Knowledge Checks

Question 1

Which of the following is not a use for workflows in IdentityIQ?
A. Processing access requests
B. Executing scheduled tasks
C. Driving lifecycle event activity
D. Implementing custom functionality through Quicklinks
E .Processing scheduled role assignment or activation

Answer 1

B. Executing scheduled tasks

Question 2

Yes or No

Processing access requests is a use for workflows in IdentityIQ?

Answer 2

Yes

Question 3

Processing scheduled role assignment or activation is a use for workflows in IdentityIQ?

Answer 3

Yes

Question 4

Yes or No

IdentityIQ’s default workflows are configurable through workflow variables. Variable values can drive functional changes like who is involved in approvals or whether whole steps of the workflow get executed or skipped.

Answer 4

Yes

Question 5

Yes or No

A workflow case is an objects that represents a running instance of a workflow.

Answer 5

Yes

Question 6

Yes or No

A workflow case is an object assigned to a user by the workflow when the workflow requires input from a user.

Answer 6

No

This is a work item

Question 7

True or False

A workflow will follow as many transition paths out of a given step as apply, spawning a separate workflowcase to track each path, as needed.

Answer 7

False

Only the first transition that evaluates to “true” is followed.

Question 8

What are the two key operations (processes) of the provisioning engine?

Answer 8

Compilation and Evaluation

Question 9

Which of these IdentityIQ functions can be customized per installation by extending or modifying the workflow attached to it? Choose all that apply.

A. Access requests
B. Certification remediation
C. Lifecycle events
D. Password changes

Answer 9

All except Certification remediation

In IdentityIQ, certification remediation (what happens after a cert decision like Revoke/Remove, and how that decision turns into provisioning work) is primarily handled by the certification engine + revocation/provisioning processing (revocation requests, background tasks, provisioning plans), not by a single “remediation workflow” that you can swap/extend per installation in the same direct way you can for requests, lifecycle, or password flows.

Question 10

Workflows

“wait -1” will make the work flow step pause for how long?

Answer 10

Until Perform Maintenance runs

Question 11

What does Reason “Expansion” means with this Access Request

Answer 11

Expansion as the reason means these attributes were added to the request during Plan Compilation and were not in the original provisioningPlan.

Question 12

True or false

If a user needs to get a new entitlement on an application where they do not already have an account the system will automatically create the account during entitlement provisioning.

Answer 12

True

Question 13

Yes or No

“Success” value in a ProvisioningResult indicates a successful provisioning.

Answer 13

No

Committed

COMMITTED = success, changes applied
FAILED = error occurred
PENDING = waiting (common in approval scenarios)
QUEUED = scheduled but not started
RETRY = will try again
CANCELLED = operation stopped
COMPILED = plan ready but not executed yet

Question 14

In a create account operations, how does IdentityIQ know which attributes need to be provided to the target system for a new account.

Answer 14

The application’s “Create” provisioning policy

Question 15

The provision method for any connector/integration is passed to the request in the form of what object?

Answer 15

Provisioning Plan

Question 16

Which of these components supports the execution of pre- and post- scripts during provisioning to Active Directory?

Answer 16

IQService

Question 17

What featuresString keyword indicates that an application’s connector is capable of writing directly to the target system?

Answer 17

PROVISIONING

Key Exam Points:

These are boolean feature flags that control provisioning behavior
PROVISIONING - the actual execution of provisioning
APPROVALS - whether to route through approval workflows
NOTIFY - whether to send notifications
TRACE - debugging/logging detail
Can combine multiple keywords with commas

Question 18

What attribute in an IntegrationConfig would stop IdentityIQ from creating manual provisioning work items for any application?

Answer 18

UniversalManager

Question 19

What specification in an IntegrationConfig indicates the list of target applications it writes for?

Answer 19

ManagedResources

Question 20

When should the Plan’s “targetIntegration” and the AccountRequest’s “application” values not match each other?

Answer 20

When the application’s provisioning channel is an Integration Configuration. (example: ticketing system like SNOW)

Question 21

Yes or No

Create Identity is one of the Identity Provisioning Policies for IdentityIQ?

Answer 21

Yes

Question 22

True or False

Allowing a Quicklink population to request adding of entitlements while not letting them request entitlement removal is a supported configuration option.

Answer 22

True

The request add and request remove of entitlements are separate configuration settings.

Question 23

True or False

Processing access requests made by one Quicklink population through one workflow, while using a different workflow for access requests submitted by another Quicklink population is supported.

Answer 23

False

Only one workflow per access request flow is supported.

Question 24

Yes or No

Self-service Registration is one of the Identity Provisioning Policies for IdentityIQ?

Answer 24

Yes

Question 25

# Yes or No Delete is one of the Identity Provisioning Policies for IdentityIQ?

Answer 25

Yes ## Footnote CUDE-DUCP Create Update Delete Enable Disable Unlock Change Password

Question 26

# Yes or No Lifecycle Events run during aggregation, immediately on detection of data changes.

Answer 26

No ## Footnote Events are detected during aggregation but not executed at that time. needsRefresh set to true

Question 27

# Yes or No Do Lifecycle Events run during an Identity Refresh task by default?

Answer 27

No ## Footnote Process Events option must be selected.

Question 28

# Yes or No Lifecycle Events run automatically by LCM workflows, when warranted by LCM identity creation or edit.

Answer 28

Yes ## Footnote LCM workflows (Joiner/Mover/Leaver) can trigger lifecycle events When identities are created or modified through LCM processes, associated lifecycle events execute

Question 29

# True or False (Role/Application Provisioning) Only one single and the most specific provisioning policy that applies to a provisioning request is applied to affect the request details.

Answer 29

False

Question 30

Which of these is required to set up a Quicklink so it runs a workflow? A. action = name of the workflow to run B. WorkflowRef pointing to the workflow to run C. action = workflow and workflowName attribute = name of the workflow to run

Answer 30

**C.** action = workflow and workflowName attribute = name of the workflow to run ## Footnote Example:

Question 31

When a Quicklink runs a workflow, how does the workflow know which user should be the target of the request?

Answer 31

The target user is determined before the workflow is launched and its ID value is passed to the workflow in the argument quickLinkIdentityId

Question 32

Which of the main LCM workflows handles role and entitlement provisioning requests?

Answer 32

LCM Provisioning

Question 33

# True or False If you don’t need supporting functions like approvals and notifications, LCM can process the mandatory compilation and evaluation steps of provisioning without calling a workflow.

Answer 33

False

Question 34

Which of the five key process steps performs the **evaluation** step of the required compilation-evaluation process flow?

Answer 34

Provision

Question 35

# Yes or No The **Initialize** step performs the evaluation step of the required compilation and evaluation process flow.

Answer 35

No | Provisioning Engine is the step that does Compilation and Evaluation

Question 36

How do you return values from a subprocess workflow to the workflow that invoked it?

Answer 36

Two-Part Process: **In subprocess**: Mark variables as output="true" **In parent**: Use return attribute or tags (note: these are Return tags for WorkflowRef, not standalone Return elements) to specify which output variables to retrieve

Question 37

Which processes uses the RemediationManager to build the ProvisioningPlan?

Answer 37

Certification revocations ## Footnote The RemediationManager is used when IdentityIQ is taking certification decisions (like revoke/remove access) and converting them into a ProvisioningPlan to execute the remediation/provisioning changes.

Question 38

How do you control logging from the various Java classes involved in processing a provisioning request?

Answer 38

Add entries to the log4j.properties file to specify the logging level per class

Question 39

What does an approval owner attribute specify?

Answer 39

The user who will be assigned the work item to complete

Question 40

# True or False Form definitions are specific to an individual workflow and cannot be shared across multiple workflows.

Answer 40

False Forms can me used by mutiple workflows.

Question 41

What does a form button’s “back” action indicate to the workflow?

Answer 41

Follow a transition path which specifies lastApprovalState=“rejected”

Question 42

What are the types of controls that can be specified on a form?

Answer 42

**PRTMC** (say: “per-tim-see”) **P**ick-lists (identities) **R**adio buttons **T**ext areas **M**ulti-select combo boxes **C**alendars (date pickers)

Question 43

# True or False Form specifications can be stored as embedded within workflows, roles, and applications.

Answer 43

True

Question 44

# True or False Form specifications can not be stored as first-class objects.

Answer 44

False

Question 45

What two arguments are required when you call the sendEmail method?

Answer 45

"to" and the email template

Question 46

# True or False The following step syntax is required to create a workItem and send an email to the owner of that work item.

Answer 46

False ## Footnote You either use workItemNotificationTemplate when using an approval, or call sendEmail when not using an approval.

Question 47

When you call the audit() method, IdentityIQ uses the ____________ method argument to check the AuditConfig. IdentityIQ only writes the audit record to the database if the configuration is enabled.

Answer 47

action | IdentityIQ uses the action method argument.

Question 48

# True or False Some auditing is built into the default workflows in IdentityIQ, but you can change what is recorded in those audit steps, and you can create custom audit event types and custom audit steps in your own workflows.

Answer 48

True

Question 49

How does IdentityIQ know what error messages should set the “Retry” status vs. the “Failed” status?

Answer 49

You must specify a retryableErrors entry in the Application definition and add the error messages which should be treated as retryable to its list

Question 50

What kind of workflow step can be enabled for step replication?

Answer 50

Subprocess

Question 51

Where and how are the pre/post scripts defined?

Answer 51

They are recorded as Rule objects in IdentityIQ but are written in Windows scripting languages and are passed to the IQService for execution during the provisioning operation

Question 52

# True or False IdentityIQ allows external applications to request data and to initiate processes, like workflows, through public web services.

Answer 52

True

Question 53

# True or False You can define a ProvisioningPlan for IdentityIQ to process by specifying it in XML and populating a workflow variable with its XML representation.

Answer 53

False ## Footnote The XML is only for serializing the plan to a more readable format; you must build the plan in Java/BeanShell.

Question 54

How would you make a provisioning plan, built inside a script step, available to subsequent workflow steps?

Answer 54

Include a return statement in your script logic and specify a **resultVariable** attribute on the step

Question 55

You must always specify an account nativeIdentity in your plan before passing it to the compilation process.

Answer 55

False ## Footnote Compilation will calculate the native identity for you; however, if the user has more than one account on the target application, you must specify the native identity to choose the target account for the operation.

Question 56

# True or False The only things a workflow step can be configured to do are: * Call a rule * Call a subprocess * Call a method

Answer 56

False ## Footnote Approvals, forms, custom steps and many more.

Question 57

How many users can a provisioning plan be applied to in a single provisioning operation?

Answer 57

One ## Footnote You can multiple requests for a single user, but the plan is tied to a single user.

Question 58

What does the nativeIdentity attribute on the AccountRequest object specify?

Answer 58

The account identifier ## Footnote This is the native/unique identifier of the account on the target system

Question 59

Which of these is NOT an operation that can be specified on an AccountRequest? a. Create b. Unlock c. Set d. Modify

Answer 59

C. Set ## Footnote **Valid AccountRequest Operations** Create - Create new account Lock - Lock an account Unlock - Unlock a locked account Disable - Disable an account Delete - Remove an account Enable - Enable a disabled account Modify - Update existing account attributes

Question 60

# True or False If the application FeaturesString supports enabling and disabling of accounts, user will always be able to perform those actions for their own account.

Answer 60

False ## Footnote FeaturesString set capalility, not permissions.

Question 61

# Is this a supported configuration option? Allowing new account requests on some applications while not allowing secondary accounts to be requested on any applications.

Answer 61

Yes ## Footnote You can control "Add" vs "Remove" permissions separately

Question 62

# Is this a supported configuration option? Some entitlements not requestable by anyone, others visible only to selected populations

Answer 62

Yes ## Footnote Entitlements have a requestable attribute (can be set to false to block all requests). Also other limits that can be set up.

Question 63

# Is this a supported configuration option? Different workflows for different QuickLink populations

Answer 63

Yes ## Footnote Applications can be individually configured for what's requestable The allowNewAccountRequests setting is per-application

Question 64

Which log file typically contains BeanShell exception stack traces in IdentityIQ?

Answer 64

iiq.log ## Footnote BeanShell errors usually flow through IdentityIQ’s Log4j logging and land in the main application log.

Question 65

Where do Workflow Trace details get written when workflow tracing is enabled?

Answer 65

workflowtrace.log ## Footnote This log is dedicated to workflow trace output (separate from general application logging).

Question 66

If you add System.out.println(...) in custom code/rules, where does that output usually appear?

Answer 66

stdout (app server console log, e.g., catalina.out on Tomcat) ## Footnote System.out writes to the JVM/servlet container console, not Log4j.

Question 67

Which log file commonly records WorkItem notification messages?

Answer 67

notification.log ## Footnote Email/notification-related events are typically routed to the notifications log for easier troubleshooting.

Question 68

If IdentityIQ code (or a custom Log4j logger you call from BeanShell) writes log output, which file most commonly contains it?

Answer 68

iiq.log ## Footnote Log4j output (INFO/WARN/ERROR) generally goes to the primary IdentityIQ log unless you’ve configured a custom appender.

Question 69

A workflow is behaving unexpectedly and you need step-by-step trace output. Which log should you check first?

Answer 69

workflowtrace.log ## Footnote Workflow trace is the “play-by-play” log; iiq.log is usually higher-level.

Question 70

True/False: System.out.println output is captured in workflowtrace.log by default.

Answer 70

False ## Footnote System.out goes to stdout/console logs; workflowtrace.log only captures workflow tracing.

Question 71

True/False: notification.log is the best place to look for BeanShell stack traces.

Answer 71

False ## Footnote BeanShell exceptions typically appear in iiq.log (or stdout if printed directly), not the notifications log.

Question 72

In one phrase: what is iiq.log primarily used for?

Answer 72

General IdentityIQ application logging (including many errors/stack traces) ## Footnote Think of iiq.log as the “main log” for most troubleshooting unless a feature has a dedicated log.

Question 73

Where is iiq.log usually stored/saved?

Answer 73

Tomcat (common IdentityIQ installs): /webapps/identityiq/WEB-INF/log/iiq.log JBoss / EAP / WildFly (varies by config): Often under something like /standalone/log/ if Log4j is pointed there, but many installs still write under the IdentityIQ webapp WEB-INF/log/

Question 74

# True or False Implementers never need to be concerned with whether an AuditAction is enabled, as IdentityIQ automatically takes care of this for them.

Answer 74

False ## Footnote Implementers do need to be aware of whether an AuditAction is enabled/configured, because if it’s disabled (or not configured the way you expect), the event may not be recorded the way you intend in the audit trail.

Question 75

Which set correctly lists all IQService script hook points for CRUD operations?

Answer 75

Before Create / After Create / Before Modify / After Modify / Before Delete / After Delete

Question 76

If you need to validate data before an account is updated by IQService, which hook should you use?

Answer 76

Before Modify

Question 77

If you need to log the results right after an account is removed by IQService, which hook should you use?

Answer 77

After Delete