Question 1

An organization detects a surge in failed login attempts across several user accounts. Most of these accounts belong to employees who are not currently on active projects. The CrowdStrike platform flags multiple accounts with medium risk scores. What should the analyst do to prioritize user assessment and mitigate potential threats?

Options :

A : Focus on accounts with medium risk scores and investigate further activity patterns

B : Reset the passwords for all inactive accounts to prevent compromise

C : Ignore the flagged accounts since the risk score is not high

D : Perform a bulk audit of all employee accounts regardless of activity level

Answer: A

Question 2

Which of the following tools is exclusively available with the Identity Threat Protection (ITP) subscription and not with the Identity Threat Detection (ITD) subscription in CrowdStrike Falcon Identity Protection?

Options :

A : Basic Active Directory Monitoring

B : Privileged Account Anomaly Detection

C : Multi-Factor Authentication (MFA) Integration Support

D : Enhanced Credential Theft Protection

Answer: B

Question 3

Which scenario best illustrates the application of analysis-based risk as opposed to detection-based risk?

Options :

A : An endpoint protection tool triggers an alert for the detection of known malware on a workstation.

B : A threat hunter observes a consistent pattern of credential misuse across multiple endpoints after reviewing system logs.

C : A security tool flags an IP address for unusually high outbound traffic, leading to an investigation.

D : A firewall blocks an IP address based on a reputation feed identifying it as malicious.

Answer: B

Question 4

Your organization wants to delegate the task of creating and managing policy rules to a security analyst. To minimize risk, you want to assign the minimum necessary Falcon role to allow the analyst to create, edit, and delete policy rules but prevent access to unrelated administrative tasks. Which Falcon role should you assign to the security analyst?

Options :

A : Falcon Security Policy Manager

B : Falcon Viewer

C : Falcon Endpoint Manager

D : Falcon Analyst

Answer: A

Question 5

You are tasked with generating a custom report in CrowdStrike to assist in planning a risk mitigation strategy. The report must focus on accounts exhibiting high-risk behaviors, such as excessive failed logins or abnormal activity patterns. Which configuration would best achieve this goal?

Options :

A : Filter by "Login Success Rate" and exclude all accounts with 100% successful logins.

B : Focus on accounts with password changes in the past 7 days to identify potential credential leaks.

C : Add a filter for "Behavior: Abnormal Activity" and display columns for "Risk Score" and "Event Count."

D : Include only accounts with MFA enabled to narrow the focus of the report.

Answer: C

Confidently Practice Online with Free CrowdStrike-IDP Exam Cram

Buying Options: