Question 1

Which scenario best illustrates the application of analysis-based risk as opposed to detection-based risk?

Options :

A : An endpoint protection tool triggers an alert for the detection of known malware on a workstation.

B : A threat hunter observes a consistent pattern of credential misuse across multiple endpoints after reviewing system logs.

C : A security tool flags an IP address for unusually high outbound traffic, leading to an investigation.

D : A firewall blocks an IP address based on a reputation feed identifying it as malicious.

Answer: B

Question 2

Which of the following best describes the role of CrowdStrike Falcon Identity Protection in preventing identity-based attacks?

Options :

A : Monitoring only Active Directory accounts for anomalous activity.

B : Utilizing AI-driven behavioral analysis to detect and stop identity-based threats across on-premises and cloud environments.

C : Securing network endpoints while assuming all identity layers are inherently secure.

D : Blocking all access requests from unrecognized devices without context validation.

Answer: B

Question 3

Falcon Identity Protection plays a critical role in an organization’s security model by addressing identity-based threats. Where does Falcon Identity Protection fit within the broader security framework?

Options :

A : It enhances security by providing real-time monitoring and enforcement for authentication and authorization events.

B : It functions as a standalone tool that does not integrate with other CrowdStrike security products.

C : It replaces traditional endpoint protection solutions by focusing solely on identity security.

D : It is an alternative to multi-factor authentication (MFA) solutions rather than a complement to them.

Answer: A

Question 4

A security analyst at your organization wants to enforce multi-factor authentication (MFA) for users flagged as "high-risk" by CrowdStrike Identity Protection. To streamline the process, they decide to create a custom workflow in Falcon Fusion. Which of the following steps correctly describes how they should proceed?

Options :

A : In the Falcon Fusion module, select the "Workflow Templates" section and modify an existing template for MFA enforcement.

B : Access the Falcon Fusion module, create a new workflow, select "Custom Workflow", and configure a trigger for high-risk user events.

C : Open the Falcon Identity Dashboard, locate the high-risk users, and manually assign them to an MFA policy.

D : Navigate to the "Policies" section in Falcon Console and create an MFA policy under the "Identity Protection" tab.

Answer: B

Question 5

While monitoring your CrowdStrike dashboard, you notice an incident that initially appeared as "Suspicious File Download" but was later escalated to "Malware Execution." To determine why the type changed and understand the incident’s progression, which action should you take?

Options :

A : Run a manual antivirus scan on the endpoint to verify the threat level.

B : Check if similar files were flagged in other incidents across your organization.

C : Review the incident’s activity history and associated event logs in the CrowdStrike platform.

D : Inspect the file properties and compare them with CrowdStrike’s threat intelligence database.

Answer: C

Confidently Practice Online with Free CrowdStrike-IDP Exam Cram

Buying Options: