Course 2026 IDP Test Prep Training Practice Exam Download [Q31-Q50]

Course 2026 IDP Test Prep Training Practice Exam Download [Q31-Q50]

Rate this post

Course 2026 IDP Test Prep Training Practice Exam Download

IDP Exam Info and Free Practice Test Professional Quiz Study Materials

CrowdStrike IDP Exam Overview:

Certification Vendor:	CrowdStrike
Exam Name:	CrowdStrike Certified Identity Specialist
Exam Number:	CCIS
Real Exam Qty:	60
Available Languages:	English
Certificate Validity Period:	3 Years
Exam Format:	Closed-book, Multiple Choice
Exam Price:	USD 250
Related Certifications:	CrowdStrike Certified Falcon Responder (CCFR) CrowdStrike Certified Falcon Administrator (CCFA) CrowdStrike Certified Falcon Hunter (CCFH) CrowdStrike Certified Cloud Specialist (CCCS) CrowdStrike Certified SIEM Analyst (CCSA) CrowdStrike Certified SIEM Engineer (CCSE)
Passing Score:	N/A (Scaled Scoring)
Exam Duration:	90 minutes
Sample Questions:	CrowdStrike IDP Sample Questions
Exam Way:	Online via Pearson VUE or Onsite at specific events
Pre Condition:	No mandatory prerequisites, but 6 months+ experience with Falcon platform and completion of recommended training is highly recommended.
Official Syllabus URL:	https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/documents/pdfs/crowdstrike-university/cfcp-certification-guide.pdf

NO.31 Which of the following would cause an identity-based incident type to change?

An exclusion added to the incident

A user linked detections to the incident in the console

A user changed the incident type in the console

Detections related to the incident

NO.32 Where would a Falcon administrator enable authentication traffic inspection (ATI) for Domain Controllers?

Identity configuration policies

Identity management settings

Identity detection configuration

Identity protection settings

NO.33 The Enforce section of Identity Protection is used to:

Configure domains, appliances, subnets, connectors, risk configuration, and settings

Define policy rules that determine what actions to take in response to certain triggers observed in the environment

View all identity-based detections and identity-based incidents in the environment

Gain an overview of the domain and indicate whether the domain follows best security practice

NO.34

Which of the followingBESTindicates that this user has an established baseline?

The user was found logging into five endpoints

The user has endpoints that they are considered owners of

The user has a risk score of 6.4

The user has recent logon activity on ETIS-WS03

NO.35

Considering the following example, what MITRE ATT&CK tactic would you use to complete the workflow?

Initial Access

Credential Access

Lateral Movement

Privilege Escalation

NO.36 Which of the following MFA providers areNOTsupported by Falcon Identity?

Firebase

Azure (Entra) MFA

Symantec VIP

DUO

NO.37 Which of the following demonstrates a detection is enabled?

The toggle next to the Detection Enabled is marked in gray

The toggle next to the Detection Enabled is marked in green

The detection has a Disabled tag next to it

The detection has an Enabled tag next to it

NO.38 What setting can be switched under the Domain Security Overview for each Active Directory domain and/or Azure tenant?

Privileged Identities

Domains

Goal

Scope

NO.39 Which of the following areNOTincluded within the three-dot menu on Identity-based Detections?

Which of the following are not included within the three-dot menu on Identity-based Detections?

Edit status

Add to Watchlist

Add exclusion

Add comment

NO.40 Falcon Identity Protection can continuously assess identity events and associate them with potential threats WITHOUTwhich of the following?

Machine-learning-powered detection rules

API-based connectors

Ingesting logs

The need for string-based queries

NO.41 Which of the following Falcon rolesCANNOTenable and disable policy rules?

Identity Protection Domain Administrator

Identity Protection Administrator

Identity Protection Policy Manager

Falcon Administrator

NO.42 The CISO of your organization recently read a report about the increased usage of identity brokers and is interested in finding a solution for the company. Which of the following makes Falcon Identity a valid solution for the organization?

Provides the ability to audit and record sessions across multiple methods, such as SSH, RDP, and SMB

Falcon Identity is able to be a middleware between Active Directory and a Human Resource Information System (HRIS)

Gives the organization the ability to proactively mitigate risks, as well as protect critical Active Directory infrastructure through Policy Rules

Allows administrators to store and delegate passwords to application servers

NO.43 Which option can be selected from the Threat Hunter menu to open the current Threat Hunter query in a new window as Graph API format?

Export to API Builder

Save as Custom Query

Save as Custom Report

Open Query in API Builder

NO.44 What is the purpose behind creating Policy Rules?

Policy Rules determine what actions to take in response to certain triggers/conditions observed within the environment

Policy Rules determine what actions an admin in the console can take before making adjustments

Policy Rules determine the scope in which the sensor collects information on the environment

Policy Rules determine how the console tracks and learns behavior for users in the environment

NO.45 Under which CrowdStrike documentation category could you find Identity Protection API information?

Tools and Reference

Falcon Management

CrowdStrike Store

CrowdStrike APIs

NO.46 What is the recommended action for the”Guest Account Enabled”risk?

Add related endpoints to a watchlist

Apply a policy rule with an “Access” trigger and “Block” action on the Guest account

Disable Guest accounts on all endpoints

Disable the endpoint in Active Directory

NO.47 How many days will an identity-based incident be suppressed if new events related to the same incident occur?

30 days

7 days

14 days

5 days

NO.48 For false positives, the Detection details can be set to new”Actions”using:

exits

remediations

exceptions

recommendations

NO.49 An account without a phone number, operating system, or role of CEO would typically be defined as:

Programmatic

Human

Enterprise

Corporate

NO.50 Within which Identity Protection menu would an administrator enableAuthentication Traffic Inspection (ATI)for a domain?

Configure > Settings

Enforce > Policy Rules

Enforce > Policy Settings

Configure > Identity Configuration Policies

CrowdStrike IDP Exam Syllabus Topics:

Topic	Details
Topic 1	Multifactor Authentication (MFA) and Identity-as-a-service (IDaaS) Configuration Basics: Focuses on accessing and configuring MFA and IDaaS connectors, configuration fields, and enabling third-party MFA integration.
Topic 2	Zero Trust Architecture: Covers NIST SP 800-207 framework, Zero Trust principles, Falcon’s implementation, differences from traditional security models, use cases, and Zero Trust Assessment score calculation.
Topic 3	Domain Security Assessment: Focuses on domain risk scores, trends, matrices, severity likelihood consequence factors, risk prioritization, score reduction, and configuring security goals and scopes.
Topic 4	Configuration and Connectors: Addresses domain controller monitoring, subnet management, risk settings, MFA and IDaaS connectors, authentication traffic inspection, and country-based lists.
Topic 5	Risk Assessment: Covers entity risk categorization, risk and event analysis dashboards, filtering, user risk reduction, custom insights versus reports, and export scheduling.
Topic 6	User Assessment: Examines user attributes, differences between users endpoints entities, risk baselining, risky account types, elevated privileges, watchlists, and honeytoken accounts.
Topic 7	Falcon Fusion SOAR for Identity Protection: Explores SOAR workflow automation including triggers, conditions, actions, creating custom templated scheduled workflows, branching logic, and loops.
Topic 8	Identity Protection Tenets: Examines Falcon Identity Protection’s architecture, domain traffic inspection, EDR complementation, human vulnerability protection, log-free detections, and identity-based attack mitigation.