Question 1

A security engineer is configuring API access for a third-party tool to pull data from the Falcon Identity Protection API. They are confused about the differences between the available API permissions. Which permission should be granted to allow read-only access to authentication event logs?

Options :

A : IdentityAPI:Admin

B : IdentityAPI:Read

C : IdentityAPI:Write

D : IdentityAPI:EventTrigger

Answer: B

Question 2

The Risk Analysis dashboard shows that a domain in the organization has a high number of risks categorized as “Critical.” The security team needs to decide on the next steps to mitigate these risks effectively. They ask for advice on how to interpret the data and act accordingly. How should the security team prioritize their actions using the Risk Analysis dashboard?

Options :

A : Address all "Critical" risks first, as these represent the highest priority vulnerabilities or threats.

B : Investigate only risks flagged within the last 24 hours to address recent threats.

C : Focus on "Low" risks to resolve the maximum number of issues quickly and improve the overall risk score.

D : Prioritize risks related to misconfigurations, as they are easier to remediate compared to vulnerabilities.

Answer: A

Question 3

Your organization conducts weekly risk assessment meetings where a report on the top 10 riskiest users is required. To streamline this process, you want to schedule an automatic email delivery of the report every Monday at 9 AM. Which of the following steps is the correct way to set up a scheduled custom report in CrowdStrike?

Options :

A : Use the "Risk Assessment" dashboard to add a scheduler widget that sends reports automatically.

B : Export the report manually every Monday and share it with stakeholders via email.

C : Create a new report in the "Custom Reports" section, enable scheduling, and specify the delivery frequency and recipients.

D : Save the report as a template and enable email notifications for all dashboard changes.

Answer: C

Question 4

Your organization recently implemented CrowdStrike Falcon Identity Protection. A team member asks how it integrates with your existing MFA provider. What is the primary way Falcon Identity Protection extends the capabilities of an existing MFA provider?

Options :

A : It disables MFA requirements for logins originating from trusted devices.

B : It replaces the existing MFA provider entirely with its own MFA solution.

C : It adds continuous authentication and risk-based monitoring to enhance existing MFA workflows.

D : It enforces MFA only for administrative users, bypassing other users in the system.

Answer: C

Question 5

An organization’s development team is building a custom application that leverages CrowdStrike Identity APIs. During a team meeting, a junior developer asks where they can find an example of GraphQL query structures and authentication details specific to these APIs. What is the best resource for this information?

Options :

A : Online GraphQL Playground

B : CrowdStrike Identity Protection Console’s “API Settings” Section

C : CrowdStrike Developer Portal’s GraphQL API Documentation Section

D : CrowdStrike Community Forum

Answer: C

Confidently Practice Online with Free CrowdStrike-IDP Exam Cram

Buying Options: