Question 1

A security engineer is configuring API access for a third-party tool to pull data from the Falcon Identity Protection API. They are confused about the differences between the available API permissions. Which permission should be granted to allow read-only access to authentication event logs?

Options :

A : IdentityAPI:Admin

B : IdentityAPI:Read

C : IdentityAPI:Write

D : IdentityAPI:EventTrigger

Answer: B

Question 2

Your organization has recently experienced a series of phishing attacks targeting users in multiple domains. You are tasked with updating the "Goal" in the Domain Security Overview of CrowdStrike's Identity Protection platform to better address this threat. Which goal should you select?

Options :

A : Strengthen Kerberos Encryption

B : Detect Suspicious Authentication Activity

C : Enhance Password Hygiene

D : Ensure Secure Privileged Access

Answer: B

Question 3

You are tasked with generating a custom report in CrowdStrike to assist in planning a risk mitigation strategy. The report must focus on accounts exhibiting high-risk behaviors, such as excessive failed logins or abnormal activity patterns. Which configuration would best achieve this goal?

Options :

A : Filter by "Login Success Rate" and exclude all accounts with 100% successful logins.

B : Focus on accounts with password changes in the past 7 days to identify potential credential leaks.

C : Add a filter for "Behavior: Abnormal Activity" and display columns for "Risk Score" and "Event Count."

D : Include only accounts with MFA enabled to narrow the focus of the report.

Answer: C

Question 4

Your security team is implementing honeytoken accounts to detect potential credential misuse in your organization. Which of the following is the best approach for creating and managing honeytoken accounts?

Options :

A : Disable honeytoken accounts after creation to avoid accidental usage.

B : Ensure that honeytoken accounts are identical to standard user accounts and log their activity daily.

C : Create accounts that resemble legitimate users but are configured to alert on any usage.

D : Use accounts with administrative privileges and ensure they are regularly accessed by administrators.

Answer: C

Question 5

What key factors contribute to the calculation of a Falcon user’s Zero Trust Assessment (ZTA) score?

Options :

A : The average time spent on critical applications by the user.

B : Device health, user behavior, application access history, and security posture.

C : Network bandwidth usage and geographic location of the user.

D : Static user role and permissions set by the administrator.

Answer: B

Free CrowdStrike-IDP Mock Exam – Practice Online Confidently

Buying Options: