Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Which of the following demonstrates a detection is enabled?
In Falcon Identity Protection, detection status is visually indicated using a toggle control within the detection configuration interface. According to the CCIS documentation, when a detection is enabled, the toggle next to Detection Enabled is displayed in green.
A green toggle indicates that the detection logic is active and that Falcon will generate detections when the defined conditions are met. When the toggle is gray, the detection is disabled and will not generate alerts or contribute to incident formation.
Falcon does not rely on textual ''Enabled'' or ''Disabled'' tags to indicate detection status. Instead, the toggle color provides a clear, immediate visual indicator to administrators.
Because a green toggle explicitly represents an enabled detection, Option B is the correct and verified answer.
Which option can be selected from the Threat Hunter menu to open the current Threat Hunter query in a new window as Graph API format?
Falcon Threat Hunter provides a direct integration with the API Builder to support advanced investigation workflows and automation. According to the CCIS curriculum, analysts can take an existing Threat Hunter query and convert it into a GraphQL-compatible format by selecting Open Query in API Builder from the Threat Hunter menu.
This option opens the current query in a new window within API Builder, automatically translating the query structure into GraphQL syntax where applicable. This enables security teams to reuse validated hunting logic for automation, reporting, or external integrations without rewriting queries from scratch.
The other menu options serve different purposes:
Export to API Builder is not a valid menu action.
Save as Custom Query stores the query for reuse inside Threat Hunter.
Save as Custom Report generates a reporting artifact, not an API query.
Because Open Query in API Builder is the only option that opens the query in GraphQL format in a new window, Option D is the correct and verified answer.
Which of the following is NOT a default insight but can be created with a custom insight?
In Falcon Identity Protection, default insights are prebuilt analytical views provided by CrowdStrike to immediately highlight common and high-impact identity risks across the environment. These default insights are automatically available in the Risk Analysis and Insights areas and are designed to surface well-known identity exposure patterns without requiring customization.
Examples of default insights include Using Unmanaged Endpoints, GPO Exposed Password, and Compromised Password. These insights are natively provided because they represent frequent and high-risk identity attack vectors such as credential exposure, unmanaged authentication sources, and password compromise, all of which directly contribute to elevated identity risk scores.
Poorly Protected Accounts with SPN (Service Principal Name), however, is not provided as a default insight. While Falcon Identity Protection does collect and analyze SPN-related risk signals---such as Kerberoasting exposure and weak service account protections---this specific grouping must be created by administrators using custom insight filters. Custom insights allow teams to define precise conditions, combine attributes (privilege level, SPN presence, password age, MFA status), and tailor risk visibility to their organization's threat model.
This distinction is emphasized in the CCIS curriculum, which explains that custom insights extend beyond default coverage, enabling deeper, organization-specific identity risk analysis. Therefore, Option D is the correct answer.
What does a modern Zero Trust security architecture offer compared to a traditional wall-and-moat (perimeter-based firewall) approach?
A modern Zero Trust security architecture fundamentally differs from the traditional wall-and-moat model by eliminating implicit trust based on network location. As defined in NIST SP 800-207 and reinforced in the CCIS curriculum, Zero Trust requires continuous authentication and authorization of all entities, regardless of whether they originate from inside or outside the network.
Traditional perimeter-based security assumes that users and devices inside the network are trusted, focusing defenses at the boundary. This approach fails in modern environments where cloud access, remote work, and compromised credentials allow attackers to operate internally without triggering perimeter controls.
Zero Trust replaces this assumption with continuous validation using identity, behavior, device posture, and risk signals. Falcon Identity Protection operationalizes this concept by continuously inspecting authentication traffic and reassessing trust throughout a session, not just at login time.
Because Zero Trust applies universally and continuously, Option D is the correct and verified answer.
How long does it typically take Falcon Identity to develop a baseline of a user?
Falcon Identity Protection establishes a user baseline by observing authentication behavior over time, including login frequency, endpoints used, access patterns, and protocol usage. According to the CCIS curriculum, Falcon typically requires approximately one week of consistent activity to develop an initial, reliable baseline for a user.
This baseline allows Falcon to distinguish normal behavior from anomalies and to calculate accurate risk scores. While the baseline continues to mature over time and becomes more precise with additional data, the first usable behavioral model is generally formed within a week.
Longer timeframes such as one or three months are not required to begin detecting abnormal behavior. Conversely, periods shorter than a week may not provide sufficient behavioral data to accurately model normal usage patterns.
Because Falcon can rapidly establish a functional baseline while continuously refining it, Option C (One week) is the correct and verified answer.
The NIST SP 800-207 framework for Zero Trust Architecture defines validation and authentication standards for users in which network locations?
The NIST SP 800-207 Zero Trust Architecture framework fundamentally rejects the concept of implicit trust based on network location. As outlined in both NIST guidance and reinforced in the CCIS curriculum, all users must be continuously validated and authenticated regardless of whether they are inside or outside the network perimeter.
Zero Trust assumes that threats can originate from anywhere, including internal networks. Therefore, authentication and authorization decisions must be made dynamically using identity, device posture, behavior, and risk signals---not network placement.
Falcon Identity Protection aligns directly with this principle by continuously evaluating identity behavior for all users, whether they authenticate from internal corporate networks, remote locations, or cloud environments.
Because Zero Trust applies universally, Option C is the correct and verified answer.
Which entity tab will show an administrator how to lower the account's risk score?
In CrowdStrike Falcon Identity Protection, the Risk tab within a user or account entity provides administrators with direct visibility into why an account has a specific risk score and what actions can be taken to reduce that score. This functionality is a core component of the User Assessment and Risk Assessment sections of the CCIS (CrowdStrike Identity Specialist) curriculum.
The Risk tab aggregates both analysis-based risks and detection-based risks, clearly identifying contributing factors such as compromised passwords, excessive privileges, risky authentication behavior, stale or never-used accounts, and policy violations. It also highlights the severity, likelihood, and consequence of each risk factor, allowing administrators to prioritize remediation efforts effectively. Most importantly, this tab provides actionable guidance, enabling teams to understand which specific remediation steps---such as enforcing MFA, resetting credentials, reducing privileges, or disabling unused accounts---will directly lower the account's overall risk score.
Other entity tabs do not provide this capability. The Timeline tab focuses on chronological events and detections, the Activity tab displays authentication and behavioral activity, and the Asset tab shows associated endpoints and resources. Only the Risk tab is designed to explain risk drivers and guide remediation, making Option D the correct and verified answer.
Exam domains verified against: Official CrowdStrike IDP exam guide, last checked October 2026.
Understand NIST SP 800-207 framework and Zero Trust principles including continuous validation. Learn how Falcon Identity Protection implements Zero Trust architecture and its key use cases, including how to interpret Zero Trust Assessment scores.
Explore the identity protection architecture in Falcon Identity Protection, how it inspects domain traffic, and complements traditional EDR solutions. Understand how it mitigates identity-based exploits and protects against human-element security vulnerabilities.
Identify the four menu categories in Falcon Identity Protection: monitor, enforce, explore, and configure. Understand the availability and features tied to subscription levels, Falcon roles, and how the tool mitigates threats bypassing traditional MITRE ATT&CK vectors.
Sample question from this domain above: Q1
Learn how risk scores, score trends, and risk matrices represent security posture in your domain. Understand the factors contributing to domain risk scores including severity, likelihood, and consequence, and how to manage goals and scope in the security overview.
Master entity risk categorization, the Risk Analysis and Event Analysis dashboards, and how to generate and export custom reports and insights. Learn to apply filters for targeted analysis and move users from higher to lower risk states.
Distinguish between users, endpoints, and entities, and between human and programmatic accounts. Learn high-risk account types such as stale and compromised password accounts, how risk baselining works, and how to use honeytoken accounts and watchlists.
Sample question from this domain above: Q5
Differentiate identity-based detections from incidents and master incident investigation pivots. Learn to navigate incident trees, filter detections, manage exclusions, and understand the difference between detection-based and analysis-based risk.
Create and manage policy rules and rule groups with appropriate triggers and conditions. Learn how to enable, disable, and apply changes to policies, and understand which Falcon roles can write and manage rules.
Monitor domain controllers and manage subnets for policy enforcement. Configure MFA and IDaaS connectors, enable authentication traffic inspection, and understand business privileges and country-based blocking rules.
Access and configure MFA and IDaaS connector settings. Enable third-party MFA for Falcon Identity Protection and understand how Falcon extends MFA capabilities rather than replacing them.
Build identity-focused workflows using Falcon Fusion SOAR components including triggers, conditions, branching, and loops. Create custom, templated, scheduled, and on-demand workflows to accomplish specific security goals.
Access Identity API documentation and create API keys specific to Falcon Identity Protection. Understand API permissions and pivot from Threat Hunter searches into GraphQL to build queries returning privileged high-risk users.
Sample question from this domain above: Q2
Common questions about the exam itself
