Important CrowdStrike IDP Exam Questions

Answer: C

Explanation:

Falcon Fusion workflows integrate directly with Falcon Identity Protection through identity-based triggers, allowing automated responses to identity threats. The correct trigger that activates a Falcon Fusion workflow from Identity Protection is Alert > Identity detection.

Identity detections are generated when Falcon observes suspicious or malicious identity behavior, such as credential abuse, abnormal authentication patterns, lateral movement attempts, or policy violations related to identity risk. These detections are distinct from endpoint-only detections or incidents and are specifically designed to represent identity-based attack activity.

While New incident and New endpoint detection are valid Falcon Fusion triggers in other Falcon modules, they are not the primary triggers for identity-focused automation. Similarly, Spotlight user action > Host relates to vulnerability management workflows rather than identity analytics.

The CCIS curriculum emphasizes that Falcon Fusion enables automated identity response, such as notifying security teams, disabling accounts, enforcing MFA, or triggering SOAR actions, based on identity detections. Therefore, workflows tied to Alert > Identity detection allow organizations to respond quickly and consistently to identity threats, making Option C the correct answer.

Answer: C

Explanation:

In Falcon Identity Protection, the 'Guest Account Enabled' risk highlights the presence of local or domain guest accounts that remain active across endpoints. Guest accounts are inherently high-risk because they typically lack strong authentication controls, are rarely monitored, and are frequently abused by attackers for lateral movement and persistence.

The CCIS curriculum explicitly recommends disabling Guest accounts on all endpoints as the primary remediation action. This is because guest accounts often bypass standard identity governance processes and violate the principles of least privilege and Zero Trust, both of which are foundational to Falcon Identity Protection's security model. Disabling these accounts removes an unnecessary and dangerous authentication path from the environment.

Other options are incorrect because:

Adding endpoints to a watchlist does not remediate the risk.

Blocking access via a policy rule is less effective than eliminating the account entirely.

Disabling endpoints in Active Directory does not directly address the guest account exposure.

Falcon Identity Protection prioritizes elimination of weak identity configurations, and disabling guest accounts is a direct, effective action that immediately lowers identity risk scores and reduces attack surface. Therefore, Option C is the correct and verified answer.

Answer: B

Explanation:

Falcon Identity Protection identifies stale endpoints as systems that have not authenticated or shown activity for an extended period and then suddenly become active. According to the CCIS curriculum, an endpoint that has been inactive for 90 days and then resumes activity will trigger a Use of Stale Endpoint detection.

This detection is important because attackers frequently exploit dormant or forgotten systems to re-enter environments, evade monitoring, or move laterally. A long period of inactivity followed by sudden authentication activity is considered a strong identity risk signal.

The 90-day threshold is used to establish a reliable inactivity baseline while minimizing false positives. Shorter timeframes could incorrectly flag normal usage patterns, while longer timeframes could delay detection of genuine threats.

Because Falcon explicitly defines stale endpoint activity using a 90-day inactivity window, Option B is the correct answer.

Answer: D

Explanation:

In CrowdStrike Falcon Identity Protection, the Risk tab within a user or account entity provides administrators with direct visibility into why an account has a specific risk score and what actions can be taken to reduce that score. This functionality is a core component of the User Assessment and Risk Assessment sections of the CCIS (CrowdStrike Identity Specialist) curriculum.

The Risk tab aggregates both analysis-based risks and detection-based risks, clearly identifying contributing factors such as compromised passwords, excessive privileges, risky authentication behavior, stale or never-used accounts, and policy violations. It also highlights the severity, likelihood, and consequence of each risk factor, allowing administrators to prioritize remediation efforts effectively. Most importantly, this tab provides actionable guidance, enabling teams to understand which specific remediation steps---such as enforcing MFA, resetting credentials, reducing privileges, or disabling unused accounts---will directly lower the account's overall risk score.

Other entity tabs do not provide this capability. The Timeline tab focuses on chronological events and detections, the Activity tab displays authentication and behavioral activity, and the Asset tab shows associated endpoints and resources. Only the Risk tab is designed to explain risk drivers and guide remediation, making Option D the correct and verified answer.

Answer: D

Explanation:

To interact with Falcon Identity Protection using GraphQL, the API client must be created with the appropriate permission scopes. According to the CCIS curriculum, the Identity Protection GraphQL scope with Write permissions must be enabled prior to using the Identity Protection API.

This scope allows the API client to execute GraphQL queries and mutations related to identity detections, incidents, users, and risk data. Even when performing read-only operations, CrowdStrike requires the GraphQL Write scope to authorize GraphQL query execution within the Falcon platform.

The other options are incorrect because:

Identity Protection Assessment and Health are read-only data scopes.

The statement that Write permissions are not required is explicitly false per CCIS documentation.

Because GraphQL access requires the Identity Protection GraphQL (Write) scope, Option D is the correct and verified answer.