The statement that workflows can be run directly from the Debug-Object page is incorrect. The Debug-Object page in SailPoint IdentityIQ is primarily used for inspecting and interacting with objects within the system, such as viewing their attributes, relationships, and states. However, running workflows is typically done through the IdentityIQ interface under the appropriate sections for workflow management or through the IdentityIQ Console, not directly from the Debug-Object page.

Therefore, the correct answer is B. No.

No. The key technical problem is the term Create Rule . IdentityIQ does not use an application “Create Rule” as the standard mechanism for defining how new target-system accounts are provisioned. New-account provisioning is principally defined through an application ' s Create Account Provisioning Policy . That policy identifies the fields required for account creation and determines how their values are obtained. Field values can themselves come from literals, scripts, rules, dependencies, or requester-entered information.

IdentityIQ does have a Creation Rule , but that is an aggregation rule with a different purpose. SailPoint documents the Creation Rule as executing when a new Identity is created during aggregation, commonly from an authoritative application. It can manipulate the identity being created—for example, its name or attributes—but it is not the mechanism that specifies how a new account is provisioned to a target application.

Provisioning rules such as BeforeProvisioning and AfterProvisioning can customize a ProvisioningPlan around connector execution, but that still does not make “Create Rule” the account-creation definition. Therefore, as worded, the proposed solution is false.

References/topics: IdentityIQ Engineer — Application Provisioning Policies, Create Account policy, Creation Rule, BeforeProvisioning Rule, Application Definition.

=======

Yes, the statement is true. When editing a step in the Business Process Editor in SailPoint IdentityIQ, the available step actions are Script, Rule, Subprocess, and Call Method. These actions allow for various types of logic and processing to be embedded within workflows. Each of these actions serves different purposes:

Script: Executes a Beanshell script.

Rule: Calls an existing IdentityIQ rule.

Subprocess: Invokes another workflow as a subprocess.

Call Method: Invokes a method on a specified object.

SailPoint IdentityIQ Business Process Editor Guide

SailPoint IdentityIQ Administration Guide (Section on Workflow Management)

Yes. Out-of-the-box LCM workflows commonly support configurable notification behavior, and email templates can be selected or referenced through workflow variables, arguments, or workflow configuration. IdentityIQ workflows use email templates to generate notification content for approvals, requests, provisioning outcomes, policy violations, reminders, and other lifecycle events. The ability to control which template is used allows implementers to customize communications without rewriting the whole workflow. This is a valid use of workflow configuration because the workflow is responsible for sending or triggering notifications during lifecycle processing. The engineer still needs to ensure the referenced EmailTemplate object exists, contains the correct variables for the workflow context, and is suitable for the intended recipient. But conceptually, specifying the email template for notifications is exactly the type of behavior that can be controlled through LCM workflow configuration rather than through application schema or identity-attribute configuration. References/topics: IdentityIQ Engineer — LCM workflow variables, EmailTemplate objects, notification configuration, approval emails, workflow-controlled messaging.

Yes. This is the classic joiner lifecycle event. The person has not previously been with the company, has now been hired, and needs new access and new accounts. In IdentityIQ Lifecycle Manager terms, a joiner process usually starts from an authoritative-source change such as a new HR record. The process may create or activate the Identity Cube, assign birthright roles, request or automatically provision accounts, calculate policies, trigger approvals, and send notifications. Unlike rehire or reinstatement scenarios, there are no existing disabled accounts to restore. The access model should be built from onboarding rules, role assignment logic, provisioning policies, application create policies, and approval workflows. This is exactly why joiner workflows exist: to standardize new-person onboarding and ensure access is created consistently, securely, and audibly. References/topics: IdentityIQ Engineer — joiner lifecycle event, LCM onboarding, birthright access, account creation, provisioning policy, role assignment.

Changing the Email Notification Type to POP3 under Global Settings > Configure IdentityIQ Settings > Mail Settings is not a correct procedure for testing generated emails in a non-production system. POP3 is an email retrieval protocol, not a method for sending or redirecting email notifications from IdentityIQ. IdentityIQ requires an SMTP server to send emails, and POP3 is typically used by email clients to retrieve emails from a server, not by a server to send emails.

For testing purposes in a non-production environment, you would typically configure the SMTP server settings to either redirect emails to a specific testing mailbox or use a " Redirect to File " option, if available, to capture emails locally.

Thus, the correct answer is B. No.

Rapid Setup does allow for specifying account correlation by mapping an identity attribute to an account attribute. This is a standard part of the onboarding process where you define how IdentityIQ should correlate accounts to identities. This basic mapping functionality is included in Rapid Setup to facilitate straightforward account correlation during application onboarding.

SailPoint IdentityIQ Rapid Setup Guide

SailPoint IdentityIQ Administration Guide (Account Correlation and Mapping Sections)

Yes. IdentityIQ provides several core identity properties that are directly available as standard search criteria without requiring them to be implemented as customer-defined extended searchable attributes. These include First Name, Last Name, Display Name, Email, and Manager . Identity Search exposes these properties separately from the configurable section called Searchable Attributes , which contains additional identity attributes created and designated as searchable during deployment.

This distinction is important when interpreting IdentityExtended.hbm.xml. The extended Hibernate mapping is primarily concerned with additional database-backed attributes that a customer wants to search efficiently. It does not mean that every searchable identity property must consume one of the numbered extended1, extended2, and similar columns.

Current IdentityIQ documentation lists Last Name, First Name, Display Name, Email, and Manager directly among Identity Search criteria, with separately configured searchable attributes presented in their own category. Therefore, the proposed solution correctly identifies standard searchable identity information supplied by IdentityIQ.

References/topics: IdentityIQ Engineer — Identity Search, Identity Mapping, standard identity attributes, searchable extended attributes, IdentityExtended.hbm.xml.

=======

Export CSV / Import CSV is not a valid action for a policy violation owner when acting on an individual Account Policy violation. In IdentityIQ, a policy violation owner is expected to resolve or manage the violation through violation-handling actions such as allowing, mitigating, remediating, forwarding, or otherwise taking governance action depending on configured permissions and workflow. Exporting or importing CSV files is an administrative or bulk-data activity, not a violation-disposition action. An Account Policy violation normally relates to a condition such as a user having more accounts than permitted on an application or system. The Word bank describes Account policies as policies that limit the number of accounts users may have on a given system. Acting on that violation requires a compliance decision or remediation path, not a CSV operation. Therefore, this proposed solution is not a valid policy-violation owner action. References/topics: IdentityIQ Engineer — Compliance Manager, policy violations, Account Policy, violation remediation, policy owner actions.

Yes. The Run Rule capability in the IdentityIQ debug/admin tooling is useful for executing BeanShell rule logic and viewing the result, especially during development or troubleshooting. When an engineer writes a simple rule that returns a value, the Run Rule feature can be used to validate the logic and observe the returned output. This is useful for quick testing of rules that evaluate identity attributes, build strings, test object lookups, or verify small pieces of BeanShell logic before embedding the rule into a workflow, lifecycle event, policy, certification configuration, or application configuration. However, this feature must be used carefully because rule execution can interact with real IdentityIQ objects depending on the code. The benefit described in the proposed solution is narrow and valid: displaying the return value of simple code is a legitimate use case. It is not the same as saying the feature should be used for unrestricted database manipulation. References/topics: IdentityIQ Engineer — Debug pages, Run Rule, BeanShell rules, rule testing, troubleshooting.