Pay the 300 USD fee for the SailPoint Certified IdentityIQ Associate exam and a clock starts running. SailPoint gives you 364 days from registration to schedule and sit the exam, and that single enrolment covers two attempts. Nothing in the purchase extends either number, so SailPoint IdentityIQ certification at Associate level is something you plan around, not something you book on a free afternoon.
The exam itself is compact: 43 questions in 90 minutes, reported as a pass or a fail, across seven topics that follow an identity from the moment an account is read from an application to the moment access is provisioned. This article explains how the enrolment window works, how the questions are worded, what each topic expects, how the Associate differs from the IdentityIQ Engineer exam, and how to spread your preparation across the time you have paid for.
Table of Contents
- What do two attempts in 364 days mean for your booking?
- What does the IdentityIQ Associate exam look like?
- Which seven topics does the syllabus name?
- How do applications, identities and roles fit together?
- What do governance, requests and provisioning add?
- IdentityIQ Associate or IdentityIQ Engineer?
- How should you prepare inside the enrolment window?
- Frequently Asked Questions
- Conclusion
What do two attempts in 364 days mean for your booking?
The SailPoint Certified IdentityIQ Associate enrolment costs 300 USD and includes two attempts, both of which must be scheduled and taken within 364 days of registering. A first attempt that falls short is not recorded as a failure straight away. The final result is only fixed after the second attempt, or when you pass.
SailPoint describes the sequence on its own IdentityIQ Associate exam page, and the three status labels are worth knowing before you buy:
- Passed appears as soon as an attempt succeeds, whether it is the first or the second.
- Not Complete appears after an unsuccessful first attempt and stays until you sit the second.
- Not Passed appears only if the second attempt is also unsuccessful.
Why the window changes your plan
Most candidates treat a purchase date as a formality. Here it is the start of a countdown, so the sensible order is reversed: prepare first, register when you are close to ready, and keep a comfortable share of the 364 days in reserve for a second sitting.
The second attempt is a safety net, and it works best when you leave time to use it. A first attempt taken in the final weeks of the window leaves almost no room to study the weak topics and return. A first attempt taken early leaves months.
What SailPoint recommends before you enrol
SailPoint recommends one year of hands-on experience for this certification and describes it as a role-based credential for on-premise identity security. It also states that the exam serves as the final exam for two of its courses, IdentityIQ Introduction and IdentityIQ Essentials, which tells you where the question writers drew their material.
What does the IdentityIQ Associate exam look like?
The SailPoint Certified IdentityIQ Associate exam has 43 questions and a 90 minute time limit, costs 300 USD, and is reported as Pass or Fail with no published percentage. The syllabus covers seven topics and gives no weighting for any of them, so you cannot rank your study time by share of marks.
| Field | Value |
|---|---|
| Exam name | SailPoint Certified IdentityIQ Associate |
| Exam code | IdentityIQ Associate (no alphanumeric code is used) |
| Questions | 43 |
| Duration | 90 minutes |
| Passing score | Pass or Fail, no percentage published |
| Fee | 300 USD |
| Attempts per enrolment | 2 |
| Time to schedule and sit | 364 days from registration |
| Recommended experience | 1 year hands-on |
| Topics | 7, with no published weightings |
Ninety minutes across 43 questions works out at just over two minutes each. That is a generous pace, which means the clock is unlikely to be what decides your result. Reading accuracy is.
How the sample questions are worded
The published sample items share one pattern. Each presents a single statement about IdentityIQ and asks whether it is accurate, with yes or no as the only choices. There is no list of four options to compare, so you cannot work backwards by elimination. You either know how the feature behaves or you do not.
The statements are built to sound plausible. One claims that removing attributes from an account schema improves correlation. Another says an IT role is made by grouping business roles. Both are wrong, and both read smoothly. Working through the IdentityIQ Associate sample questions early shows you how small the gap between a true statement and a false one can be.
Watch for absolute words. A statement that says a business role is acquired only by detection, or that a QuickLink never grants access by itself, turns on that one word. Read each statement twice before you answer.
Which seven topics does the syllabus name?
The IdentityIQ Associate syllabus names seven topics: Foundational Concepts, Applications, Identity Modeling, Access Modeling, Governance, User-Driven Requests, and Provisioning. SailPoint lists the same seven on its exam page. No weightings are published, but the number of objectives under each topic shows where the detail sits.
| Topic | Objectives listed | What you must be able to do |
|---|---|---|
| Foundational Concepts | 7 | Explain the purpose of identity security, define common terms, compare tasks and workflows, identify uses of rules |
| Applications | 9 | Describe account and group schemas, correlation options, aggregation task options, connector rules and Rapid Setup |
| Identity Modeling | 6 | List what IdentityCubes contain, contrast identity and account attributes, explain manager correlation and Identity Refresh |
| Access Modeling | 5 | Describe the entitlement catalog, compare business and IT roles, describe how identities obtain roles |
| Governance | 4 | Identify certification phases, describe how certifications start, identify common policies and policy detection |
| User-Driven Requests | 4 | Understand QuickLink Populations, request types, the access request process and identity requests |
| Provisioning | 6 | Define provisioning, list the actions that trigger it, explain provisioning policies, Lifecycle Events and attribute synchronization |
That is 41 objectives in total. An objective count is not a weighting, and you should not read it as one. Still, Applications carries nine objectives and Governance carries four, so Applications simply has more to learn.
Notice the verbs as well. Almost every objective begins with describe, explain, identify or compare. None asks you to write a rule or build a workflow. The Associate exam tests whether you understand what IdentityIQ does and why, which matches a credential tied to introductory and essentials training.
How do applications, identities and roles fit together?
In IdentityIQ, an application represents a connected system, aggregation reads its accounts, correlation attaches each account to an identity, and the resulting IdentityCube holds what that person has. Entitlements are then catalogued and grouped into roles. Three of the seven IdentityIQ Associate topics follow this chain, so learning it as one flow saves time.
Applications: where the data comes in
The Applications topic has the most objectives because everything else depends on it. You need to know the difference between account and group schema types, which settings depend on the connector you choose, and which task options affect aggregation. You also need the process for resolving uncorrelated accounts, which are accounts IdentityIQ has read but cannot yet match to a person.
One sample statement suggests that running an identity refresh resolves an uncorrelated account. It does not, and the item exists because the two ideas are easy to blur. The product’s own IdentityIQ product documentation has separate chapters for application configuration, correlation and the entitlement catalog, and reading them in that order mirrors the syllabus.
Identity Modeling: the cube and its attributes
Here the syllabus asks you to contrast an identity attribute with an account attribute. An account attribute belongs to one account on one application. An identity attribute belongs to the person. Manager correlation sits in this topic too, and it commonly uses manager information from an authoritative application to link each identity to the correct manager.
Access Modeling: entitlements and two kinds of role
Marking an account schema attribute as managed lets its values be governed as entitlements, so they can be catalogued, requested and reviewed. Roles sit above that. The syllabus asks you to compare business and IT roles and to describe how identities obtain them, and the sample items test both points directly.
The idea is older than the product. Role based access control was formalised in 1992 by David Ferraiolo and Rick Kuhn at NIST, and the NIST model was adopted as an American national standard in 2004. IdentityIQ applies that thinking at enterprise scale, which is why the role questions reward understanding over memorised definitions.
What do governance, requests and provisioning add?
Governance, User-Driven Requests and Provisioning cover what happens after access is modelled. Governance reviews and polices existing access, User-Driven Requests lets people ask for change, and Provisioning carries approved change out to target systems. Together they hold 14 of the 41 IdentityIQ Associate objectives and describe the daily work of an identity team.
Governance
You must identify the certification phases and what occurs in each, and describe the many ways a certification can be initiated. In IdentityIQ a certification is an access review, not an exam, and the double meaning catches newcomers. Policies complete the topic: know examples of common policies and how violations are detected. SailPoint’s explainer on identity governance and administration gives the wider context.
User-Driven Requests
QuickLink Populations control who can request what for whom. That phrase comes straight from the syllabus, and it is the core of the topic. Being shown a request QuickLink does not grant the access requested through it. Approval and provisioning still have to happen.
Provisioning
Six objectives sit here: define provisioning, list the IdentityIQ actions that trigger it, describe provisioning policies, summarise the process, and explain Lifecycle Events and attribute synchronization. Lifecycle Events matter most in practice, because they turn a change in a person’s status into a change in access without anyone raising a request.
All three topics serve one aim, which the NIST identity program states plainly.
“Identity and Access Management is a fundamental and critical cybersecurity capability. Simply put, with its focus on foundational and applied research and standards, NIST seeks to ensure the right people and things have the right access to the right resources at the right time.”
Keep that sentence in mind when a statement looks unfamiliar. If a described behaviour would give someone access without a review, a request or a policy behind it, the statement is probably false.
IdentityIQ Associate or IdentityIQ Engineer?
The IdentityIQ Associate exam costs 300 USD and has 43 questions, while the IdentityIQ Engineer exam costs 400 USD and has 66. Both run for 90 minutes, both are reported as Pass or Fail, and both enrolments give two attempts within 364 days. The difference is scope: the Associate tests understanding, the Engineer tests implementation.
| Feature | IdentityIQ Associate | IdentityIQ Engineer |
|---|---|---|
| Fee | 300 USD | 400 USD |
| Questions | 43 | 66 |
| Duration | 90 minutes | 90 minutes |
| Result | Pass or Fail | Pass or Fail |
| Attempts and window | 2 attempts in 364 days | 2 attempts in 364 days |
| Focus | Concepts, applications, identity and access modelling, governance, requests, provisioning | Installation, build and deployment, Lifecycle Manager, custom development, application onboarding, troubleshooting |
The pace differs sharply. The Engineer exam fits 66 questions into the same 90 minutes, which is about 82 seconds each against roughly 126 seconds on the Associate. The Engineer also expects custom development and debugging, neither of which appears in the Associate syllabus.
SailPoint’s certification program page lists both IdentityIQ exams beside its cloud certifications, and it also describes a recertification program for keeping a certification active. If your employer runs IdentityIQ on its own infrastructure, the Associate is the natural first step.
If your organisation has moved to Identity Security Cloud, the cloud track fits better. This site’s guide to the Identity Security Engineer exam covers that route, which costs 400 USD and runs to 73 questions in 120 minutes.
How should you prepare inside the enrolment window?
Prepare for the IdentityIQ Associate exam before you register, so that the 364 day window is spent on sitting the exam and not on starting to study. Learn the seven topics in data flow order, practise judging single statements, take the first attempt early, and keep enough of the window free for a second attempt.
- Study the seven topics before you pay, because registration starts the 364 day clock.
- Work through Applications first, since aggregation and correlation feed every later topic.
- Follow one identity through Identity Modeling and Access Modeling until you can explain how it obtains a role.
- Cover Governance, User-Driven Requests and Provisioning together as the three ways access is reviewed, requested and delivered.
- Practise on yes or no statements and write down why each false statement is false.
- Register and schedule the first attempt early in the window, leaving months and not weeks for a second.
- Use a Not Complete result to list the topics that felt uncertain, restudy them, then sit the second attempt.
Hands-on time beats rereading
SailPoint recommends a year of hands-on experience for a reason. Statements about aggregation options or certification phases are far easier to judge when you have run an aggregation task and completed an access review yourself. If you have access to a test environment at work, use it for every topic you can.
Keep a wrong statement log
Because each item is a single statement, your errors fall into patterns. You may keep confusing identity refresh with correlation, or business roles with IT roles. A short log of the statements you misjudged, with one line on the correct behaviour, is the most useful revision document you can build.
Frequently Asked Questions
How many questions are on the SailPoint IdentityIQ Associate exam?
The exam has 43 questions and a 90 minute time limit, which gives you just over two minutes per question.
What is the passing score for the IdentityIQ Associate exam?
The result is reported as Pass or Fail. No percentage or cut score is published, so any figure you see quoted elsewhere is not an official one.
How much does SailPoint IdentityIQ certification cost at Associate level?
The SailPoint Certified IdentityIQ Associate enrolment costs 300 USD, and that price includes two attempts.
How long do I have to take the exam after registering?
You have 364 days from registration to schedule and take the exam. Both attempts must fall inside that window.
What happens if I fail the first attempt?
Your status shows Not Complete until you take the second attempt. After the second attempt it changes to Passed or Not Passed.
Which topics does the IdentityIQ Associate exam cover?
Seven topics: Foundational Concepts, Applications, Identity Modeling, Access Modeling, Governance, User-Driven Requests, and Provisioning. No weightings are published.
Is experience required before the IdentityIQ Associate exam?
SailPoint recommends one year of hands-on experience. It is a recommendation, and the exam is described as the final exam for the IdentityIQ Introduction and IdentityIQ Essentials courses.
Which IdentityIQ version does the exam target?
Neither the syllabus nor the SailPoint exam page names a product version for the exam, so none is stated here. Check the exam prep guide in your SailPoint account before you study version-specific features.
Is the IdentityIQ Associate exam harder than the IdentityIQ Engineer exam?
The Engineer exam is broader and faster, with 66 questions in 90 minutes and topics such as custom development and troubleshooting. The Associate has 43 questions in the same time and tests understanding.
Conclusion
The SailPoint Certified IdentityIQ Associate exam is 43 questions in 90 minutes with a Pass or Fail result, and the rule that shapes everything else is the enrolment: two attempts, 364 days, 300 USD. Register when you are nearly ready, not when you begin.
The seven topics make most sense as one flow. Applications bring accounts in, identities and roles give them meaning, and governance, requests and provisioning keep access correct afterwards. Learn that chain and the single statement questions become much easier to judge.
Sit the first attempt early enough that the second is a real option. Then read a set of sample statements, note every one you misjudge, and let that list decide what you study next.
