PDFを無料でダウンロードにはIdentityIQ-Associate有効な練習テスト問題があります
IdentityIQ-Associateテストエンジンお試しセット、IdentityIQ-Associate問題集PDF
SailPoint IdentityIQ-Associate 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
質問 # 23
Is this statement true for the use of tasks?
They are used to automate the processes to build, update, and maintain the information contained within IdentityIQ.
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ, tasks are used to automate repeatable system processes that build, update, and maintain IdentityIQ data. Tasks are executable operations that can be run manually or scheduled to run at defined intervals. They are commonly used for core operational activities such as account aggregation, group aggregation, identity refresh, role processing, certification generation support, report execution, data maintenance, and other background processing.
This statement accurately describes the purpose of tasks because much of IdentityIQ's governance model depends on current and processed data. For example, aggregation tasks bring account and entitlement data from applications into IdentityIQ. Identity Refresh tasks update IdentityCubes, calculate role assignments, process lifecycle events, evaluate policies, and refresh identity attributes. Maintenance tasks help keep stored information consistent and usable.
Tasks differ from workflows because tasks are primarily system-executed jobs, while workflows coordinate business processes, approvals, provisioning logic, and human interaction. Therefore, tasks are correctly described as mechanisms that automate the operational processes used to build, update, and maintain information inside IdentityIQ.
Reference topics: Foundational Concepts, tasks versus workflows, aggregation tasks, identity refresh, IdentityCube maintenance, application data processing, and system automation.
質問 # 24
Is this statement about uncorrelated accounts true?
If an application's correlation logic has changed, the aggregation task can change account correlations to match the new logic.
- A. No
- B. Yes
正解：B
解説：
The statement is true. In SailPoint IdentityIQ, account correlation is the process used to associate an application account, represented as a Link, with the appropriate IdentityCube. Correlation logic is configured on the application and may use account attributes, identity attributes, or correlation rules to determine ownership. When that logic is changed, a subsequent account aggregation can evaluate account data against the updated correlation configuration and adjust account-to-identity associations where the aggregation process is configured to perform correlation.
This is important when accounts were previously uncorrelated, incorrectly correlated, or correlated under outdated matching criteria. For example, if an application originally correlated accounts by user name but is later changed to correlate by employee ID, aggregation can apply the new logic so that accounts align with the correct identities. Manual correlation is therefore not the only remediation path; proper correlation configuration followed by aggregation is a standard way to resolve or correct account ownership.
The behavior depends on the aggregation and correlation configuration, but the principle is accurate: aggregation can apply changed correlation logic to account correlations. Reference topics: Applications, correlation options, account aggregation, uncorrelated account resolution, Link-to-IdentityCube association, and Identity Modeling.
質問 # 25
Does this statement accurately describe how roles are acquired by users in the default role model configuration?
Business roles can only be requested by managers.
- A. No
- B. Yes
正解：A
解説：
No. This statement does not accurately describe role acquisition in IdentityIQ. Business roles are not restricted to being requested only by managers. In IdentityIQ, roles may be acquired through role assignment logic, role detection, access requests, or administrative action, depending on the role configuration and the organization's request model.
A business role commonly represents access associated with a business function, job, department, location, or organizational responsibility. Users may receive business roles automatically when their identity attributes satisfy configured role profiles or assignment rules, typically recalculated during Identity Refresh. Separately, roles may be made requestable through Lifecycle Manager and exposed through QuickLinks, where request eligibility is controlled by QuickLink Populations, request configuration, and workflow rules.
Managers may be allowed to request roles for direct reports, but that is only one possible configuration. IdentityIQ can also allow users to request roles for themselves, allow delegated requesters to request for others, or restrict requests to specific populations.
Therefore, "only requested by managers" is too narrow and incorrect. Reference topics: Access Modeling, business roles, role assignment, role detection, Identity Refresh, User-Driven Requests, QuickLink Populations, and role request configuration.
質問 # 26
Is this a function of QuickLink Populations?
They control which identities can approve access requests.
- A. No
- B. Yes
正解：A
解説：
No. QuickLink Populations do not determine which identities can approve access requests. In SailPoint IdentityIQ, QuickLink Populations control the availability and scope of QuickLinks for users. They define who can initiate a specific request action, what type of request can be launched, and in many cases who the request can be submitted for. For example, they may allow an employee to request access for themselves or allow a manager to request access for direct reports.
Approval authority is handled separately through request workflows, approval schemes, approval rules, work item assignment logic, application or role owners, managers, governance groups, or configured business processes. When an access request is submitted, IdentityIQ evaluates the configured approval path to determine which identities receive approval work items. That approval routing is not controlled by the QuickLink Population itself.
Therefore, the statement is inaccurate. QuickLink Populations govern request initiation and visibility, while approval routing is governed by workflow and approval configuration. Reference topics: User-Driven Requests, QuickLink Populations, access request process, approval workflows, work items, and request authorization.
質問 # 27
Is this statement true about Rapid Setup?
It will create the application definitions.
- A. No
- B. Yes
正解：B
解説：
Yes. Rapid Setup in SailPoint IdentityIQ is designed to accelerate application onboarding by creating and configuring the application definitions required for IdentityIQ to manage data from connected systems. An application definition is the IdentityIQ object that represents an external source or target system and stores the connector selection, connectivity settings, schema information, aggregation behavior, correlation configuration, and related governance options.
Rapid Setup reduces the amount of manual configuration normally required when defining applications. Instead of building every application definition entirely through the standard detailed configuration screens, Rapid Setup guides the administrator through a simplified setup path and creates the required IdentityIQ application objects from that configuration. Those application definitions can then be used for aggregation, correlation, entitlement discovery, access modeling, and downstream governance processes.
This does not mean Rapid Setup eliminates the need for validation. Administrators must still verify schemas, correlation rules, entitlement treatment, and provisioning behavior. However, the statement is accurate because creating application definitions is a core function of Rapid Setup.
Reference topics: Applications, Rapid Setup, application definitions, connector configuration, schema configuration, aggregation, correlation, and entitlement discovery.
質問 # 28
The purpose of marking an attribute as managed when defining the application account schema is to designate it as:
An attribute that should be included in certifications.
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed identifies that attribute as governance-relevant access data. This is commonly applied to attributes that contain entitlement- like values, such as groups, roles, permissions, or application access assignments. When the attribute is managed, IdentityIQ can create and maintain managed attribute records for the values discovered during aggregation, allowing those values to be represented in the entitlement catalog with business metadata such as display name, description, owner, requestability, and classification.
This managed designation supports governance processes, including certifications. In an access review, reviewers need to evaluate meaningful access items rather than raw account data. Managed entitlement values can therefore be surfaced as reviewable access so managers, application owners, or entitlement owners can approve, revoke, or otherwise act on them during certification campaigns.
This does not mean the attribute itself is simply editable in IdentityIQ; editability is controlled separately through provisioning policies, forms, workflows, and connector support. The managed flag is primarily about governing the attribute's values as access.
Reference topics: Applications - schema attribute properties; Access Modeling - entitlement catalog; Governance - certification review items.
質問 # 29
Is this statement true about Rapid Setup?
Rapid Setup birthright roles are requestable.
- A. No
- B. Yes
正解：A
解説：
No. In IdentityIQ, a birthright role is intended to represent access that is automatically assigned to identities based on defined business criteria, such as lifecycle state, department, location, job function, or other identity attributes. The purpose of a birthright role is automatic access assignment, not user-driven request selection.
Rapid Setup can help configure common access-modeling and application-onboarding elements more efficiently, including birthright access patterns, but the birthright concept remains assignment-based rather than request-based.
Requestable access is handled through the access request model, where users select roles, entitlements, or other access items made available through request configuration and QuickLinks. Birthright access is different because it is granted when an identity satisfies the role assignment criteria and is recalculated through identity refresh and role evaluation. Making birthright roles requestable would undermine their purpose as standard baseline access automatically derived from identity data.
Therefore, the statement is inaccurate. Rapid Setup birthright roles are used for automated assignment and baseline access, not as requestable access items. Reference topics: Applications, Rapid Setup, Access Modeling, birthright roles, role assignment, identity refresh, and User-Driven Requests.
質問 # 30
Is this statement true for IdentityIQ application definitions?
Correlation logic can be specified for authoritative applications.
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ, correlation logic can be specified for authoritative applications. An authoritative application is commonly used as a trusted source for identity data, such as HR or another system of record. During aggregation, IdentityIQ reads account or source records from the application and uses correlation logic to determine whether each record should be linked to an existing IdentityCube or used in identity creation and update processing.
Correlation logic may be configured using account attributes, identity attributes, or correlation rules. For example, an authoritative source may correlate records by employee ID, user name, email address, or another unique identifier. This ensures that incoming authoritative data updates the correct identity instead of creating duplicates or leaving records uncorrelated.
The authoritative nature of the application does not eliminate the need for correlation. It defines the trust level and identity-data role of the source, while correlation defines how records from that source are matched to identities in IdentityIQ.
Reference topics: Applications, authoritative applications, correlation options, account aggregation, IdentityCube creation, identity attribute mapping, and uncorrelated account resolution.
質問 # 31
Is this an accurate statement about preventive policy checking in IdentityIQ?
Preventive policy checking can only stop self-service requests.
- A. No
- B. Yes
正解：A
解説：
The statement is false. Preventive policy checking in SailPoint IdentityIQ is not limited only to self-service requests. Preventive policy evaluation is used to identify policy violations before access changes are completed. This can occur during access request processing, provisioning-related activity, or other configured request paths where IdentityIQ evaluates proposed changes against defined policies before allowing the transaction to proceed.
A self-service request is only one possible entry point. IdentityIQ access requests may be submitted by an end user, a manager, an administrator, or another authorized requester depending on QuickLink Population rules, request configuration, and access-request permissions. Preventive policy checking evaluates the requested access change itself, not merely the fact that the request was self-initiated. If the proposed access would violate a separation-of-duty, risk, or other governance policy, IdentityIQ can warn, require additional handling, or block the request depending on policy and workflow configuration.
Therefore, the word "only" makes the statement incorrect. Preventive policy checking is a governance control applied to configured access-change activity, not exclusively to self-service actions. Reference topics:
Governance, policy detection, preventive policy checking, access request policy evaluation, User-Driven Requests, and provisioning request control.
質問 # 32
Is this statement true for IdentityIQ application definitions?
Applications in IdentityIQ are named with the connector that is selected.
- A. No
- B. Yes
正解：A
解説：
No. In SailPoint IdentityIQ, the application name is a configurable label assigned to the application object and does not have to match the connector selected. The application definition represents an external system or source, while the connector defines the technical integration method used to communicate with that system.
These are related configuration elements, but they are not the same field and one does not automatically name the other.
For example, an application could be named "Corporate Directory," "North America Active Directory," or
"HR Source," while using an LDAP, Active Directory, JDBC, Delimited File, Web Services, or another connector type. The connector selection determines available configuration settings, supported schema behavior, aggregation options, and provisioning capabilities. The application name is used for identification within IdentityIQ, reporting, certifications, requests, policies, and administrative configuration.
Therefore, the statement is incorrect because IdentityIQ applications are not named by the selected connector.
They are named by the administrator or implementer according to the business or system context. Reference topics: Applications, application definition, connector selection, connector-dependent settings, schemas, aggregation, and provisioning support.
質問 # 33
Is this statement true about Rapid Setup?
It will create the application definitions.
- A. No
- B. Yes
正解：B
解説：
Yes. Rapid Setup in SailPoint IdentityIQ is designed to accelerate application onboarding by creating and configuring the application definitions required for IdentityIQ to manage data from connected systems. An application definition is the IdentityIQ object that represents an external source or target system and stores the connector selection, connectivity settings, schema information, aggregation behavior, correlation configuration, and related governance options.
Rapid Setup reduces the amount of manual configuration normally required when defining applications.
Instead of building every application definition entirely through the standard detailed configuration screens, Rapid Setup guides the administrator through a simplified setup path and creates the required IdentityIQ application objects from that configuration. Those application definitions can then be used for aggregation, correlation, entitlement discovery, access modeling, and downstream governance processes.
This does not mean Rapid Setup eliminates the need for validation. Administrators must still verify schemas, correlation rules, entitlement treatment, and provisioning behavior. However, the statement is accurate because creating application definitions is a core function of Rapid Setup.
Reference topics: Applications, Rapid Setup, application definitions, connector configuration, schema configuration, aggregation, correlation, and entitlement discovery.
質問 # 34
Is this an accurate statement about the selection of a connector as part of an application definition?
Some connectors contain a predefined account schema.
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ, some application connectors include predefined schema information because the structure of accounts and groups on those target systems is well known to the connector. When an application is created and a specific connector type is selected, IdentityIQ may automatically populate schema elements such as the account schema, native identity attribute, display attribute, common account attributes, and sometimes group or entitlement schema definitions. This is common for standard connectors where the managed system has a predictable object model.
However, predefined does not mean final or immutable. The application administrator must still review and adjust the schema to ensure it accurately represents the implementation, including which attributes are aggregated, which attributes are searchable, which attributes are entitlements, and which attributes are used for identity correlation. Other connector types, such as generic JDBC, delimited file, or custom connectors, may require more manual schema definition.
This statement is therefore accurate because connector selection can provide default schema structure. Reference topics: Applications, connector selection, account schema, group schema, schema attributes, aggregation configuration, and application definition.
質問 # 35
Can this method be used to include entitlements or groups in the Entitlement Catalog?
Mark an attribute as multi-valued in the application schema and run an account aggregation.
- A. No
- B. Yes
正解：A
解説：
No. Marking an attribute as multi-valued does not, by itself, cause IdentityIQ to treat that attribute as an entitlement or include its values in the Entitlement Catalog. In an application schema, the multi-valued setting only indicates that the account attribute can contain more than one value. It describes data structure, not governance meaning.
To include access values in the Entitlement Catalog, the relevant schema attribute must be configured as an entitlement-bearing attribute, or group objects must be properly configured and aggregated through the application's group schema where applicable. IdentityIQ then recognizes those values as governable access rights and can represent them as managed attributes in the Entitlement Catalog. Once cataloged, they can be reviewed, certified, requested, described, owned, risk-scored, and governed by policy.
For example, an account attribute such as "groups" may be multi-valued, but IdentityIQ must also know that those values represent access rights. Without entitlement configuration, the aggregation stores attribute values on the account but does not properly model them as catalog entitlements.
Reference topics: Access Modeling, Entitlement Catalog, managed attributes, application schema attributes, entitlement attribute configuration, group schema, and account aggregation.
質問 # 36
Is this statement true for IdentityIQ application definitions?
Application definitions contain the connectivity information IdentityIQ uses to communicate with the application.
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ, an application definition represents an external system or managed source and contains the configuration IdentityIQ needs to connect to and interact with that system. The selected connector determines which connectivity settings are required, and the application definition stores those values. Examples can include server host, port, credentials, JDBC URL, file path, API endpoint, tenant information, authentication parameters, or other connector-specific settings.
This connectivity information enables IdentityIQ to perform operations such as account aggregation, group aggregation, schema discovery, entitlement collection, and provisioning where the connector supports write operations. The exact fields vary by connector type, which is why an LDAP, JDBC, Delimited File, Active Directory, or Web Services application may expose different configuration requirements.
Therefore, the statement is accurate: application definitions contain the communication and connectivity configuration used by IdentityIQ to access the application. Reference topics: Applications, application definition, connector selection, connector-dependent settings, account aggregation, schema configuration, and provisioning support.
質問 # 37
The purpose of marking an attribute as managed when defining the application account schema is to designate it as:
An attribute with values that are promoted to the Entitlement Catalog.
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed designates that the values discovered for that attribute are treated as managed entitlement values and promoted into the Entitlement Catalog. This is typically used for attributes that represent access, such as groups, roles, permissions, profiles, or other application-specific entitlement assignments. During aggregation, IdentityIQ reads account data from the application. When a schema attribute is marked as managed, the distinct values of that attribute can become ManagedAttribute objects, allowing IdentityIQ to govern them as cataloged access items.
This catalog promotion is important because raw technical values often need business context before they can be reviewed, requested, approved, certified, or reported on. The Entitlement Catalog can store metadata such as display name, description, owner, requestability, classification, and other governance attributes. These values then become usable in access certifications, access requests, reports, policy evaluation, and role modeling.
Therefore, the statement accurately describes the managed attribute function. Reference topics: Applications - account schema attribute properties; Access Modeling - entitlement catalog; Governance - certification content and entitlement review.
質問 # 38
Is this a true statement about the provisioning process in IdentityIQ?
IdentityIQ determines if the account needs to be created before modification.
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ provisioning, the system evaluates the requested access change in the context of the identity's existing application accounts. When a provisioning request requires a modification on an application, IdentityIQ must determine whether the identity already has an account, represented by a Link, on that application. If no existing account is available and the requested change requires one, IdentityIQ can include account creation as part of the provisioning activity before applying attribute or entitlement modifications.
This behavior is central to request-based provisioning. For example, if a user requests an entitlement on an application where they do not yet have an account, IdentityIQ cannot simply add the entitlement to a nonexistent account. The provisioning process must first establish the account, collect required values through provisioning policies, and then apply the requested access. The provisioning plan may therefore be expanded or adjusted during compilation and fulfillment.
Therefore, the statement is true: IdentityIQ can determine whether an account must be created before modification. Reference topics: Provisioning, provisioning plan processing, account requests, provisioning policies, account creation, entitlement modification, and plan compilation.
質問 # 39
Is this statement true about Rapid Setup?
Rapid Setup birthright roles are requestable.
- A. No
- B. Yes
正解：A
解説：
No. In IdentityIQ, a birthright role is intended to represent access that is automatically assigned to identities based on defined business criteria, such as lifecycle state, department, location, job function, or other identity attributes. The purpose of a birthright role is automatic access assignment, not user-driven request selection. Rapid Setup can help configure common access-modeling and application-onboarding elements more efficiently, including birthright access patterns, but the birthright concept remains assignment-based rather than request-based.
Requestable access is handled through the access request model, where users select roles, entitlements, or other access items made available through request configuration and QuickLinks. Birthright access is different because it is granted when an identity satisfies the role assignment criteria and is recalculated through identity refresh and role evaluation. Making birthright roles requestable would undermine their purpose as standard baseline access automatically derived from identity data.
Therefore, the statement is inaccurate. Rapid Setup birthright roles are used for automated assignment and baseline access, not as requestable access items. Reference topics: Applications, Rapid Setup, Access Modeling, birthright roles, role assignment, identity refresh, and User-Driven Requests.
質問 # 40
Why would an organization define lifecycle events in IdentityIQ?
To define what should trigger a joiner process, a mover process, or a leaver process
- A. No
- B. Yes
正解：B
解説：
Yes. Lifecycle Events in SailPoint IdentityIQ are defined to detect significant identity changes and trigger the appropriate business process in response. Organizations commonly use them to automate joiner, mover, and leaver scenarios. A joiner event may be triggered when a new identity is created or becomes active. A mover event may be triggered by changes such as department, job title, manager, location, or business unit. A leaver event may be triggered when an identity's employment status or lifecycle state indicates termination.
The lifecycle event configuration defines the condition to monitor and the business process or workflow to execute when that condition is met. This allows IdentityIQ to automate access provisioning, role assignment, account creation, access removal, account disablement, approvals, notifications, and other lifecycle-driven actions.
Therefore, the statement is accurate. Lifecycle Events are specifically used to define what identity data changes should initiate joiner, mover, or leaver processing.
Reference topics: Provisioning, Lifecycle Events, joiner-mover-leaver processing, identity attribute changes, business processes, workflows, and event-driven provisioning.
質問 # 41
Is this statement accurate about the BeanShell rules used in the aggregation process?
Rule processing can be disabled in the task definition.
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ, BeanShell rules used during aggregation are optional processing extensions, and task configuration can control whether rule processing is applied for a particular aggregation run. Aggregation itself is performed through the application definition, connector, schema, and aggregation task. Rules may be added to customize behavior, such as transforming incoming account data, applying custom correlation logic, handling identity creation, or modifying account information before it is stored.
Because rules can significantly affect aggregation behavior, IdentityIQ provides task-level controls that allow administrators to disable rule processing when appropriate. This can be useful for testing connector behavior, isolating troubleshooting scenarios, improving performance during certain runs, or validating source data without custom transformation logic. When rule processing is disabled, aggregation relies on standard connector and configuration behavior rather than custom BeanShell execution.
Therefore, the statement is accurate. Rule execution is not mandatory for aggregation and can be controlled from the task definition. Reference topics: Applications, aggregation tasks, BeanShell rules, connector configuration, account schema, correlation rules, creation rules, and aggregation task options.
質問 # 42
Is this a purpose of identity governance and administration (IGA)?
Recording which data a user downloads
- A. No
- B. Yes
正解：A
解説：
Recording which data a user downloads is not a core purpose of Identity Governance and Administration in SailPoint IdentityIQ. IGA is concerned with governing identities, accounts, access, entitlements, roles, policy violations, certifications, access requests, and provisioning. Its central objective is to answer questions such as who a user is, what access they have, whether that access is appropriate, who approved it, and whether access complies with defined business and security policies.
Tracking the specific files, records, or data objects downloaded by a user is typically associated with data activity monitoring, data loss prevention, security information and event management, or user behavior analytics. IdentityIQ may integrate with other systems and can govern access to applications or repositories that contain sensitive data, but it does not primarily function as a tool for recording every data download event.
In IdentityIQ terms, the governance focus is identity security: access visibility, access certification, policy enforcement, role modeling, lifecycle management, and provisioning controls. Reference topics: Foundational Concepts, purpose of identity security, common IdentityIQ terms, governance model, certifications, policies, and provisioning.
質問 # 43
The purpose of marking an attribute as managed when defining the application account schema is to designate it as:
An attribute that can be edited in IdentityIQ.
- A. No
- B. Yes
正解：A
解説：
Marking an account schema attribute as managed does not mean the attribute can be edited in IdentityIQ. In IdentityIQ application schema configuration, a managed attribute is one whose values are promoted into IdentityIQ as governable access objects, commonly represented in the entitlement catalog. This allows IdentityIQ to attach governance metadata to the discovered values, such as display name, description, owner, requestability, classification, and review-related context.
Editability is controlled through different mechanisms, including provisioning policies, forms, workflows, connector capabilities, and provisioning plan operations. An attribute may be managed for governance purposes without being directly editable by a user in IdentityIQ. Conversely, an attribute may be populated during provisioning if the application connector and provisioning policy support it, but that is separate from the schema's managed designation.
The managed setting is therefore about governance, cataloging, and access modeling, not direct modification.
It enables IdentityIQ to treat values of that schema attribute as objects that can be reviewed, requested, certified, described, and owned.
Reference topics: Applications - account schema attributes and their functions; Access Modeling - entitlement catalog; Governance - certifications; Provisioning - provisioning policies and attribute handling.
質問 # 44
The purpose of marking an attribute as managed when defining the application account schema is to designate it as:
An attribute with values that are promoted to the Entitlement Catalog.
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ, marking an application account schema attribute as managed designates that the values discovered for that attribute are treated as managed entitlement values and promoted into the Entitlement Catalog. This is typically used for attributes that represent access, such as groups, roles, permissions, profiles, or other application-specific entitlement assignments. During aggregation, IdentityIQ reads account data from the application. When a schema attribute is marked as managed, the distinct values of that attribute can become ManagedAttribute objects, allowing IdentityIQ to govern them as cataloged access items.
This catalog promotion is important because raw technical values often need business context before they can be reviewed, requested, approved, certified, or reported on. The Entitlement Catalog can store metadata such as display name, description, owner, requestability, classification, and other governance attributes. These values then become usable in access certifications, access requests, reports, policy evaluation, and role modeling.
Therefore, the statement accurately describes the managed attribute function. Reference topics: Applications
- account schema attribute properties; Access Modeling - entitlement catalog; Governance - certification content and entitlement review.
質問 # 45
Is this definition of entitlement accurate?
An access right on an application
- A. No
- B. Yes
正解：B
解説：
Yes. In SailPoint IdentityIQ, an entitlement represents an access right, permission, privilege, group membership, role membership, or similar access-granting value on an application. Entitlements are discovered from application account data during aggregation and are commonly modeled in IdentityIQ through schema attributes marked as entitlement attributes. Once aggregated, these values may appear in the entitlement catalog as managed attributes, where they can be reviewed, requested, certified, governed by policies, and associated with roles.
The definition "an access right on an application" is accurate because entitlements describe what an identity's account is allowed to do or access within a connected system. Examples include Active Directory group membership, database roles, application permissions, cloud groups, or other system-specific access values. IdentityIQ uses entitlements as core governance objects for certifications, access requests, policy checks, role modeling, and provisioning.
This definition is intentionally broad because different target systems represent access differently. IdentityIQ normalizes those application-specific access values into entitlement concepts for identity governance.
Reference topics: Access Modeling, entitlement catalog, managed attributes, application schema, entitlement aggregation, certifications, access requests, and provisioning.
'
質問 # 46
Is this statement true for the identity refresh task?
It will execute the aggregation rules set on the application definition.
- A. No
- B. Yes
正解：A
解説：
The statement is false. The Identity Refresh task does not execute aggregation rules configured on an application definition. Aggregation rules are part of the application aggregation process, where IdentityIQ connects to a source system, reads account or group data, applies connector and application-level processing, and stores account links, entitlement values, and related data in the IdentityIQ repository.
The Identity Refresh task operates after data is already present in IdentityIQ. Its function is to update IdentityCubes and recalculate identity-level governance information. Depending on selected options, Identity Refresh may update identity attributes, refresh role assignments, detect assigned or detected roles, evaluate policies, process lifecycle events, refresh manager relationships, or recalculate risk and access-related identity state.
Application aggregation and identity refresh are separate task functions. Aggregation obtains and normalizes data from applications; Identity Refresh interprets and recalculates identity governance state using that aggregated data. Therefore, rules tied specifically to aggregation on the application definition are execute during aggregation, not during Identity Refresh.
Reference topics: Identity Modeling - Identity Refresh task options; Applications - aggregation rules and application definitions; Foundational Concepts - tasks and workflows.
質問 # 47
Is this statement about uncorrelated accounts true?
Uncorrelated Identity Cubes are removed from IdentityIQ after 30 days.
- A. No
- B. Yes
正解：A
解説：
The statement is false. IdentityIQ does not apply a universal rule that removes uncorrelated IdentityCubes after 30 days. Uncorrelated accounts or uncorrelated identity records result from aggregation and correlation processing when IdentityIQ cannot confidently associate an account from an application with an existing IdentityCube. These records remain available for administrative review and remediation until they are resolved through correlation logic, manual correlation, re-aggregation, identity refresh activity, or configured cleanup processes.
The key point is that retention and removal behavior is configuration-driven, not controlled by a fixed 30-day product rule. Administrators may use tasks, aggregation settings, pruning behavior, or lifecycle processes to clean up stale identity or account data, but such actions depend on implementation choices and task configuration. IdentityIQ preserves uncorrelated data because it may represent a real account requiring governance, certification, policy evaluation, or investigation.
Therefore, the assertion that uncorrelated IdentityCubes are automatically removed after 30 days is incorrect. Reference topics: Applications, uncorrelated account resolution, correlation configuration, aggregation results, IdentityCube association, identity refresh, and administrative cleanup tasks.
質問 # 48
......
あなたを合格させるIdentity Security Engineer IdentityIQ-Associate試験問題集で2026年08月31日には78問あります：https://www.jpntest.com/shiken/IdentityIQ-Associate-mondaishu