Question 1

In the context of potential risk factors related to identity, what does the "Severity" component assess?

Options :

A : The number of identities impacted by a breach

B : The likelihood that a vulnerability will be exploited

C : The probability that an attack will occur

D : The impact of a potential security breach if the risk materializes

Answer: D

Question 2

Falcon Identity Protection introduces a log-free detection approach that differs from traditional Endpoint Detection and Response (EDR) solutions. Which of the following best describes a key advantage of Falcon Identity Protection’s log-free detection mechanism compared to traditional EDR solutions?

Options :

A : It completely replaces endpoint telemetry, making EDR solutions unnecessary for security operations.

B : It provides real-time identity threat detection without relying on endpoint logs, reducing latency in threat response.

C : It only works with Windows-based endpoints and does not support cross-platform environments.

D : It only detects threats within the organization’s network perimeter, making it ineffective against cloud-based identity threats.

Answer: B

Question 3

An incident responder is reviewing several identity-based detections in CrowdStrike. One detection, "Multiple Failed Login Attempts from a Known Bad IP Address", was flagged on a domain administrator account. The responder wants to determine the potential severity and next steps. Which of the following types of information is least likely to be included in this detection?

Options :

A : The IP address flagged as malicious

B : The specific devices that were targeted during the failed logins

C : Indicators of Compromise (IoCs) related to the flagged IP address

D : The number of failed login attempts and the time window

Answer: B

Question 4

A company uses a scheduled task to run a proprietary script, DailyReportGenerator.ps1, which is repeatedly flagged by CrowdStrike as suspicious. The security team has verified that the task is safe and wants to prevent further detections while ensuring monitoring remains active for all other scheduled tasks. How should the team add an appropriate detection exclusion in CrowdStrike?

Options :

A : Add an exception for the specific scheduled task by its name and command-line arguments.

B : Create a detection exclusion for the hash of DailyReportGenerator.ps1.

C : Add a process exclusion for powershell.exe across all endpoints.

D : Exclude all scheduled tasks from detection alerts.

Answer: A

Question 5

Which of the following best aligns with implementing Zero Trust Architecture to protect an organization’s resources?

Options :

A : Establishing a Perimeter Firewall with Intrusion Detection

B : Implementing Role-Based Access Control (RBAC) Combined with Multi-Factor Authentication (MFA)

C : Segmenting the Network Based on Traditional VLANs

D : Relying Solely on Endpoint Security Software

Answer: B

Confidently Practice Online with Free CrowdStrike-IDP Exam Cram

Buying Options: