IDP Exam Dumps - CrowdStrike Certified Identity Specialist(CCIS) Exam

The provided Falcon Fusion SOAR workflow example shows a trigger based on anIdentity Detection, followed by conditions and actions that search for recently logged-in users and related entities across endpoints. According to the CCIS curriculum, this type of workflow aligns with theLateral Movementtactic in the MITRE ATT&CK framework.

Lateral Movement involves an attacker moving from one system or account to another after initial access has been achieved. The workflow’s logic—correlating identity detections with additional users and endpoints—supports identifying and responding to movement across the environment using compromised or abused credentials.

The other tactics do not best fit this scenario:

Initial Access occurs earlier in the attack chain.

Credential Access focuses on obtaining credentials.

Privilege Escalation centers on increasing access rights.

Because the workflow is designed to detect and respond tomovement between systems and identities,Option C (Lateral Movement)is the correct and verified answer.

Within Falcon Identity Protection, aWatched Useris a user explicitly designated forheightened monitoringdue to potential business risk. According to the CCIS curriculum, watchlists are designed to provide additional visibility into users whose behavior, access level, or role may warrant closer observation, even if they have not yet exhibited confirmed malicious activity.

Watched Users may include executives, administrators, users with access to sensitive systems, or accounts suspected of being targeted. Placing a user on a watchlist does not imply compromise; instead, it ensures their activity is prioritized in investigations, detections, and dashboards.

The other options are incorrect:

Honeytoken Accountsare decoy accounts designed to detect malicious usage.

High Riskis a calculated risk state, not a monitoring classification.

Marked Useris not a valid Falcon Identity Protection classification.

Because the CCIS material explicitly identifiesWatched Usersas accounts requiring observation for potential risk,Option Cis the correct and verified answer.

To retrieve identity-based detections and incident-related data using the CrowdStrike APIs, the API key must include the correctpermission scope. According to the CCIS curriculum, theIdentity Protection Detectionsscope is required to access identity-based detection and incident information through GraphQL.

This scope allows API queries to retrieve:

Identity-based detections

Associated incident metadata

Detection attributes such as severity, status, and related entities

Incident data in Falcon Identity Protection isderived from detections, making the Detections scope the authoritative permission set for this information. Without this scope, GraphQL queries related to identity detections and incidents will fail authorization.

The other scopes are either too narrow or unrelated to detection retrieval. Therefore,Option Ais the correct and verified answer.

A modern Zero Trust security architecture fundamentally differs from the traditional wall-and-moat model byeliminating implicit trust based on network location. As defined inNIST SP 800-207and reinforced in the CCIS curriculum, Zero Trust requirescontinuous authentication and authorization of all entities, regardless of whether they originate from inside or outside the network.

Traditional perimeter-based security assumes that users and devices inside the network are trusted, focusing defenses at the boundary. This approach fails in modern environments where cloud access, remote work, and compromised credentials allow attackers to operate internally without triggering perimeter controls.

Zero Trust replaces this assumption with continuous validation using identity, behavior, device posture, and risk signals. Falcon Identity Protection operationalizes this concept by continuously inspecting authentication traffic and reassessing trust throughout a session, not just at login time.

Because Zero Trust applies universally and continuously,Option Dis the correct and verified answer.

Falcon Identity Protection establishes auser baselineby observing authentication behavior over time, including login frequency, endpoints used, access patterns, and protocol usage. According to the CCIS curriculum, Falcon typically requiresapproximately one weekof consistent activity to develop an initial, reliable baseline for a user.

This baseline allows Falcon to distinguish normal behavior from anomalies and to calculate accurate risk scores. While the baseline continues to mature over time and becomes more precise with additional data, the first usable behavioral model is generally formed within a week.

Longer timeframes such as one or three months are not required to begin detecting abnormal behavior. Conversely, periods shorter than a week may not provide sufficient behavioral data to accurately model normal usage patterns.

Because Falcon can rapidly establish a functional baseline while continuously refining it,Option C (One week)is the correct and verified answer.