I85PREP
⌘ K
IIQ Engineer study materials
IIQ Engineer study resources

IIQ Engineer practice questions

One question at a time. Build your IIQ Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Installation, Upgrade, and System Configuration

In a deployed IdentityIQ web application, in which directory must the iiq.properties file be placed?

  1. META-INF
  2. WEB-INF/lib
  3. WEB-INF/conf
  4. WEB-INF/classes Correct answer.

Explanation

IdentityIQ resolves its configuration through the Java classpath. In a deployed WAR the classpath root is WEB-INF/classes, so iiq.properties must be placed there for the application to read database and connector settings at startup.

Question 2Installation, Upgrade, and System Configuration

Which command creates the schema and baseline configuration in a brand-new, empty IdentityIQ database?

  1. iiq upgrade
  2. iiq console
  3. iiq init Correct answer.
  4. iiq reset

Explanation

Initialization is a one-time step performed against an empty database: it creates the tables, loads the shipped baseline objects and creates the initial administrator. The upgrade command is reserved for databases that already contain an IdentityIQ schema.

Question 3Installation, Upgrade, and System Configuration

After installing newer IdentityIQ binaries against a database created by an older release, which command must be run to bring the schema up to date?

  1. iiq schema
  2. iiq init
  3. iiq upgrade Correct answer.
  4. iiq console -upgrade

Explanation

Upgrade migrations are applied by the dedicated upgrade command, which detects the current schema version and applies the required changes while preserving existing data. Running initialization instead on a populated database is not a supported upgrade path.

Question 4Installation, Upgrade, and System Configuration

Which administrator account is created by IdentityIQ initialization and used for the very first login?

  1. spadmin Correct answer.
  2. iiqadmin
  3. sysadmin
  4. root

Explanation

Initialization provisions a built-in administrator account named spadmin with a well-known default password that must be changed immediately after the first login. All other administrator identities are defined later through the identity model.

Question 5Installation, Upgrade, and System Configuration

Which file controls log levels and log file destinations in current IdentityIQ releases?

  1. log4j.properties
  2. log4j2.properties Correct answer.
  3. iiq.logging.properties
  4. log4j2.xml

Explanation

Current releases use the Log4j2 framework and read a log4j2.properties file from the classpath, normally WEB-INF/classes. Administrators change package-level log levels and appender targets in that file.

Question 6Installation, Upgrade, and System Configuration

Where should the vendor-supplied JDBC driver JAR be placed before initialization?

  1. WEB-INF/bin
  2. WEB-INF/lib Correct answer.
  3. A directory under the database server installation
  4. WEB-INF/classes

Explanation

The driver must be on the web application's classpath, and JAR dependencies belong in WEB-INF/lib. The database server never needs the IdentityIQ-side driver, and text folders are not scanned for jars.

Question 7Installation, Upgrade, and System Configuration

Which prefix do the tables created in the IdentityIQ schema use?

  1. spt_ Correct answer.
  2. idq_
  3. sail_
  4. iiq_

Explanation

IdentityIQ stores its persistent objects in tables prefixed with spt_, which is why schema scripts and troubleshooting guides refer to objects such as spt_identity. Knowing the prefix helps when validating that initialization completed correctly.

Question 8Installation, Upgrade, and System Configuration

In which directory of the deployed web application are the command-line scripts for the console utility located?

  1. WEB-INF/classes
  2. WEB-INF/bin Correct answer.
  3. WEB-INF/lib
  4. WEB-INF/logs

Explanation

The shell and batch scripts that launch the console utility ship in the WEB-INF/bin directory of the deployed application. Running them from that folder ensures the product libraries are on the classpath.

Question 9Installation, Upgrade, and System Configuration

Which console command checks the currently loaded IdentityIQ configuration for errors?

  1. verifyConfiguration
  2. testConfiguration
  3. checkConfiguration Correct answer.
  4. validateConfiguration

Explanation

The console provides a dedicated configuration check command that inspects the running configuration and reports problems such as broken references or missing required values. It is commonly run after importing configuration objects or changing system settings.

Question 10Installation, Upgrade, and System Configuration

Which console command executes a sequence of console commands stored in a text file?

  1. batch Correct answer.
  2. source
  3. script
  4. exec

Explanation

The batch command reads a file of console commands and executes them in order, which is how administrators automate repetitive import and export work. Each line is handled exactly as if it had been typed at the prompt.

Question 11Installation, Upgrade, and System Configuration

Which console command loads an XML file of configuration objects into IdentityIQ?

  1. install
  2. load
  3. deploy
  4. import Correct answer.

Explanation

The import command parses an XML file and merges its objects into the IdentityIQ repository, matching on name and type. It is the standard way to promote configuration between environments from the command line.

Question 12Installation, Upgrade, and System Configuration

Global settings such as the mail server and session behavior are maintained in which built-in object?

  1. Application Definition
  2. Global Settings
  3. System Setup Correct answer.
  4. System Configuration

Explanation

The System Setup object holds installation-wide settings that are not tied to a specific application or identity, including mail server details and scheduler behavior. Administrators edit it from the gear menu rather than from an application definition.

Question 13Installation, Upgrade, and System Configuration

Configuring an SMTP server in System Setup is required for which capability?

  1. Password policy enforcement
  2. Authoritative account correlation
  3. Outbound task notification email Correct answer.
  4. Role mining analysis results

Explanation

IdentityIQ sends task, workflow and certification notifications through the mail server defined in System Setup. Without a valid SMTP configuration, those messages are not delivered even though the underlying business logic still runs.

Question 14Installation, Upgrade, and System Configuration

Which action best preserves customized configuration before applying a version upgrade?

  1. Remove the entire WEB-INF/classes folder
  2. Drop the identity cube
  3. Export configuration objects to XML Correct answer.
  4. Delete the spt_ tables

Explanation

Exporting the objects that carry custom logic and settings produces a portable backup that can be re-imported and compared after the upgrade. Combined with a database backup, it is the standard preparation step before replacing the application binaries.

Question 15Installation, Upgrade, and System Configuration

Custom Java code that must be callable from IdentityIQ at runtime is delivered how?

  1. An XML object imported with the console
  2. A JAR file placed in WEB-INF/lib Correct answer.
  3. A BeanShell rule stored in the database
  4. A properties file placed in WEB-INF/bin

Explanation

Compiled extensions must be on the application classpath, and WEB-INF/lib is the classpath location for JAR dependencies. Rules written in the built-in scripting language cover per-object customization, not compiled classes.

Question 16Installation, Upgrade, and System Configuration

Which console command runs a BeanShell script file against the IdentityIQ API?

  1. run Correct answer.
  2. shell
  3. script
  4. exec

Explanation

The run command executes the statements in a named BeanShell file using the console's session, which lets administrators perform scripted maintenance without the user interface. The script has the same API access as other server-side rules.

Question 17Installation, Upgrade, and System Configuration

Which statement about connecting with the console utility is correct?

  1. It connects directly to the database Correct answer.
  2. It requires the application server to be running
  3. It uses the application server's remote API
  4. It only works against an embedded database

Explanation

The console is a standalone Java client that loads the product classes and opens its own connection using the configured data source settings. That is why console work is possible while the application server is stopped, and also why concurrent schema changes must be avoided.

Question 18Installation, Upgrade, and System Configuration

How is a plugin added to an IdentityIQ installation?

  1. Insert a row into the spt_plugin table manually
  2. Import the plugin and enable it Correct answer.
  3. Add the plugin name to log4j2.properties
  4. Copy the plugin JAR into WEB-INF/classes

Explanation

Plugins are distributed as importable packages that create plugin objects and supporting artifacts; after import the plugin must be enabled and configured before its features become active. Importing through the supported mechanism keeps the plugin's dependencies and settings consistent.

Question 19Installation, Upgrade, and System Configuration

Why should the previously exploded web application directory be removed when redeploying a new IdentityIQ version to Tomcat?

  1. Tomcat refuses to start with two copies of the WAR
  2. It regenerates the application's encryption key
  3. Stale files from the previous version may remain Correct answer.
  4. It frees database connections held by the old version

Explanation

Tomcat expands the archive once and may keep serving leftover files, so deleting the old exploded directory forces a clean extraction of the new version. Otherwise obsolete classes and configuration can persist alongside the new deployment.

Question 20Installation, Upgrade, and System Configuration

On a Linux Tomcat host, where is the IdentityIQ JVM heap size normally configured?

  1. setenv.sh Correct answer.
  2. web.xml
  3. iiq.properties
  4. log4j2.properties

Explanation

JVM options such as the maximum heap are passed to the application server at startup, and Tomcat sources them from the setenv script in its bin directory. IdentityIQ property and deployment descriptor files control application behavior, not the JVM.

Question 21Installation, Upgrade, and System Configuration

IdentityIQ must reach an LDAP server over LDAPS. Which step makes that server's certificate trusted by the application?

  1. Copy the certificate into WEB-INF/lib
  2. Import the certificate with iiq console import
  3. Import the certificate into the JVM truststore Correct answer.
  4. Add the certificate to iiq.properties

Explanation

TLS validation is performed by the JVM, so the issuing certificate must be present in the truststore used by the application server's Java process. Product-level configuration files and object imports have no effect on Java's certificate validation.

Question 22Installation, Upgrade, and System Configuration

Two IdentityIQ nodes share one database behind a load balancer. What must the load balancer provide?

  1. TLS termination at the load balancer
  2. Session affinity (sticky sessions) Correct answer.
  3. Round-robin distribution without persistence
  4. A shared NFS mount for WEB-INF

Explanation

Each node keeps the user's session in its own memory, so successive requests from one user must return to the same node. Without session affinity, users are randomly logged out or lose in-progress work.

Question 23Installation, Upgrade, and System Configuration

What privilege does the database account need during initialization and upgrade that ordinary runtime use does not require?

  1. DDL privileges to create and alter tables Correct answer.
  2. No privileges beyond CREATE SESSION
  3. Only SELECT and INSERT on the spt_ tables
  4. Database administrator rights on all schemas

Explanation

Initialization and upgrade create and modify tables and indexes, which requires data definition rights on the IdentityIQ schema. Day-to-day operation only needs data manipulation rights on the resulting tables.

Question 24Installation, Upgrade, and System Configuration

Which sequence correctly describes a version upgrade of an existing IdentityIQ installation?

  1. Run iiq upgrade first, back up the database afterwards, deploy the WAR, then start the server
  2. Deploy the WAR, run iiq init, start the server, then back up the database
  3. Back up the database, stop the server, deploy the WAR, run iiq upgrade, start the server Correct answer.
  4. Start the server, deploy the WAR, run iiq upgrade, then back up the database

Explanation

The database backup must exist before any change, the server must be stopped so no process holds the old schema, and migrations must complete before the new application serves requests. Skipping the migration step leaves the binaries expecting tables that do not yet exist.

Question 25Installation, Upgrade, and System Configuration

IdentityIQ is being moved to a new, empty database on a new host. Which approach builds a working installation there?

  1. Run iiq upgrade against the new empty database
  2. Update iiq.properties, run iiq init, then import the exported configuration Correct answer.
  3. Copy the old iiq.properties to the new host and start the server against the empty schema
  4. Restore the old database and change only the connection URL

Explanation

An empty database needs the schema and baseline objects created first, after which previously exported customization can be imported to reproduce the source environment. Merely repointing the application at an empty schema leaves it with nothing to read.

Question 26Installation, Upgrade, and System Configuration

Which file, placed on the application server's classpath, holds the JDBC URL, user name, and password that IdentityIQ uses to reach its repository database?

  1. web.xml
  2. context.xml
  3. iiq.properties Correct answer.
  4. catalina.properties

Explanation

IdentityIQ reads its repository datasource settings (driver class, connection URL, user, and password) from iiq.properties, which is packaged into WEB-INF/classes of the deployed application and must be edited to match the target database before initialization.

Question 27Installation, Upgrade, and System Configuration

SailPoint distributes IdentityIQ as a deployable artifact. Which artifact is deployed into the servlet container for a new installation?

  1. A .war web application archive Correct answer.
  2. A .jar library added to the container's shared library directory
  3. A .zip of console scripts unpacked into the container's bin directory
  4. A .ear enterprise archive bundling the application and its database

Explanation

IdentityIQ is delivered as a WAR file that is dropped into the servlet container's deployment location; the container then explodes it into a web application directory containing WEB-INF/classes and WEB-INF/lib.

Question 28Installation, Upgrade, and System Configuration

An administrator needs more detailed logging from the deployed IdentityIQ web application. Which file is edited to change log levels?

  1. The log4j2.properties file under WEB-INF/classes Correct answer.
  2. The catalina.properties file in the container's conf directory
  3. The iiq.properties file in the container's lib directory
  4. The web.xml deployment descriptor under WEB-INF

Explanation

Logging for IdentityIQ is driven by the Log4j2 configuration file located in WEB-INF/classes of the exploded web application, where loggers and appenders are tuned; the change takes effect when the application is restarted.

Question 29Installation, Upgrade, and System Configuration

An administrator repoints iiq.properties at a brand-new, empty database and restarts the server, but startup fails because the schema objects do not exist. Which action prepares the database?

  1. Run the checkConfig command from the IIQ console
  2. Run the import command from the IIQ console
  3. Run the run command from the IIQ console
  4. Run the init command from the IIQ console Correct answer.

Explanation

The init command creates and populates the IdentityIQ schema in the configured empty database, so it must be executed against a fresh repository before the application can start successfully on that database.

Question 30Installation, Upgrade, and System Configuration

A two-node IdentityIQ cluster shares one repository database. The team plans to upgrade node A first and keep it running while node B remains on the old release, then upgrade node B. Why is that plan unsafe?

  1. Node B will overwrite node A's customized configuration objects the next time node B is restarted.
  2. The schema upgrade is not backward compatible with the old release, so all nodes must be stopped. Correct answer.
  3. The load balancer cannot route requests to nodes running different versions of the Java runtime.
  4. Licensing requires every server in a cluster to report the same version before it accepts requests.

Explanation

A version upgrade includes a one-time repository schema change that the previous release cannot read, so the application must be down on every node while the database upgrade is performed and then all nodes are started on the new version together.

Question 31Application Onboarding and Connector Configuration

An engineer must onboard a nightly HR export that arrives as a comma-separated text file on the IdentityIQ server. Which connector should be selected?

  1. Web Services
  2. Delimited File Correct answer.
  3. LDAP
  4. JDBC

Explanation

The Delimited File connector reads flat text files and lets you define the delimiter, header handling, and column-to-attribute mapping. It is the standard choice for CSV or TSV feeds produced by another system.

Question 32Application Onboarding and Connector Configuration

What is the effect of marking an application as authoritative?

  1. Its entitlements are excluded from access certifications.
  2. Its connector settings are locked after aggregation.
  3. Its accounts are provisioned to the target automatically.
  4. Its account data is used to create and update identities. Correct answer.

Explanation

An authoritative application acts as a source of identity data: attributes from its aggregated accounts are written to matched identities during refresh. It can also drive identity creation when a creation rule is configured.

Question 33Application Onboarding and Connector Configuration

Which part of an application definition describes the groups and entitlements that can be collected from the target?

  1. Identity schema
  2. Provisioning schema
  3. Account schema
  4. Group schema Correct answer.

Explanation

An application definition carries an account schema for account attributes and, when groups are supported, a group schema that defines the attributes of collected groups. Group aggregation uses the group schema to build entitlement objects.

Question 34Application Onboarding and Connector Configuration

What is the purpose of the Test Connection option on an application's configuration page?

  1. It aggregates accounts to verify the schema.
  2. It creates a link between an account and an identity.
  3. It validates the connector settings can reach the target. Correct answer.
  4. It provisions a test account to the target system.

Explanation

Test Connection uses the configured host, credentials, and connector parameters to confirm the target is reachable and authentication succeeds. It performs no aggregation, correlation, or provisioning.

Question 35Application Onboarding and Connector Configuration

In an account schema, what does the native identity attribute represent?

  1. The name of the application that owns the account
  2. The identity's display name in IdentityIQ
  3. The account's password on the target system
  4. The unique identifier of the account on the target Correct answer.

Explanation

Native identity is the value that uniquely identifies an account on the target system, such as a distinguished name or employee number. It is the key used to recognise the same account across successive aggregations.

Question 36Application Onboarding and Connector Configuration

What is the primary result of running an account aggregation task for an application?

  1. Provisioning policies are generated for each account type.
  2. Account objects are read and linked to matching identities. Correct answer.
  3. Roles are assigned to the identities that own the accounts.
  4. The application's connector is upgraded to the latest version.

Explanation

Aggregation reads accounts from the target, creates or updates the corresponding account objects, and correlates them to identities to form links. Accounts that match no identity remain in the uncorrelated accounts list.

Question 37Application Onboarding and Connector Configuration

Where in the application definition is the logic that matches aggregated accounts to identities configured?

  1. On the Groups tab
  2. On the Correlation tab Correct answer.
  3. On the Schema tab
  4. On the Provisioning Policies tab

Explanation

The Correlation tab holds the correlation configuration: attribute mappings, an optional filter or expression, and the creation rule. These settings decide which identity an aggregated account is linked to.

Question 38Application Onboarding and Connector Configuration

Which task should be run after aggregation so that identity attributes reflect newly linked account data?

  1. The Connector Test task
  2. The Group Aggregation task
  3. The Identity Refresh task Correct answer.
  4. The Delete Accounts task

Explanation

Identity Refresh recalculates identities, pushing attribute values from linked accounts onto the identity and evaluating roles and policies. Aggregation alone only creates the accounts and links.

Question 39Application Onboarding and Connector Configuration

What does delta aggregation on an application rely on to fetch only changed accounts?

  1. A full export of all accounts compared in memory each run
  2. A manual list of accounts supplied by the application owner
  3. A timestamp or change-tracking column that the connector filters on Correct answer.
  4. The number of accounts created since the application was onboarded

Explanation

Delta aggregation passes a filter based on a modified-date or change-tracking attribute so only records changed since the previous run are returned. The target data source must expose such an attribute for the filter to work.

Question 40Application Onboarding and Connector Configuration

An application holds both employees and contractors, but only employees should be governed. Which configuration restricts which accounts are brought into IdentityIQ?

  1. An owner assignment on the application definition
  2. A creation rule on the correlation configuration
  3. A provisioning policy for the account type
  4. A filter on the account schema that aggregation applies Correct answer.

Explanation

A filter applied to the account schema narrows the records returned during aggregation, so only the intended population is read and governed. The rest never become accounts in IdentityIQ.

Question 41Application Onboarding and Connector Configuration

What is the purpose of a correlation expression on an application?

  1. It schedules the aggregation task at a recurring interval.
  2. It returns true when an account should be linked to a given identity. Correct answer.
  3. It decides which identity attributes appear on the identity page.
  4. It defines which attributes are written to the target on create.

Explanation

The correlation expression is evaluated for candidate identities and accounts and returns true to establish the link. It is used when matching requires logic beyond simple attribute-to-attribute comparison.

Question 42Application Onboarding and Connector Configuration

A provisioning policy on an application is used to do which of the following?

  1. Restrict which identities may be certified for the application
  2. Control how often the application's accounts are aggregated
  3. Define the audit schedule for the application's entitlements
  4. Specify the attributes sent when provisioning an account Correct answer.

Explanation

Provisioning policies are attached to an application per account type and operation, and define the fields and values the provisioning engine sends to the target. They determine what an account looks like when it is created or modified.

Question 43Application Onboarding and Connector Configuration

An account attribute can hold several entitlements in a single value set. What must be configured so each value is stored separately?

  1. The attribute must be removed from the identity attribute mapping
  2. The attribute must be flagged as multi-valued in the account schema Correct answer.
  3. The attribute must be marked as the native identity of the account
  4. The attribute must be excluded from the correlation configuration

Explanation

Marking a schema attribute as multi-valued tells the connector to split the incoming value into a list so each entry is stored and governed individually. Without that setting the whole string is stored as one attribute value.

Question 44Application Onboarding and Connector Configuration

Which item is required to configure account aggregation for a JDBC application?

  1. A delimited file containing the account export
  2. An LDAP bind DN for the database server
  3. A web service endpoint returning JSON
  4. A SQL query that returns the account records Correct answer.

Explanation

The JDBC connector reads accounts by executing a SQL statement configured on the account schema, using the connection string and credentials supplied in the application configuration. A valid query returning the account rows is therefore mandatory.

Question 45Application Onboarding and Connector Configuration

What does a managed attribute represent in IdentityIQ?

  1. A connector setting that limits the size of each batch
  2. A rule that creates identities from uncorrelated accounts
  3. A catalog entry describing an entitlement and its ownership Correct answer.
  4. A schedule that runs aggregation on the target system

Explanation

Managed attributes are entitlement catalog entries, produced from aggregated groups or entitlement values, that carry a display name, owner, and requestability. They make individual entitlements governable and requestable.

Question 46Application Onboarding and Connector Configuration

If no custom correlation logic is configured, how does IdentityIQ match an aggregated account to an identity by default?

  1. By comparing the application owner to the identity's manager
  2. By comparing the account's native identity to the identity's email
  3. By comparing the account name to the identity name Correct answer.
  4. By comparing every attribute in the account schema to the identity

Explanation

The default behaviour compares the account name attribute with identity names to establish the link. Custom mappings or a correlation expression are needed when the target's account names do not match identity names.

Question 47Application Onboarding and Connector Configuration

Which feature on an application definition must be enabled before IdentityIQ can send provisioning requests to the target?

  1. PASSWORD_MANAGEMENT
  2. MANAGER_LOOKUP
  3. PROVISIONING Correct answer.
  4. ENABLE_PARTITIONING

Explanation

The features string on the application controls which behaviours are active. PROVISIONING must be present for account create, modify, and delete requests to be sent to the target system.

Question 48Application Onboarding and Connector Configuration

In a delimited file application, which setting tells the connector that the first row of the file contains column names?

  1. Set the delimiter to a comma
  2. Set the number of rows to skip to zero
  3. Mark the file as UTF-8 encoded
  4. Enable the header row / column names option Correct answer.

Explanation

The header option instructs the connector to treat the first line as field names and map them to the schema attributes. Without it, the first data row would be read as an account record.

Question 49Application Onboarding and Connector Configuration

What is the purpose of defining more than one account schema on a single application?

  1. It duplicates every account so each one has a redundant copy.
  2. It allows the same application to be aggregated by multiple owners.
  3. It allows the connector to be tested against several hosts at once.
  4. It supports distinct account types with different attributes. Correct answer.

Explanation

Each account schema represents a distinct object type on the target, such as employees versus contractors. Correlation and provisioning policies can then be defined separately for each account type.

Question 50Application Onboarding and Connector Configuration

A delimited file application must read an export produced by another system. What must be true about the file path configured on the application?

  1. The path must be a URL served over HTTPS.
  2. The path must point to a share mounted on the target system.
  3. The path must be readable by the IdentityIQ host at task run time. Correct answer.
  4. The path must be encrypted with the application's key.

Explanation

The Delimited File connector opens the file from the filesystem of the IdentityIQ server, so the path must exist and be readable by the account running the aggregation task. Placement and permissions on that host are the administrator's responsibility.