CrowdStrike IDP Exam Dumps

Cloud-based MFA connectors integrate Falcon Identity Protection with third-party MFA providers using application-based authentication, not user credentials. As outlined in the CCIS curriculum, these connectors require an application identifier (Client/Application ID) and secret keys to securely authenticate API communications.

This approach follows modern security best practices by avoiding the use of privileged user credentials and instead leveraging scoped, revocable application secrets. The connector uses these credentials to trigger MFA challenges and exchange authentication context securely.

Options involving usernames, passwords, or domain controller details are incorrect, as Falcon Identity Protection does not store or require privileged account credentials for MFA integrations. Therefore, Option D is the correct answer.

Falcon Identity Protection uses incident suppression windows to prevent alert fatigue while still maintaining accurate incident tracking. According to the CCIS documentation, when new events related to an existing identity-based incident occur, the incident is suppressed for 5 days.

This suppression means that Falcon does not generate a new incident for the same activity during this window. Instead, additional detections are added to the existing incident, allowing analysts to view the full progression of the threat in a single investigative context.

The 5-day suppression window ensures that ongoing identity attacks---such as repeated authentication abuse or lateral movement---are consolidated rather than fragmented across multiple incidents. This improves investigation efficiency and aligns with Falcon's incident lifecycle management approach.

Because the suppression period is fixed at 5 days, Option D is the correct and verified answer.

Authentication Traffic Inspection (ATI) is enabled through Identity Configuration Policies, which define how the Falcon sensor captures and inspects identity-related network traffic. According to the CCIS documentation, ATI configuration is performed under Configure > Identity Configuration Policies.

These policies allow administrators to specify which authentication protocols are inspected, which domain controllers are covered, and how identity telemetry is collected. This configuration step is mandatory to enable identity visibility and detection capabilities.

The Enforce menu is used for policy rules and automated actions, not traffic inspection. General settings do not control sensor inspection behavior. Because ATI directly affects sensor data capture, it is managed exclusively through Identity Configuration Policies.

Therefore, Option D is the correct and verified answer.

The Domain Security Overview in Falcon Identity Protection uses Goals to frame identity risks into focused security assessment perspectives. These goals allow organizations to evaluate identity posture based on specific security priorities such as directory hygiene, privilege exposure, or overall attack surface reduction.

According to the CCIS curriculum, the available Goals include Privileged Users Management, AD Hygiene, Pen Testing, and Reduce Attack Surface. These goals are predefined by CrowdStrike and determine how risks are grouped, weighted, and presented in reports.

Business Privileged Users Management is not an available Goal within the Domain Security Overview. While Falcon Identity Protection does support the concept of business privileges and evaluates their impact on users and entities, this concept is handled through risk analysis and configuration---not as a selectable Domain Security Goal.

The CCIS documentation clearly distinguishes between Goals (which control reporting and assessment views) and business privilege modeling (which influences risk scoring). Therefore, Option B is the correct and verified answer.

Falcon Identity Protection follows a correlation and enrichment model where events, detections, and incidents are dynamically linked over time. According to the CCIS curriculum, events that occur after an incident is marked In Progress do not automatically create a new incident. Instead, related events and detections are typically added to the existing incident, provided they fall within the incident's correlation and suppression window.

This behavior allows Falcon to present a single evolving incident, showing the full progression of an identity attack rather than fragmenting activity into multiple incidents. Therefore, statement A is not true.

The other statements are correct:

Detections can be retroactively associated with incidents that occurred earlier if correlation logic determines relevance.

Events can be linked to detections even if the detection is created after the event occurred.

Not all events are security-relevant; many remain informational and never become detections.

This adaptive correlation model is a core concept in CCIS training and supports efficient investigation and incident lifecycle management. Hence, Option A is the correct answer.