CrowdStrike Certified Identity Specialist (CCIS) 1 IDP Practice Test Questions and Certification Success Tips CrowdStrike Certification The - https://bit.ly/4uVrhoM - CrowdStrike Identity Specialist Certification validates the knowledge and skills required to implement, manage, and optimize CrowdStrike identity protection solutions. This certification demonstrates expertise in securing user identities, detecting and responding to identity-based threats, configuring access controls, monitoring authentication activities, and protecting organizations from credential compromise. Vmexam.com CrowdStrike Certified Identity Specialist (CCIS) 1 IDP Practice Test IDP is CrowdStrike Identity Specialist Certification offered by the CrowdStrike. Since you want to comprehend the IDP Question Bank, I am assuming you are already in the manner of preparation for your IDP Certification Exam. To prepare for the actual exam, all you need is to study the content of this exam questions. You can recognize the weak area with our premium IDP practice exams and help you to provide more focus on each syllabus topic covered. This method will help you to increase your confidence to pass the CrowdStrike Identity Specialist certification with a better score. CrowdStrike Certified Identity Specialist (CCIS) 2 IDP Exam Details Exam Name CrowdStrike Identity Specialist Exam Code IDP Exam Price $250 USD Duration 90 minutes Number of Questions 60 Passing Score 80% Recommended Training / Books CCIS Training Schedule Exam PEARSON VUE Sample Questions CrowdStrike CCIS Sample Questions Recommended Practice CrowdStrike Certified Identity Specialist (CCIS) Practice Test IDP Exam Syllabus Section Objectives Zero Trust Architecture - Describe what the NIST SP 800-207 framework for Zero Trust architecture defines - Describe the security need and impetus for the Zero Trust architecture - Describe the implementation of the Zero Trust architecture within Falcon Identity Protection - Describe the fundamental principles of Zero Trust (continuous validation, etc.) - Describe the difference between a traditional "wall-and-moat" security model and a modern Zero Trust model - Describe some of the key use cases for Falcon Zero Trust - Describe how a Falcon user's Zero Trust Assessment (ZTA) score is calculated Identity Protection Tenets - Describe the identity protection architecture employed at CrowdStrike as a part of the Falcon Identity Protection module - Describe how Falcon Identity Protection inspects traffic in the domain - Describe how Falcon Identity Protection complements traditional EDR solutions - Describe how Falcon Identity Protection helps secure against the human elements of security vulnerability - Describe how Falcon Identity Protection empowers the team to mitigate and prevent identity based exploits and attacks - Identify key differences between Falcon Identity Protection CrowdStrike Certified Identity Specialist (CCIS) 3 Section Objectives log-free detections and traditional EDR solutions - Describe the threat landscape and the need for identity-based security solutions Falcon Identity Protection Fundamentals - Identify the menu categories (monitor, enforce, explore and configure) of Falcon Identity Protection - Describe the contents of each menu category (monitor, enforce, explore and configure) within Falcon Identity Protection - Identify the goal of each menu category (monitor, enforce, explore and configure) - Recognize the availability of specific tools limited by product subscription for Identity Threat Detection vs. Identity Threat Protection (ITD vs. ITP) - Describe the purpose of Falcon Identity Protection in general security terms - Explain how Falcon Identity Protection works to mitigate threats that bypass traditional MITRE ATT&CK framework vectors - Describe the Falcon roles working within Falcon Identity Protection and the features available to those roles Domain Security Assessment - Explain what the Risk Score represents in the domain - Describe how the Score Trend is represented and how to affect the score - Explain the Risk Matrix and how risks are represented - Describe how to lower the domain risk score - Explain and describe how to prioritize addressing risks in the domains - Describe where Falcon Identity Protection fits in the security model - Explain the factors that contribute to the domain risk scores - Describe what "Severity," "Likelihood" and "Consequence" mean in terms of potential risk factors related to identity - Define the goals in the Domain Security overview and how they relate to identity protection outcomes - Describe how to change the "Goal" and what each goal in the domain security overview is geared toward - Describe how to change "Scope" and what that does for the Overview dashboard Risk Assessment - Describe the categories of entity risk (low, medium, high) and their thresholds - Demonstrate how to move a user from higher to lower risk - Describe the elements that contribute to higher Risk Scores - Explain the Risk Analysis dashboard - Explain the Event Analysis dashboard CrowdStrike Certified Identity Specialist (CCIS) 4 Section Objectives - Apply filters for targeted risk analysis - Explain how to generate custom insights with filters - Describe how to create a custom report - Explain the difference of when one creates a custom insight versus a custom report - Describe how to export and schedule custom reports User Assessment - Describe the attributes and data points associated with users in Falcon Identity Protection - Explain the difference between a user, an endpoint and an entity - Describe the difference between human and programmatic accounts - Describe the icons and their meaning when identifying users - Explain what the default insights do in the Users view - Explain how to create custom filters in the Users view - Describe how high-risk users are baselined - Explain the risk baselining process and various timelines needed for accurate baselines - Describe the various risky types of accounts (stale, never logged in, compromised password, etc.) and the risks they pose - Explain how to add custom lists to the Compromised Password directory - Explain what risks users with elevated privileges pose and how to assess those users - Explain the user watchlist and honeytoken accounts - Describe the use cases for a honeytoken account Threat Hunting and Investigation - Describe an identity-based detection - Describe an identity-based incident - Describe the investigation pivots available from an identity- based incident - Explain the difference between an identity-based incident and detection - Describe how to pivot to related entities - Explain how to navigate an identity-based incident tree - Describe the evolution of an incident over time as more detections accumulate - Describe the information contained in the different types of identity-based detections - Explain the key information highlighted in various detections - Describe how to filter and search for detections - Demonstrate how to investigate the history of an incident and potential incident type changes - Explain how to enable/disable detection exclusions CrowdStrike Certified Identity Specialist (CCIS) 5 Section Objectives - Describe how to add exceptions to detection exclusions - Describe the logic behind detection exclusions - Describe the use cases for enabling or disabling detection types - Describe the difference between a detection-based risk and an analysis-based risk Risk Management with Policy Rules - Describe the purpose of policy rules and policy groups - Demonstrate the policy rule creation process - Explain the purpose of the various triggers and conditions within a policy rule - Explain how to enable and disable policy rules - Explain how to group, ungroup and manage groups of rules - Describe how to apply any changes made to policy rules - Describe the Falcon role(s) necessary to write and manage policy rules Configuration and Connectors - Describe how to monitor the domain controllers (DCs) in the domain (visibility into the DCs reporting and endpoints per DC) - Describe how to create and manage subnets - Explain how to enforce policy rules using subnets - Explain the risk configuration settings - Describe how to add exceptions to risk configurations - Explain the two types of connectors (MFA, IDaaS) - Explain the two types of MFA connectors (Cloud MFA, On- Premises RADIUS MFA) - Identify the supported MFA and IDaaS connectors - Describe where to find connector setup documentation - Describe how to enable authentication traffic inspection (ATI) on DCs in the domain - Describe the available configuration options within Falcon Identity Protection policies as it relates to data captured by the Falcon sensor - Describe what business privileges are, and how they impact entities - Explain how configured blocklisted/allowlisted countries impact detections Multifactor Authentication (MFA) and Identity-as-a- service (IDaaS) Configuration Basics - Explain how to access the IDaaS and MFA configuration settings - Explain the configuration fields associated with the various connectors - Describe how to configure the settings for MFA connectors - Describe how to enable third-party MFA for Falcon Identity Protection - Describe how Falcon Identity Protection extends on capabilities of existing MFA providers and does not intend to CrowdStrike Certified Identity Specialist (CCIS) 6 Section Objectives replace it Falcon Fusion SOAR for Identity Protection - Describe the building blocks of a Falcon Fusion SOAR workflow - Explain how to define triggers - Explain how to add conditions - Explain what various conditions do and how to combine them to limit the scope of a workflow - Describe how to create custom, templated, scheduled and on-demand workflows - Describe how to create branching workflows and loops - Create workflows in Falcon Fusion SOAR to accomplish specific goals GraphQL API - Describe where you can find Identity API (GraphQL) documentation - Create an API key specific to Falcon Identity Protection - Describe the differences between the different Falcon Identity Protection API permissions - Pivot from a Threat Hunter search into GraphQL - Build a simple query that returns all privileged users with high risk IDP Questions and Answers Set 01. A Fusion SOAR condition block evaluates a defined parameter and routes the workflow only if the condition evaluates to _____. a) high b) true c) integer d) null Answer: b CrowdStrike Certified Identity Specialist (CCIS) 7 02. In Falcon Identity Protection, a _____ account is one created to serve as a trap, triggering alerts if it is accessed or queried. a) stale b) federated c) honeytoken d) external Answer: c 03. How does Falcon Identity Protection differentiate between “ Identity Threat Detection ” (ITD) and “ Identity Threat Protection ” (ITP)? a) ITD is focused on email filtering, while ITP blocks USB access b) ITD provides detection only, whereas ITP includes active policy enforcement c) ITD manages MFA settings, ITP handles only cloud connectors d) ITD is limited to cloud identities, ITP handles on-premises accounts Answer: b 04. How are honeytoken accounts typically used in Falcon Identity Protection? a) To store backup configurations b) To reset user passwords automatically c) To sync account settings across domains d) To serve as decoys for detecting identity-based attacks Answer: d 05. What advantage does GraphQL offer over traditional REST APIs for identity queries in Falcon? a) It provides encrypted DNS tunneling b) It allows clients to retrieve only the exact data fields required c) It requires fewer user permissions d) It automatically corrects syntax errors Answer: b CrowdStrike Certified Identity Specialist (CCIS) 8 06. What two insights can be gained from adjusting the “ Goals ” in the Domain Security overview? (Choose two) a) Customization of risk prioritization for business context b) Alert threshold tuning for antivirus c) Visual benchmarks against security maturity objectives d) Determining daily login hours per user Answer: a, c 07. What is a key architectural advantage of Falcon Identity Protection over traditional endpoint detection and response (EDR) solutions? a) It only monitors Windows endpoints in isolation b) It relies entirely on signature-based detection c) It requires no configuration for policy enforcement d) It observes domain controller traffic for identity signals Answer: d 08. Which two authentication control methods are supported for third- party integrations in Falcon Identity Protection? (Choose two) a) Conditional risk-based MFA b) Static port blocking c) RADIUS-based enforcement d) Biometric hardware filtering Answer: a, c 09. Which permission must be enabled on an API key to query privileged user risk data in Falcon Identity Protection? a) “ Detection Write ” b) “ Identity Protection Read ” c) “ Sensor Control ” d) “ Report Generation Only ” Answer: b CrowdStrike Certified Identity Specialist (CCIS) 9 10. Where can you access the configuration settings for MFA and IDaaS connectors in Falcon Identity Protection? a) Under the “ Monitor ” tab b) In the "Explore" menu c) Within the “ Configure ” section of the platform d) Through Falcon ’ s external API only Answer: c Full Online Practice of IDP Certification VMExam.com is one of the world ’ s leading certifications, Online Practice Test providers. We partner with companies and individuals to address their requirements, rendering Mock Tests and Question Bank that encourages working professionals to attain their career goals. You can recognize the weak area with our premium IDP practice exams and help you to provide more focus on each syllabus topic covered. Start Online practice of IDP Exam by visiting URL https://www.vmexam.com/crowdstrike/idp-crowdstrike-identity- specialist