Question 1

You are tasked with generating a custom report in CrowdStrike to assist in planning a risk mitigation strategy. The report must focus on accounts exhibiting high-risk behaviors, such as excessive failed logins or abnormal activity patterns. Which configuration would best achieve this goal?

Options :

A : Filter by "Login Success Rate" and exclude all accounts with 100% successful logins.

B : Focus on accounts with password changes in the past 7 days to identify potential credential leaks.

C : Add a filter for "Behavior: Abnormal Activity" and display columns for "Risk Score" and "Event Count."

D : Include only accounts with MFA enabled to narrow the focus of the report.

Answer: C

Question 2

Which of the following best aligns with implementing Zero Trust Architecture to protect an organization’s resources?

Options :

A : Establishing a Perimeter Firewall with Intrusion Detection

B : Implementing Role-Based Access Control (RBAC) Combined with Multi-Factor Authentication (MFA)

C : Segmenting the Network Based on Traditional VLANs

D : Relying Solely on Endpoint Security Software

Answer: B

Question 3

Which of the following best describes the role of CrowdStrike Falcon Identity Protection in preventing identity-based attacks?

Options :

A : Monitoring only Active Directory accounts for anomalous activity.

B : Utilizing AI-driven behavioral analysis to detect and stop identity-based threats across on-premises and cloud environments.

C : Securing network endpoints while assuming all identity layers are inherently secure.

D : Blocking all access requests from unrecognized devices without context validation.

Answer: B

Question 4

How does Falcon Identity Protection enhance a security model focused on Zero Trust principles in a domain environment?

Options :

A : By monitoring and restricting lateral movement through identity-based threat detection

B : By encrypting all network traffic within the domain

C : By automating access control policies for cloud-based applications

D : By replacing traditional firewalls and antivirus solutions

Answer: A

Question 5

According to the NIST SP 800-207 framework, which of the following is a key capability that a Zero Trust Architecture should provide?

Options :

A : Granting access to resources based on network location.

B : Allowing full access to the network for authorized users.

C : Continuous monitoring and visibility of all network traffic and user activity.

D : Trusting known devices indefinitely without reevaluation.

Answer: C