CrowdStrike IDP Exam Dumps

Falcon Identity Protection continuously inspects authentication traffic and network behavior to establish behavioral baselines for users and accounts. These baselines enable the platform to detect deviations that indicate potential compromise, misuse, or insider threat activity. This behavioral intelligence directly enhances the effectiveness of Falcon Fusion workflows.

Falcon Fusion leverages identity and behavioral analytics as decision points within workflows, allowing automated actions to be triggered when abnormal behavior is detected. For example, a workflow can automatically enforce MFA, notify administrators, isolate risky sessions, or initiate remediation when a user deviates from their established baseline.

The CCIS curriculum highlights that Falcon Fusion is designed to integrate identity risk signals with IT policy enforcement, enabling Zero Trust-aligned automation. This capability goes far beyond simple notifications and supports coordinated responses across security and IT teams.

Options A, B, and C are incorrect because Falcon Fusion is fully identity-aware, applies broadly across users and entities, and supports a wide range of actions beyond email notifications. Therefore, Option D accurately describes how behavioral profiling strengthens Falcon Fusion workflows.

To interact with Falcon Identity Protection using GraphQL, the API client must be created with the appropriate permission scopes. According to the CCIS curriculum, the Identity Protection GraphQL scope with Write permissions must be enabled prior to using the Identity Protection API.

This scope allows the API client to execute GraphQL queries and mutations related to identity detections, incidents, users, and risk data. Even when performing read-only operations, CrowdStrike requires the GraphQL Write scope to authorize GraphQL query execution within the Falcon platform.

The other options are incorrect because:

Identity Protection Assessment and Health are read-only data scopes.

The statement that Write permissions are not required is explicitly false per CCIS documentation.

Because GraphQL access requires the Identity Protection GraphQL (Write) scope, Option D is the correct and verified answer.

Within Falcon Identity Protection, Predefined Reports allow administrators to generate standardized reports based on specific data subjects. The Subject dropdown determines the type of data the report will be built from, such as identity risks, authentication activity, or endpoint-related telemetry.

The category associated with endpoints in the Subject dropdown is Events. Endpoint-related data---such as authentication attempts, logons, protocol usage, and domain controller--observed activity---is captured and represented as events within Falcon. These events form the foundational telemetry used for identity detections, investigations, and reporting.

By contrast:

Insights represent aggregated analytical findings derived from events.

Incidents group multiple detections into a single investigative narrative.

Accounts focus on identity entities such as users and service accounts.

Endpoint visibility in reporting is therefore tied directly to Events, as events reflect the raw and enriched activity observed on endpoints and domain controllers. This structure aligns with Falcon's identity-first security model, where endpoint-observed authentication behavior feeds identity risk scoring and Zero Trust decisions.

The CCIS curriculum explicitly associates endpoint-related reporting with the Events subject, making Option B the correct and verified answer.

Falcon Identity Protection integrates with a defined set of supported MFA providers to enforce identity verification and conditional access based on identity risk. According to the CCIS curriculum, supported MFA providers include Azure (Entra) MFA, Cisco Duo, and Symantec VIP, which are commonly used enterprise-grade MFA solutions.

These integrations allow Falcon Identity Protection to evaluate authentication attempts and dynamically enforce MFA challenges when risky behavior is detected. The supported providers expose the necessary APIs and authentication workflows required for Falcon to trigger MFA challenges as part of Policy Rules and Zero Trust enforcement.

Firebase is not a supported MFA provider within Falcon Identity Protection. Firebase is primarily a mobile and application development platform and does not function as an enterprise MFA provider compatible with Falcon's identity enforcement model. As such, it cannot be used to enforce conditional access or identity verification through Falcon Identity Protection.

Because Falcon only supports specific, enterprise MFA integrations validated by CrowdStrike, Option A is the correct and verified answer.

To integrate Falcon Identity Protection with Azure AD (Entra ID) as an Identity-as-a-Service (IDaaS) provider, specific application-level credentials are required. According to the CCIS curriculum, the connector configuration requires Tenant Domain, Application (Client) ID, and Application Secret.

These values are generated when registering an application in Azure AD and are used to authenticate Falcon Identity Protection securely via OAuth-based API access. This method ensures least-privilege access and allows the connector to ingest cloud authentication activity and apply SSO-related policy enforcement.

Other options list incomplete or incorrect credential combinations. Therefore, Option D is the correct and verified answer.