IdentityNow-Engineer SailPoint Certified IdentityNow Engineer Questions and Answers

No, this statement describes Manager Certification rather than Manager Correlation. Manager Certification refers to an approval process in which managers are required to periodically review and approve the access rights of their direct reports. This is a governance feature used to ensure that employees only have the access they need, and it helps managers validate their team’s access periodically. Manager Correlation, on the other hand, is about linking identities to their managers based on attributes.

Key Reference from SailPoint Documentation:

Manager Certification vs. Manager Correlation: While Manager Certification involves periodic review and approval of access by managers, Manager Correlation is strictly about linking identities to their respective managers based on defined attributes.

No, reconfiguration within IdentityNow is not required to connect to the disaster recovery (DR) VAs, which makes this scenario not a disadvantage. When properly configured, all VAs (including DR VAs) in a cluster are part of the same logical unit, meaning that failover to the DR VAs should happen seamlessly without manual intervention or significant reconfiguration. IdentityNow handles the failover automatically, directing traffic to the DR VAs when primary VAs become unavailable.

While there might be some overhead in a manual failover scenario for certain configurations, the use of a single VA cluster helps mitigate this by ensuring the system can failover without needing complex reconfigurations for every source.

References:

SailPoint IdentityNow Virtual Appliance Failover and Disaster Recovery Configuration.

SailPoint IdentityNow High Availability Architecture Guide.

Yes, it is possible to remove the approval requirement for an application in IdentityNow by editing the access profile and unchecking the 'Required Approval' box. This configuration change would eliminate the need for a manager or other approver to review access requests, allowing users to be granted access without requiring approval.

Key Reference from SailPoint Documentation:

Access Profile Configuration: Access profiles can be configured to require or not require approval for access requests, and this option can be modified directly in the profile settings.

No, the Virtual Appliances (VAs) should not reside in A, which represents the SailPoint cloud environment. VAs are typically deployed in the on-premises network to interface directly with internal resources like Active Directory, databases, and applications. The cloud environment is where IdentityNow services are hosted, but the VAs need to be positioned closer to on-premise resources to manage identity synchronization and provisioning tasks.

Key Reference from SailPoint Documentation:

VA Placement Recommendations: Virtual Appliances are deployed in the on-premise network rather than the cloud, to ensure they have direct and secure access to internal resources.

Yes, the search syntax @accounts( source.name:"AD" AND state:"disabled" ) is correct for finding identities with disabled AD accounts. In this case, the query filters accounts based on the state being "disabled," which is valid and effective for identifying disabled accounts.

Key Reference from SailPoint Documentation:

Search by Account State: Using state:"disabled" is an accurate way to search for disabled accounts in SailPoint IdentityNow.

Yes, SailPoint IdentityNow's versioned APIs are fully supported. SailPoint uses versioning in their APIs to ensure backward compatibility, allowing clients to continue using older API versions while newer versions are introduced with additional features and improvements. Versioning helps maintain stability for applications that depend on the APIs.

Key Reference from SailPoint Documentation:

API Versioning: SailPoint IdentityNow provides support for versioned APIs, allowing developers to choose specific versions of the API, which are fully maintained and supported, to prevent breaking changes in integrations.

No, the Generic Cloud Connector is not the most suitable connector type for this use case. The system described is a modern, cloud-based web application that exposes a SCIM 2.0 interface with OAuth 2.0 client credentials for authentication. The Generic Cloud Connector is typically used for systems that do not have specialized connectors but can integrate via general APIs or REST endpoints. Since the application supports SCIM 2.0, which is a standardized protocol for managing identities, the SCIM 2.0 Connector would be the more appropriate choice, as it is specifically designed for this type of integration.

References:

SailPoint IdentityNow SCIM 2.0 Connector Guide.

SailPoint IdentityNow Connector Overview Documentation.

1. sudo timedatectl

Purpose: Display the current system date and time.

2. sudo journalctl -f -u ccsd Of tail /home/sailpoint/ccs.log

Purpose: Review a log file. This command is used to view logs related to the CCS (Cloud Connector Service) for troubleshooting or analysis.

3. ldapsearch -x -D

Purpose: Search an Active Directory domain controller. This command queries an LDAP directory to retrieve information about users, groups, etc.

4. nc -vz -w 5 192.168.0.1 80

Purpose: Test a port on a remote system. This command is using "netcat" to test whether port 80 on the specified IP address is open and responding.

Yes, downloading the accounts data CSV from the Accounts tab on the authoritative source is a reasonable action for troubleshooting incomplete identities. This CSV file contains detailed account information pulled from the authoritative source, allowing the engineer to manually inspect the raw data and identify any discrepancies or missing attributes that could lead to incomplete identities. This is a useful step in verifying the accuracy and completeness of the data being aggregated from the authoritative source.

References:

SailPoint IdentityNow Source Account Data Inspection and CSV Export Documentation.

SailPoint IdentityNow Identity Data Troubleshooting Guide.

IQService does not run on the Virtual Appliance (VA). It is a separate service that must be installed on a Windows Server within the environment that has access to the target system, particularly for Active Directory and other Windows-based systems. IQService acts as a proxy between the IdentityNow tenant and these target systems, allowing operations such as password management and account provisioning to be executed on systems that do not support native connectors on the VA. It communicates with the VA but is not hosted on it.

References:

SailPoint IdentityNow IQService Installation Guide.

SailPoint IdentityNow Target Connector Architecture.

Yes, a non-production tenant is typically used for testing new features before they are deployed to the production environment. This allows administrators to validate functionality, identify potential issues, and ensure the features work as expected without affecting the live users and operations.

Key Reference from SailPoint Documentation:

Testing New Features in Non-Production: SailPoint advises using non-production environments for testing new functionalities to safeguard production environments from untested changes.

The virtual appliance (VA) private key is not stored in both the IdentityNow tenant and the VA. The VA private key, which is critical for secure communications, is stored only on the Virtual Appliance (VA) itself. It is used to authenticate and encrypt communications between the VA and the IdentityNow tenant. Storing such sensitive information in the IdentityNow tenant would violate best practices for key management and security.

Instead, the IdentityNow tenant only holds the public key or a reference to the key to facilitate secure exchanges with the VA. The private key remains secured locally within the VA, protecting it from potential security vulnerabilities associated with external storage.

References:

SailPoint IdentityNow Virtual Appliance Architecture Guide.

SailPoint IdentityNow Security and Encryption Documentation.

The default non-production tenant does not have the same full performance scalability as a production tenant. Non-production environments are typically configured with reduced resources since they are intended for testing, development, or demonstration rather than handling large-scale, live workloads.

Key Reference from SailPoint Documentation:

Performance Differences Between Tenants: SailPoint non-production tenants are generally scaled down compared to production environments to reflect their testing and demonstration purposes, not for high-performance or large-scale operations.

The search syntax @accounts( source.name:"AD" AND disabled:false ) is not correct for finding disabled AD accounts. This query would return accounts that are not disabled because it is filtering for disabled:false. To find disabled accounts, the filter should specify disabled:true.

Key Reference from SailPoint Documentation:

Search Syntax for Disabled Accounts: To search for disabled accounts, the condition should check for disabled:true.

In this use case, provisioning is initiated, but the source has provisioning disabled, meaning automated provisioning cannot proceed. The process described is accurate: when provisioning is assigned to a source where provisioning is disabled, IdentityNow does not execute the provisioning through its automated system. Instead, a manual task is generated for a human to complete the provisioning process. This manual intervention ensures that the necessary access changes can still occur, albeit through human oversight rather than an automated connector.

This scenario aligns with how IdentityNow handles sources that are flagged as non-provisionable. The provisioning logic is still calculated within the system, but actual implementation requires manual steps when the source is configured in this way.

References:

SailPoint IdentityNow Provisioning Architecture.

SailPoint IdentityNow Manual Provisioning Workflow Documentation.

Yes, https://my.example.com is an example of a vanity URL. Vanity URLs are customized, branded URLs designed to be easily recognizable, memorable, and aligned with a company’s branding. In this case, the subdomain my and the domain example.com create a branded, user-friendly URL. Vanity URLs are often used for simplifying access to services like IdentityNow and for improving user experience.

Key Reference from SailPoint Documentation:

Vanity URL Usage in IdentityNow: SailPoint allows customers to configure vanity URLs to provide a more personalized and branded login experience for their users.

Certifications are not assigned to the reviewer when the campaign status is "Preview Ready." The "Preview Ready" status indicates that the campaign is prepared for review by administrators, and the certification details can be previewed before launching the campaign. However, the certifications are only assigned to the reviewers once the campaign is in the "Active" status, which signifies the start of the certification process. At this point, reviewers can access the certifications assigned to them.

References:

SailPoint IdentityNow Certification Campaign Lifecycle Guide.

SailPoint IdentityNow Certification Campaign Status Documentation.

Yes, one of the key advantages of microservice architecture is the ability to resolve issues or failures quickly. Microservices are designed to be independent, loosely coupled services. If an issue arises in one service, it can be isolated and addressed without affecting the entire system. This compartmentalization enables faster resolution since each service can be debugged, redeployed, or scaled independently, resulting in quicker recovery from failures. This is a core benefit of microservice-based systems, including those used in SailPoint IdentityNow.

References:

SailPoint IdentityNow Microservices Architecture Overview.

Benefits of Microservices in SaaS Platforms.

No, selecting a checkbox to use the database admin as the service account is not a recommended or required configuration when implementing a source that uses a JDBC connector. Typically, for security and least privilege, a dedicated service account with only the necessary permissions to read and manage identities within the database is used. Granting database administrator (DBA) privileges to the service account introduces unnecessary security risks and is against best practices.

References:

SailPoint IdentityNow JDBC Connector Configuration Guide.

SailPoint IdentityNow Best Practices for Service Accounts Documentation.

No, custom connectors are not developed and compiled inside IdentityNow. Custom connectors are typically developed outside of the IdentityNow platform using a development environment and then tested and packaged before being uploaded to the platform. These connectors can be developed using tools provided by SailPoint, but the actual development process occurs externally, not directly within the IdentityNow environment.

Key Reference from SailPoint Documentation:

Custom Connector Development: Custom connectors are developed outside of the IdentityNow platform and then integrated into it for use.

Yes, the fact that the disaster recovery (DR) VAs are not being utilized until a disaster recovery event occurs is a disadvantage. In this strategy, the DR VAs remain idle, leading to underutilization of resources. These VAs could otherwise handle workloads during normal operations to improve efficiency, distribute load, or reduce latency, especially if they are geographically closer to specific target systems. Relying on DR VAs only during failover scenarios limits their potential to optimize performance and balance loads in day-to-day operations.

References:

SailPoint IdentityNow Virtual Appliance Clustering and Disaster Recovery Documentation.

SailPoint IdentityNow High Availability and DR Strategies.

No, the provided steps are not correct. The sequence of actions is misplaced:

Step 1: Before clicking "Test Connection," you need to download or procure the VA image and import it into the virtualization platform.

Step 6: After logging in and changing the password, the next step is to configure the networking settings, not downloading the image again.

Step 12: After uploading the config.yaml, you should proceed with testing the connection to ensure the VA is correctly configured and can communicate with IdentityNow.

Corrected Steps:

Download / procure the VA image.

Configure networking configurations (as needed).

Click Test Connection on the VA configuration.

References:

SailPoint IdentityNow Virtual Appliance Installation and Configuration Guide.

SailPoint IdentityNow Virtual Appliance Test Connection Documentation.

Yes, the file /etc/systemd/network/static.network (or a similarly named file depending on the Linux distribution used by the Virtual Appliance) is typically used to configure a static IP address for the VA. This file is part of the systemd network configuration, and modifying it allows you to specify static IP settings, such as the IP address, netmask, gateway, and DNS servers, for the Virtual Appliance's network interface.

To set a static IP address, you would need to modify this file and restart the network service for the changes to take effect.

References:

SailPoint IdentityNow Virtual Appliance Network Configuration Guide.

Linux systemd Network Configuration Documentation.

Yes, defining an account schema is an essential step when implementing a JDBC connector. The schema defines the structure of the identity data being pulled from the database, including the attributes that will be mapped to identity profiles in IdentityNow. The schema can be defined either by using the "Discover Schema" option, which automatically identifies available attributes, or by manually configuring the schema attributes if specific custom mappings are required.

References:

SailPoint IdentityNow JDBC Connector Schema Configuration Guide.

SailPoint IdentityNow Source Schema Discovery Documentation.

Yes, evaluating available campaign administration filters is a best practice before generating the campaign preview. Campaign filters allow administrators to control the scope of the campaign by filtering users, entitlements, or other criteria, which is crucial for tailoring the certification to the right audience. By evaluating and applying filters, administrators ensure that only the relevant users and entitlements are included in the certification campaign, leading to more effective and targeted certifications.

References:

SailPoint IdentityNow Campaign Administration Guide.

SailPoint IdentityNow Certification Campaign Filtering and Scope Documentation.

Yes, the search syntax @accounts( source.name:"AD" AND state:"disabled" ) is correct, as it matches the necessary criteria for finding disabled AD accounts. This query searches for accounts in the AD source where the account state is set to "disabled," which effectively filters for the desired result.

Key Reference from SailPoint Documentation:

Correct Syntax for Disabled Accounts: The search correctly identifies accounts with a disabled state using this syntax.

The Web Services connector in IdentityNow does not exclusively support JSON content-types; it also supports XML as a content type for communication. JSON (JavaScript Object Notation) is widely used, but the connector is flexible and can be configured to handle XML-based APIs as well, depending on the requirements of the target system. Thus, it does not only support JSON.

References:

SailPoint IdentityNow Web Services Connector Documentation.

SailPoint IdentityNow Web Services Connector Content-Type Configuration Guide.

Yes, an access profile allows the definition of an approval process. When an access profile is created, administrators can configure specific approval workflows that must be followed before the access is granted. This includes designating approvers or specifying multiple levels of approval, depending on the organization's policies. This capability is useful for ensuring that sensitive access requests are properly reviewed and approved.

References:

SailPoint IdentityNow Access Request and Approval Workflow Guide.

SailPoint IdentityNow Access Profile Configuration Documentation.

SailPoint IdentityNow allows HTML editing of email templates to customize the look, feel, and content of notifications. Administrators can modify email templates using HTML to include company branding, custom messages, and specific formatting based on their organization's communication needs.

SailPoint provides out-of-the-box email templates for common scenarios such as access requests, password resets, or provisioning notifications. Administrators can enhance these templates using HTML and inline CSS to personalize the messages for their users.

Key Reference from SailPoint Documentation:

Email Template Customization in IdentityNow: SailPoint supports the editing of email templates via HTML to meet specific organizational requirements. Administrators can navigate to the email templates section within the admin interface and update the HTML content as needed.