CrowdStrike IDP Exam Dumps

In Falcon Identity Protection, the 'Guest Account Enabled' risk highlights the presence of local or domain guest accounts that remain active across endpoints. Guest accounts are inherently high-risk because they typically lack strong authentication controls, are rarely monitored, and are frequently abused by attackers for lateral movement and persistence.

The CCIS curriculum explicitly recommends disabling Guest accounts on all endpoints as the primary remediation action. This is because guest accounts often bypass standard identity governance processes and violate the principles of least privilege and Zero Trust, both of which are foundational to Falcon Identity Protection's security model. Disabling these accounts removes an unnecessary and dangerous authentication path from the environment.

Other options are incorrect because:

Adding endpoints to a watchlist does not remediate the risk.

Blocking access via a policy rule is less effective than eliminating the account entirely.

Disabling endpoints in Active Directory does not directly address the guest account exposure.

Falcon Identity Protection prioritizes elimination of weak identity configurations, and disabling guest accounts is a direct, effective action that immediately lowers identity risk scores and reduces attack surface. Therefore, Option C is the correct and verified answer.

The Enforce section of Falcon Identity Protection is dedicated to policy-based identity enforcement. According to the CCIS curriculum, this section allows administrators to define and manage Policy Rules and Policy Groups that specify how the platform should respond when identity-related conditions are detected.

These rules evaluate triggers such as risky authentication behavior, privilege misuse, compromised credentials, or elevated risk scores, and then execute actions like blocking access, enforcing MFA, or initiating Falcon Fusion workflows. Enforce is therefore the execution layer of Falcon's identity security model.

The other options correspond to different sections of the platform:

Configuration tasks are handled in Configure.

Detections and incidents are reviewed in Monitor or Explore.

Domain posture overviews are displayed in Domain Security Overview.

Because Enforce directly controls what actions are taken in response to identity risk, Option B is the correct and verified answer.

To interact with Falcon Identity Protection using GraphQL, the API client must be created with the appropriate permission scopes. According to the CCIS curriculum, the Identity Protection GraphQL scope with Write permissions must be enabled prior to using the Identity Protection API.

This scope allows the API client to execute GraphQL queries and mutations related to identity detections, incidents, users, and risk data. Even when performing read-only operations, CrowdStrike requires the GraphQL Write scope to authorize GraphQL query execution within the Falcon platform.

The other options are incorrect because:

Identity Protection Assessment and Health are read-only data scopes.

The statement that Write permissions are not required is explicitly false per CCIS documentation.

Because GraphQL access requires the Identity Protection GraphQL (Write) scope, Option D is the correct and verified answer.

In Falcon Identity Protection, the Explore section of the Falcon menu is used to investigate analytical views such as the Event Analysis dashboard. This aligns with the CCIS framework, which defines Explore as the primary area for interactive investigation, analytics, and risk exploration across identity data.

The Event Analysis dashboard is designed to help administrators analyze identity-related authentication events, behavioral patterns, and anomalous activity derived from domain traffic inspection and domain controller telemetry. These analytical capabilities are intentionally placed under Explore because this menu category supports hypothesis-driven investigation rather than enforcement or configuration actions.

By contrast:

Enforce is used to apply policy rules and automated controls.

Threat Hunter is focused on proactive hunting using queries and detection pivots.

Configure is used to manage settings, connectors, policies, and integrations.

The CCIS documentation explicitly associates dashboards such as Risk Analysis and Event Analysis with the Explore menu, emphasizing its role in understanding why risk exists before taking action. Therefore, Option C (Explore) is the correct and verified answer.

A modern Zero Trust security architecture fundamentally differs from the traditional wall-and-moat model by eliminating implicit trust based on network location. As defined in NIST SP 800-207 and reinforced in the CCIS curriculum, Zero Trust requires continuous authentication and authorization of all entities, regardless of whether they originate from inside or outside the network.

Traditional perimeter-based security assumes that users and devices inside the network are trusted, focusing defenses at the boundary. This approach fails in modern environments where cloud access, remote work, and compromised credentials allow attackers to operate internally without triggering perimeter controls.

Zero Trust replaces this assumption with continuous validation using identity, behavior, device posture, and risk signals. Falcon Identity Protection operationalizes this concept by continuously inspecting authentication traffic and reassessing trust throughout a session, not just at login time.

Because Zero Trust applies universally and continuously, Option D is the correct and verified answer.