Within Domain Security Overview, whatGoalincorporates all risks into one security assessment report?
Correct Answer: C
Within the Domain Security Overview,Goalsare used to tailor how identity risks are grouped, evaluated, and reported. TheReduce Attack Surfacegoal is the only option thatincorporates all identity risks into a single, comprehensive security assessment. The CCIS curriculum explains that Reduce Attack Surface provides a holistic view of identity exposure by aggregating risks related to authentication paths, account hygiene, privileges, misconfigurations, and legacy identity weaknesses. This goal is designed for organizations seeking an overall understanding of their identity security posture rather than focusing on a specific domain such as privileged users or directory hygiene. Other goals are more specialized: * AD Hygienefocuses on directory configuration issues. * Privileged User Managementconcentrates on high-privilege identities. * Pen Testingaligns more with adversarial simulation than continuous risk assessment. Reduce Attack Surface aligns directly withZero Trust principles, helping organizations identify and eliminate unnecessary identity access paths. Therefore,Option Cis the correct and verified answer.
Question 12
Which CrowdStrike documentation category would you search to find GraphQL examples?
Correct Answer: A
GraphQL is the underlying query technology used by multiple CrowdStrike platforms, including Falcon Identity Protection. According to the CCIS curriculum,GraphQL examples are documented under the broader "CrowdStrike APIs" documentation category, not limited to a single product. The CrowdStrike APIs section includes: * Authentication and API key usage * GraphQL schema references * Example GraphQL queries and mutations * Pagination, filtering, and response handling While Identity Protection uses GraphQL for identity-specific queries, the examples themselves are centralized underCrowdStrike APIsto provide consistency across Falcon modules. Product-specific use cases are then layered on top of these core examples. The other options are incorrect: * Threat Intelligence focuses on adversary data. * XDR covers detection and correlation concepts. * Identity Protection APIs describe endpoints and permissions, not general GraphQL usage examples. Therefore,Option Ais the correct and verified answer.
Question 13
Which of the following would cause an identity-based incident type to change?
Correct Answer: D
In Falcon Identity Protection,identity-based incidents are dynamicand can evolve over time as additional detections are associated with them. According to the CCIS curriculum, an incident'stype is automatically recalculatedbased on thedetections related to the incident, not by manual user actions. As new identity-based detections are generated-such as credential misuse, lateral movement attempts, or abnormal authentication behavior-the platform continuously reassesses the incident. If the newly added detections indicate a different or more severe attack pattern, Falcon may automaticallychange the incident typeto better reflect the observed threat activity. Manual actions such as adding exclusions or linking detections do not directly change the incident type. Similarly, users cannot manually override an incident's classification. The classification logic is driven entirely by Falcon's analytics engine to ensure consistent, objective threat categorization. This automated behavior is emphasized in CCIS training to highlight Falcon's ability toadapt incident context as attacks progress, makingOption Dthe correct answer.
Question 14
The Enforce section of Identity Protection is used to:
Correct Answer: B
The Enforce section of Falcon Identity Protection is dedicated to policy-based identity enforcement. According to the CCIS curriculum, this section allows administrators to define and manage Policy Rules and Policy Groups that specify how the platform should respond when identity-related conditions are detected. These rules evaluate triggers such as risky authentication behavior, privilege misuse, compromised credentials, or elevated risk scores, and then execute actions like blocking access, enforcing MFA, or initiating Falcon Fusion workflows. Enforce is therefore the execution layer of Falcon's identity security model. The other options correspond to different sections of the platform: Configuration tasks are handled in Configure. Detections and incidents are reviewed in Monitor or Explore. Domain posture overviews are displayed in Domain Security Overview. Because Enforce directly controls what actions are taken in response to identity risk, Option B is the correct and verified answer.
Question 15
Can a specific detection be excluded altogether or just per entity?
Correct Answer: C
Falcon Identity Protection provides flexible control over how identity-based detections are handled through the Detection Exclusionsframework. According to the CCIS curriculum, administrators can eitherdisable an entire detection typeor, where supported,exclude specific entitiessuch as users, service accounts, or endpoints from triggering that detection. Not all detections support entity-level exclusions. For detections that do, exclusions allow organizations to suppress known benign behavior without disabling the detection globally. This is particularly useful for service accounts or legacy systems that generate expected but non-malicious activity. When entity-level exclusion is not supported, administrators may choose todisable the detection entirely, which stops it from generating alerts across the environment. The CCIS documentation clearly explains this dual model: * All detections can be disabled, regardless of type * Only some detections support entity-based exclusions This approach balances operational flexibility with security integrity and avoids the misconception that exclusions automatically create security gaps. Therefore,Option Cis the correct and verified answer.
