P.S. Free & New IDP dumps are available on Google Drive shared by Itcertkey: https://drive.google.com/open?id=1xVFTG7Pazedw4Mh64ozuRrgweyw7aeKY
Our IDP learning questions engage our working staff in understanding customers’ diverse and evolving expectations and incorporate that understanding into our strategies, thus you can 100% trust our IDP exam engine. And our professional IDP Study Materials determine the high pass rate. According to the research statistics, we can confidently tell that 99% candidates after using our products have passed the IDP exam.
| Section | Objectives |
|---|---|
| Topic 1: Risk Assessment & Management | - Domain Security Assessment - Risk Management with Policy Rules - User Assessment - Risk Assessment |
| Topic 2: Identity Protection Fundamentals & Zero Trust | - Falcon Identity Protection Fundamentals - Identity Protection Tenets - Zero Trust Architecture |
| Topic 3: Operations & Integration | - Falcon Fusion for Identity Protection - GraphQL API - MFA and IDaaS Configuration Basics - Threat Hunting and Investigation - Configuration and Connectors |
This is a simple and portable document of real CrowdStrike IDP Exam Questions. It contains actual CrowdStrike IDP exam questions and answers and can be helpful for quick revision or for studying on the go. It is also printable so you can easily study on a hard copy of the pdf having a break from staring.
NEW QUESTION # 22
Can a specific detection be excluded altogether or just per entity?
Answer: A
Explanation:
Falcon Identity Protection provides flexible control over how identity-based detections are handled through the Detection Exclusionsframework. According to the CCIS curriculum, administrators can eitherdisable an entire detection typeor, where supported,exclude specific entitiessuch as users, service accounts, or endpoints from triggering that detection.
Not all detections support entity-level exclusions. For detections that do, exclusions allow organizations to suppress known benign behavior without disabling the detection globally. This is particularly useful for service accounts or legacy systems that generate expected but non-malicious activity. When entity-level exclusion is not supported, administrators may choose todisable the detection entirely, which stops it from generating alerts across the environment.
The CCIS documentation clearly explains this dual model:
* All detections can be disabled, regardless of type
* Only some detections support entity-based exclusions
This approach balances operational flexibility with security integrity and avoids the misconception that exclusions automatically create security gaps. Therefore,Option Cis the correct and verified answer.
NEW QUESTION # 23
Which of the following actions under the Investigate menu will pivot to Falcon Identity Protection from an identity-based detection?
Answer: B
Explanation:
Falcon Identity Protection integrates directly withThreat Hunterto enable deeper investigation of identity- based activity. According to the CCIS curriculum, selectingSearch for involved entities in Threat Hunter allows analysts to pivot from an identity-based detection into Threat Hunter while preserving identity context.
This pivot enables analysts to examine related users, service accounts, endpoints, and authentication behavior using advanced queries and timelines. Importantly, this action maintains the identity-centric investigation flow, bridging detections with broader hunting capabilities.
The other options do not perform this specific pivot:
* Investigating users or endpoints remains within entity views.
* Searching for events in Threat Hunter does not preserve entity context.
BecauseSearch for involved entities in Threat Hunteris the correct pivot action,Option Bis the verified answer.
NEW QUESTION # 24
By using compromised credentials, threat actors are able to bypass theExecutionphase of the MITRE ATT&CK framework and move directly into:
Answer: C
Explanation:
The CCIS curriculum highlights a critical identity-security concept: when attackers usecompromised credentials, they often bypass traditional malware-based attack phases, including theExecutionphase of the MITRE ATT&CK framework. Because no malicious code needs to be executed, attackers can immediately begin interacting with the environment as a legitimate user.
As a result, threat actors move directly into theDiscoveryphase. During Discovery, attackers enumerate users, groups, privileges, systems, domain relationships, and trust paths to understand the environment and plan further actions. This behavior is commonly observed in identity-based attacks and living-off-the-land techniques.
Falcon Identity Protection is specifically designed to detect this behavior by monitoring authentication traffic, privilege usage, and anomalous identity activity-areas where traditional EDR tools may have limited visibility.
The other options are incorrect:
* Initial Access has already occurred via credential compromise.
* Weaponization and Execution are not required.
* Lateral Movement typically follows Discovery.
Because compromised credentials allow attackers to jump straight intoDiscovery,Option Cis the correct and verified answer.
NEW QUESTION # 25
How many days will an identity-based incident be suppressed if new events related to the same incident occur?
Answer: C
Explanation:
Falcon Identity Protection usesincident suppression windowsto prevent alert fatigue while still maintaining accurate incident tracking. According to the CCIS documentation, whennew events related to an existing identity-based incident occur, the incident issuppressed for 5 days.
This suppression means that Falcon does not generate a new incident for the same activity during this window. Instead, additional detections areadded to the existing incident, allowing analysts to view the full progression of the threat in a single investigative context.
The 5-day suppression window ensures that ongoing identity attacks-such as repeated authentication abuse or lateral movement-are consolidated rather than fragmented across multiple incidents. This improves investigation efficiency and aligns with Falcon's incident lifecycle management approach.
Because the suppression period is fixed at5 days,Option Dis the correct and verified answer.
NEW QUESTION # 26
The configuration of the Azure AD (Entra ID) Identity-as-a-Service connector requires which three pieces of information?
Answer: B
Explanation:
To integrate Falcon Identity Protection withAzure AD (Entra ID)as an Identity-as-a-Service (IDaaS) provider, specific application-level credentials are required. According to the CCIS curriculum, the connector configuration requiresTenant Domain,Application (Client) ID, andApplication Secret.
These values are generated when registering an application in Azure AD and are used to authenticate Falcon Identity Protection securely via OAuth-based API access. This method ensures least-privilege access and allows the connector to ingest cloud authentication activity and apply SSO-related policy enforcement.
Other options list incomplete or incorrect credential combinations. Therefore,Option Dis the correct and verified answer.
NEW QUESTION # 27
......
Our IDP simulating exam is perfect for they come a long way on their quality. On one hand, we have engaged in this career for over ten years and have become the leader in this market. On the other hand, we never stop developing our IDP study guide. And our IDP Training Materials have the function to remember and correct your errors. If you commit any errors, Our IDP learning questions can correct your errors with accuracy rate more than 98 percent.
IDP Reliable Test Preparation: https://www.itcertkey.com/IDP_braindumps.html
P.S. Free & New IDP dumps are available on Google Drive shared by Itcertkey: https://drive.google.com/open?id=1xVFTG7Pazedw4Mh64ozuRrgweyw7aeKY