Important CrowdStrike IDP Exam Questions

Answer: C

Explanation:

Falcon Fusion workflows integrate directly with Falcon Identity Protection through identity-based triggers, allowing automated responses to identity threats. The correct trigger that activates a Falcon Fusion workflow from Identity Protection is Alert > Identity detection.

Identity detections are generated when Falcon observes suspicious or malicious identity behavior, such as credential abuse, abnormal authentication patterns, lateral movement attempts, or policy violations related to identity risk. These detections are distinct from endpoint-only detections or incidents and are specifically designed to represent identity-based attack activity.

While New incident and New endpoint detection are valid Falcon Fusion triggers in other Falcon modules, they are not the primary triggers for identity-focused automation. Similarly, Spotlight user action > Host relates to vulnerability management workflows rather than identity analytics.

The CCIS curriculum emphasizes that Falcon Fusion enables automated identity response, such as notifying security teams, disabling accounts, enforcing MFA, or triggering SOAR actions, based on identity detections. Therefore, workflows tied to Alert > Identity detection allow organizations to respond quickly and consistently to identity threats, making Option C the correct answer.

Answer: A

Explanation:

Falcon Identity Protection integrates with a defined set of supported MFA providers to enforce identity verification and conditional access based on identity risk. According to the CCIS curriculum, supported MFA providers include Azure (Entra) MFA, Cisco Duo, and Symantec VIP, which are commonly used enterprise-grade MFA solutions.

These integrations allow Falcon Identity Protection to evaluate authentication attempts and dynamically enforce MFA challenges when risky behavior is detected. The supported providers expose the necessary APIs and authentication workflows required for Falcon to trigger MFA challenges as part of Policy Rules and Zero Trust enforcement.

Firebase is not a supported MFA provider within Falcon Identity Protection. Firebase is primarily a mobile and application development platform and does not function as an enterprise MFA provider compatible with Falcon's identity enforcement model. As such, it cannot be used to enforce conditional access or identity verification through Falcon Identity Protection.

Because Falcon only supports specific, enterprise MFA integrations validated by CrowdStrike, Option A is the correct and verified answer.

Answer: D

Explanation:

Falcon Identity Threat Detection (ITD) provides visibility, analytics, and detection of identity-based threats but does not include enforcement capabilities. According to the CCIS curriculum, ITD customers have access to investigative and analytical features such as Event Analysis, Privileged Identities, and relevant Settings for visibility and monitoring.

Policy Rules, however, are part of Identity Threat Protection (ITP) and reside in the Enforce section of the Falcon console. Policy Rules enable automated responses and enforcement actions, such as blocking access or enforcing MFA, which are not available under ITD-only subscriptions.

This distinction is critical in the CCIS material:

ITD = Detect and analyze identity threats

ITP = Detect + enforce policy actions

Because ITD does not include enforcement functionality, Policy Rules are not available, making Option D the correct answer.

Answer: B

Explanation:

In Falcon Identity Protection, the three-dot () action menu on an identity-based detection provides analysts with a limited set of actions that apply directly to the detection itself. According to the CCIS curriculum, these actions are designed to support investigation workflow, tuning, and documentation.

The supported actions in the detection-level three-dot menu include:

Edit status, which allows analysts to update the detection state (for example, New, In Progress, or Closed).

Add comment, which enables collaboration and documentation directly on the detection.

Add exclusion, where supported, to suppress future detections that match known benign behavior.

Add to Watchlist is not included in this menu because watchlists are applied to entities (such as users, service accounts, or endpoints), not to detections. Watchlists are managed from entity views or investigation workflows and are used to increase visibility and monitoring priority for specific identities---not to act on individual detections.

This distinction is emphasized in CCIS training to reinforce the separation between entity-centric actions and detection-centric actions. Because watchlists operate at the entity level, Option B is the correct and verified answer.

Answer: C

Explanation:

In Falcon Identity Protection, the 'Guest Account Enabled' risk highlights the presence of local or domain guest accounts that remain active across endpoints. Guest accounts are inherently high-risk because they typically lack strong authentication controls, are rarely monitored, and are frequently abused by attackers for lateral movement and persistence.

The CCIS curriculum explicitly recommends disabling Guest accounts on all endpoints as the primary remediation action. This is because guest accounts often bypass standard identity governance processes and violate the principles of least privilege and Zero Trust, both of which are foundational to Falcon Identity Protection's security model. Disabling these accounts removes an unnecessary and dangerous authentication path from the environment.

Other options are incorrect because:

Adding endpoints to a watchlist does not remediate the risk.

Blocking access via a policy rule is less effective than eliminating the account entirely.

Disabling endpoints in Active Directory does not directly address the guest account exposure.

Falcon Identity Protection prioritizes elimination of weak identity configurations, and disabling guest accounts is a direct, effective action that immediately lowers identity risk scores and reduces attack surface. Therefore, Option C is the correct and verified answer.