IDP Exam Preparation Material | CrowdStrike Certified Identity Specialist

Explanation:
Falcon Identity Protection calculates user risk scores based on a combination of privilege level, credential exposure, and behavioral indicators. According to the CCIS curriculum, a privileged user with a compromised password represents one of the highest-risk identity scenarios.
Privileged accounts―such as administrators or service accounts with elevated access―already pose increased risk due to their access scope. When Falcon detects that such an account’s credentials have been compromised, the risk escalates significantly because attackers can immediately gain high-impact access without further escalation.
The other options do not inherently represent the same level of risk:
Logging in from a shared endpoint may increase risk but is context-dependent.
Stale users are risky but typically lower risk than active compromised credentials.
Domain Admin group membership alone does not imply compromise.
Because credential compromise combined with privilege dramatically increases attack potential,
Option B is the correct and verified answer.

Explanation:
Falcon Identity Protection is architected as a log-free identity security platform, a core tenet emphasized throughout the CCIS curriculum. Unlike traditional SIEM- or log-based solutions, Falcon Identity Protection does not require string-based queries to continuously assess identity events or associate them with threats.
Instead, the platform relies on machine-learning-powered detection rules, real-time authentication traffic inspection, and API-based connectors to collect and analyze identity telemetry directly from domain controllers and identity providers. This approach eliminates the operational complexity of building, tuning, and maintaining query logic.
String-based queries are commonly associated with legacy log aggregation tools and SIEM platforms, where analysts must manually search logs to identify suspicious behavior. Falcon Identity Protection replaces this model with behavioral baselining and automated correlation, enabling continuous identity risk assessment without human-driven query execution.
Because Falcon does not require string-based queries to operate,
Option Dis the correct and verified answer.

Explanation:
The Enforce section of Falcon Identity Protection is dedicated to policy-based identity enforcement. According to the CCIS curriculum, this section allows administrators to define and manage Policy Rules and Policy Groups that specify how the platform should respond when identity-related conditions are detected.
These rules evaluate triggers such as risky authentication behavior, privilege misuse, compromised credentials, or elevated risk scores, and then execute actions like blocking access, enforcing MFA, or initiating Falcon Fusion workflows. Enforce is therefore the execution layer of Falcon’s identity security model.
The other options correspond to different sections of the platform:
Configuration tasks are handled in Configure.
Detections and incidents are reviewed in Monitor or Explore.
Domain posture overviews are displayed in Domain Security Overview.
Because Enforce directly controls what actions are taken in response to identity risk, Option B is the correct and verified answer.

Explanation:
To interact with Falcon Identity Protection using GraphQL, the API client must be created with the appropriate permission scopes. According to the CCIS curriculum, the Identity Protection GraphQL scope with Write permissions must be enabled prior to using the Identity Protection API.
This scope allows the API client to execute GraphQL queries and mutations related to identity detections, incidents, users, and risk data. Even when performing read-only operations, CrowdStrike requires the GraphQL Write scope to authorize GraphQL query execution within the Falcon platform.
The other options are incorrect because:
Identity Protection Assessment and Health are read-only data scopes.
The statement that Write permissions are not required is explicitly false per CCIS documentation.
Because GraphQL access requires the Identity Protection GraphQL (Write)scope,
Option Dis the correct and verified answer.

Explanation:
The NIST SP 800-207 Zero Trust Architectureframework fundamentally rejects the concept of implicit trust based on network location. As outlined in both NIST guidance and reinforced in the CCIS curriculum, all users must be continuously validated and authenticated regardless of whether they are inside or outside the network perimeter.
Zero Trust assumes that threats can originate from anywhere, including internal networks. Therefore, authentication and authorization decisions must be made dynamically using identity, device posture, behavior, and risk signals―not network placement.
Falcon Identity Protection aligns directly with this principle by continuously evaluating identity behavior for all users, whether they authenticate from internal corporate networks, remote locations, or cloud environments.
Because Zero Trust applies universally,
Option Cis the correct and verified answer.