How many days will an identity-based incident be suppressed if new events related to the same incident occur?
Correct Answer: D
Falcon Identity Protection usesincident suppression windowsto prevent alert fatigue while still maintaining accurate incident tracking. According to the CCIS documentation, whennew events related to an existing identity-based incident occur, the incident issuppressed for 5 days. This suppression means that Falcon does not generate a new incident for the same activity during this window. Instead, additional detections areadded to the existing incident, allowing analysts to view the full progression of the threat in a single investigative context. The 5-day suppression window ensures that ongoing identity attacks-such as repeated authentication abuse or lateral movement-are consolidated rather than fragmented across multiple incidents. This improves investigation efficiency and aligns with Falcon's incident lifecycle management approach. Because the suppression period is fixed at5 days,Option Dis the correct and verified answer.
Question 7
How should a user be classified if one requires observation for potential risk to the business?
Correct Answer: C
Within Falcon Identity Protection, aWatched Useris a user explicitly designated forheightened monitoring due to potential business risk. According to the CCIS curriculum, watchlists are designed to provide additional visibility into users whose behavior, access level, or role may warrant closer observation, even if they have not yet exhibited confirmed malicious activity. Watched Users may include executives, administrators, users with access to sensitive systems, or accounts suspected of being targeted. Placing a user on a watchlist does not imply compromise; instead, it ensures their activity is prioritized in investigations, detections, and dashboards. The other options are incorrect: * Honeytoken Accountsare decoy accounts designed to detect malicious usage. * High Riskis a calculated risk state, not a monitoring classification. * Marked Useris not a valid Falcon Identity Protection classification. Because the CCIS material explicitly identifiesWatched Usersas accounts requiring observation for potential risk,Option Cis the correct and verified answer.
Question 8
Which of the following statements isNOTtrue as it relates to Identity Events, Detections, and Incidents?
Correct Answer: A
Falcon Identity Protection follows acorrelation and enrichment modelwhere events, detections, and incidents are dynamically linked over time. According to the CCIS curriculum,events that occur after an incident is marked In Progress do not automatically create a new incident. Instead, related events and detections are typicallyadded to the existing incident, provided they fall within the incident's correlation and suppression window. This behavior allows Falcon to present asingle evolving incident, showing the full progression of an identity attack rather than fragmenting activity into multiple incidents. Therefore, statementA is not true. The other statements are correct: * Detections can be retroactively associated with incidents that occurred earlier if correlation logic determines relevance. * Events can be linked to detections even if the detection is created after the event occurred. * Not all events are security-relevant; many remain informational and never become detections. This adaptive correlation model is a core concept in CCIS training and supports efficient investigation and incident lifecycle management. Hence,Option Ais the correct answer.
Question 9
Which entity tab will show an administrator how to lower the account's risk score?
Correct Answer: D
In CrowdStrike Falcon Identity Protection, theRisktab within a user or account entity provides administrators with direct visibility intowhy an account has a specific risk score and what actions can be taken to reduce that score. This functionality is a core component of theUser AssessmentandRisk Assessmentsections of the CCIS (CrowdStrike Identity Specialist) curriculum. The Risk tab aggregates bothanalysis-based risksanddetection-based risks, clearly identifying contributing factors such as compromised passwords, excessive privileges, risky authentication behavior, stale or never- used accounts, and policy violations. It also highlights theseverity, likelihood, and consequenceof each risk factor, allowingadministrators to prioritize remediation efforts effectively. Most importantly, this tab provides actionable guidance, enabling teams to understand which specific remediation steps-such as enforcing MFA, resetting credentials, reducing privileges, or disabling unused accounts-will directly lower the account's overall risk score. Other entity tabs do not provide this capability. TheTimelinetab focuses on chronological events and detections, theActivitytab displays authentication and behavioral activity, and theAssettab shows associated endpoints and resources. Only theRisktab is designed to explain risk drivers and guide remediation, making Option Dthe correct and verified answer.
Question 10
Where would a Falcon administrator enable authentication traffic inspection (ATI) for Domain Controllers?
Correct Answer: A
Authentication Traffic Inspection (ATI) is a foundational capability of Falcon Identity Protection that enables the platform to analyze authentication traffic from domain controllers. According to the CCIS documentation, ATI is enabled throughIdentity configuration policies. Identity configuration policies define how the Falcon sensor captures and inspects authentication-related traffic, including Kerberos, NTLM, LDAP, and other identity protocols. Enabling ATI at this level ensures that domain controllers provide the necessary telemetry for identity risk analysis, detections, and behavioral profiling. The other options are incorrect because: * Identity management settings focus on identity governance and administration. * Identity detection configuration controls detection logic, not traffic inspection. * Identity protection settings manage high-level configuration but do not directly enable ATI. Because ATI must be explicitly enabled viaIdentity configuration policies,Option Ais the correct and verified answer.
