate the necessary database schema. This includes tables, constraints, and other structural components for IdentityIQ.

Initialize default IdentityIQ system objects from ' iiq console ' using the ' import ' command.

Import default system objects like roles, policies, and configuration settings using the IdentityIQ console’s import feature. This sets up the base configuration.

Start all of the application servers.

Once everything is configured, start the application servers to make the IdentityIQ application available.

Apply the latest patch.

Finally, apply any patches to ensure the system is up to date with the latest security and feature enhancements.

Comprehensive Detailed Explanation with All IdentityIQ Engineer References

Stopping all application servers is necessary to avoid file locks and ensure the WAR deployment and database setup processes can proceed smoothly.

Un-jarring the WAR file deploys IdentityIQ into the server directory structure, making its code accessible for execution.

Configuring the iiq.properties file connects IdentityIQ to the database, establishing where it will read and write data.

Creating the database is fundamental, as the IdentityIQ system relies on a structured data environment.

Generating the database schema via iiq schema builds out the tables and structures necessary for storing identity, access, and policy data.

Initializing system objects sets up core elements of IdentityIQ (like roles, capabilities, and system configurations) required for its operation.

Starting the application servers activates the IdentityIQ environment, allowing the system to begin processing requests.

Applying the latest patch ensures that the installation is up-to-date with all bug fixes, enhancements, and security updates from SailPoint.

SailPoint IdentityIQ Installation Guide (steps on fresh installation and post-installation configurations).

The " Total Memory " value displayed on the JVM Memory page indicates the amount of memory currently allocated to the JVM heap. In the image provided, the " Total Memory " is shown as 725.617 MB. This is the amount of memory that the JVM heap is currently using, meaning it has been allocated and is available for the JVM to use.

SailPoint IdentityIQ Performance Tuning and Monitoring Guide

SailPoint IdentityIQ Administration Guide (JVM and Memory Management Sections)

Yes. The requirement concerns performing an operation against an existing account through the Manage Accounts functionality. The QuickLink population therefore needs to permit users in that population to manage existing accounts. Selecting “Allow managing existing accounts” establishes that population-level eligibility for operations involving accounts that already exist.

This configuration should be distinguished from the specific account operation itself. Lifecycle Manager ' s Manage Accounts configuration controls which account actions—such as enable, disable, unlock, or other supported operations—are available. The QuickLink-population setting determines whether the user is allowed to manage existing accounts through that interface. Both layers must align with the requested functionality.

This question is also genuinely different from the ODT ' s existing question. The bank asks about a user wanting to enable an account and proposes selecting the Rehire action. Here, the video specifically asks about unlocking an existing account and proposes a QuickLink-population setting.

Therefore, for the configuration proposed in this DOMC item, the answer is Yes.

References/topics: IdentityIQ Engineer — Lifecycle Manager, Manage Accounts QuickLink, QuickLink populations, existing-account management, account unlock, Manage Account Actions.

=======

No. Launching certification campaigns is not default Lifecycle Manager functionality. Lifecycle Manager focuses on identity lifecycle and access-request operations such as joiner, mover, leaver processing, access requests, account management, approvals, and provisioning workflows. Certification campaigns belong to IdentityIQ’s access review and compliance/certification capabilities, not LCM’s default functional scope. Certifications are used to review access, roles, entitlements, policy violations, or account/group membership and then require reviewers to approve, revoke, or otherwise act on access. LCM may interact with certification results indirectly because remediation from a certification can trigger provisioning or access changes, but launching the campaign itself is a certification/compliance function. This question tests whether the engineer separates lifecycle-request processing from access-review governance. Mixing them up leads to poor module design and incorrect implementation expectations. References/topics: IdentityIQ Engineer — Lifecycle Manager, access request, provisioning workflows, certification campaigns, Compliance Manager.

The " Delete Entitlement " batch request type is not designed for cleaning up access by correcting or updating entitlements in bulk. Instead, " Delete Entitlement " is used to remove specific entitlements from the system entirely, which may not be what is needed if the goal is to correct incorrect entitlements (e.g., removing excess entitlements while adding missing ones). For the scenario described, where users need their entitlements corrected, other batch processes such as " Update Entitlement, " " Revoke Access, " or specific role re-assignment processes would be more appropriate.

SailPoint IdentityIQ Batch Request Types Documentation

SailPoint IdentityIQ Administration Guide (Entitlement Management Sections)

The statement " The Identity object is passed to the rule " is correct. When writing source mapping rules to populate identity attributes, the Identity object is indeed passed to the rule. This allows the rule to access and modify attributes on the Identity object based on the logic defined within the rule.

Therefore, the correct answer is A. Yes.

Adding a new object attribute to the Application ObjectConfig in IdentityIQ is not sufficient on its own to generate the database script needed to extend Application attributes. This action updates the configuration within IdentityIQ for how the application object is managed, but it does not produce the necessary SQL scripts to modify the underlying database schema. The actual database schema must be extended using specific IdentityIQ tools and commands like iiq extendedSchema.

SailPoint IdentityIQ Configuration Guide (ObjectConfig and Schema Management)

SailPoint IdentityIQ Administration Guide (Database Schema Extension)