Question 1

Falcon Identity Protection plays a critical role in an organization’s security model by addressing identity-based threats. Where does Falcon Identity Protection fit within the broader security framework?

Options :

A : It enhances security by providing real-time monitoring and enforcement for authentication and authorization events.

B : It functions as a standalone tool that does not integrate with other CrowdStrike security products.

C : It replaces traditional endpoint protection solutions by focusing solely on identity security.

D : It is an alternative to multi-factor authentication (MFA) solutions rather than a complement to them.

Answer: A

Question 2

According to the NIST SP 800-207 framework, which of the following is a key capability that a Zero Trust Architecture should provide?

Options :

A : Granting access to resources based on network location.

B : Allowing full access to the network for authorized users.

C : Continuous monitoring and visibility of all network traffic and user activity.

D : Trusting known devices indefinitely without reevaluation.

Answer: C

Question 3

A security analyst at your organization wants to enforce multi-factor authentication (MFA) for users flagged as "high-risk" by CrowdStrike Identity Protection. To streamline the process, they decide to create a custom workflow in Falcon Fusion. Which of the following steps correctly describes how they should proceed?

Options :

A : In the Falcon Fusion module, select the "Workflow Templates" section and modify an existing template for MFA enforcement.

B : Access the Falcon Fusion module, create a new workflow, select "Custom Workflow", and configure a trigger for high-risk user events.

C : Open the Falcon Identity Dashboard, locate the high-risk users, and manually assign them to an MFA policy.

D : Navigate to the "Policies" section in Falcon Console and create an MFA policy under the "Identity Protection" tab.

Answer: B

Question 4

Your organization conducts weekly risk assessment meetings where a report on the top 10 riskiest users is required. To streamline this process, you want to schedule an automatic email delivery of the report every Monday at 9 AM. Which of the following steps is the correct way to set up a scheduled custom report in CrowdStrike?

Options :

A : Use the "Risk Assessment" dashboard to add a scheduler widget that sends reports automatically.

B : Export the report manually every Monday and share it with stakeholders via email.

C : Create a new report in the "Custom Reports" section, enable scheduling, and specify the delivery frequency and recipients.

D : Save the report as a template and enable email notifications for all dashboard changes.

Answer: C

Question 5

What is the primary purpose of applying filters during a risk assessment in the CrowdStrike platform?

Options :

A : To minimize the dataset for faster query execution

B : To focus analysis on specific risk-related indicators

C : To archive irrelevant logs for future reference

D : To automatically resolve low-priority incidents

Answer: B