Which of the following isNOTan available Goal within the Domain Security Overview?
Correct Answer: B
The Domain Security Overview in Falcon Identity Protection usesGoalsto frame identity risks into focused security assessment perspectives. These goals allow organizations to evaluate identity posture based on specific security priorities such as directory hygiene, privilege exposure, or overall attack surface reduction. According to the CCIS curriculum, theavailable GoalsincludePrivileged Users Management,AD Hygiene, Pen Testing, andReduce Attack Surface. These goals are predefined by CrowdStrike and determine how risks are grouped, weighted, and presented in reports. Business Privileged Users Managementisnot an available Goalwithin the Domain Security Overview. While Falcon Identity Protection does support the concept ofbusiness privilegesand evaluates their impact on users and entities, this concept is handled through risk analysis and configuration-not as a selectable Domain Security Goal. The CCIS documentation clearly distinguishes betweenGoals(which control reporting and assessment views) andbusiness privilege modeling(which influences risk scoring). Therefore,Option Bis the correct and verified answer.
Question 2
Falcon Identity Protection monitors network traffic to build user behavioral profiles to help identify unusual user behavior. How can this be beneficial to create a Falcon Fusion workflow?
Correct Answer: D
Falcon Identity Protection continuously inspects authentication traffic and network behavior to establish behavioral baselines for users and accounts. These baselines enable the platform to detect deviations that indicate potential compromise, misuse, or insider threat activity. This behavioral intelligence directly enhances the effectiveness ofFalcon Fusion workflows. Falcon Fusion leveragesidentity and behavioral analyticsas decision points within workflows, allowing automated actions to be triggered when abnormal behavior is detected. For example, a workflow can automatically enforce MFA, notify administrators, isolate risky sessions, or initiate remediation when a user deviates from their established baseline. The CCIS curriculum highlights that Falcon Fusion is designed tointegrate identity risk signals with IT policy enforcement, enabling Zero Trust-aligned automation. This capability goes far beyond simple notifications and supports coordinated responses across security and IT teams. Options A, B, and C are incorrect because Falcon Fusion is fully identity-aware, applies broadly across users and entities, and supports a wide range of actions beyond email notifications. Therefore,Option Daccurately describes how behavioral profiling strengthens Falcon Fusion workflows.
Question 3
Which of the following demonstrates a detection is enabled?
Correct Answer: B
In Falcon Identity Protection, detection status is visually indicated using atoggle controlwithin the detection configuration interface. According to the CCIS documentation, when a detection isenabled, the toggle next to Detection Enabledis displayed ingreen. A green toggle indicates that the detection logic is active and that Falcon will generate detections when the defined conditions are met. When the toggle is gray, the detection is disabled and will not generate alerts or contribute to incident formation. Falcon does not rely on textual "Enabled" or "Disabled" tags to indicate detection status. Instead, the toggle color provides a clear, immediate visual indicator to administrators. Because agreen toggleexplicitly represents an enabled detection,Option Bis the correct and verified answer.
Question 4
How long does it typically take Falcon Identity to develop a baseline of a user?
Correct Answer: C
Falcon Identity Protection establishes auser baselineby observing authentication behavior over time, including login frequency, endpoints used, access patterns, and protocol usage. According to the CCIS curriculum, Falcon typically requiresapproximately one weekof consistent activity to develop an initial, reliable baseline for a user. This baseline allows Falcon to distinguish normal behavior from anomalies and to calculate accurate risk scores. While the baseline continues to mature over time and becomes more precise with additional data, the first usable behavioral model is generally formed within a week. Longer timeframes such as one or three months are not required to begin detecting abnormal behavior. Conversely, periods shorter than a week may not provide sufficient behavioral data to accurately model normal usage patterns. Because Falcon can rapidly establish a functional baseline while continuously refining it,Option C (One week)is the correct and verified answer.
Question 5
To enforce conditional access policies with Identity Verification, an MFA connector can be configured for different authentication methods such as:
Correct Answer: B
Falcon Identity Protection integrates with third-party MFA providers throughMFA connectorsto support conditional access and identity verification. The CCIS documentation explains that these connectors allow organizations to enforce MFA challenges based on identity risk, authentication behavior, or policy conditions. One of the supported MFA authentication methods isPush, where a notification is sent to a registered device or application for user approval. Push-based MFA is widely used due to its balance of usability and security and is fully supported by Falcon Identity Protection when integrated with compatible MFA providers. The other options are not valid MFA authentication methods within Falcon: * Page and Pull are not recognized MFA mechanisms. * Alarm is related to alerting, not authentication. By enabling push-based MFA through an MFA connector, organizations can dynamically enforce identity verification in alignment with Zero Trust principles. Therefore,Option Bis the correct and verified answer.
