(Aug-2026) Get professional help from our IDP Dumps PDF [Q24-Q46]

Rate this post

(Aug-2026) Get professional help from our IDP Dumps PDF

Give You Free Regular Updates on IDP Exam Questions

CrowdStrike IDP Exam Syllabus Topics:

Section	Objectives
Risk Management & Investigation	– User risk assessment – Threat hunting and investigation workflows – Detection and incident response in identity context
Falcon Identity Protection Fundamentals	– Platform components and architecture – Monitoring, enforcing, exploring, configuring functions – Identity risk scoring and baseline behavior
Zero Trust Architecture	– Zero Trust implementation in Falcon Identity Protection – NIST SP 800-207 principles – Identity-based risk model
Identity Protection Tenets	– Human vs programmatic identities – Identity-based attack mitigation – Identity threat detection concepts
Policy & Configuration	– Authentication and MFA integration – Domain and connector configuration – Policy rules enforcement

QUESTION 24
When an endpoint that has not been used in the last90 daysbecomes active, a detection forUse of Stale Endpointis reported.

180 days

90 days

30 days

60 days

QUESTION 25
Can a specific detection be excluded altogether or just per entity?

Only specific entities can be excluded by using the Identity-Based Detection # Detection Exclusion page

Only detections can be disabled using the Identity-Based Detection # Detection Exclusion page

All detections can be disabled, some detections support excluding entities

Adding an exclusion for a detection creates a security hole, therefore a detection cannot be excluded

QUESTION 26
Under which CrowdStrike documentation category could you find Identity Protection API information?

Tools and Reference

Falcon Management

CrowdStrike Store

CrowdStrike APIs

QUESTION 27
Within Domain Security Overview, whatGoalincorporates all risks into one security assessment report?

Pen Testing

AD Hygiene

Reduce Attack Surface

Privileged User Management

QUESTION 28
How does the Falcon sensor for Windows contribute to the enforcement in Falcon Identity Protection?

Enforces strict password complexity rules for user accounts

Encrypts network traffic to ensure secure communication

Manages user access and permissions on domain controllers

Collects and validates domain authentication events

QUESTION 29
Within which Identity Protection menu would an administrator enableAuthentication Traffic Inspection (ATI)for a domain?

Configure > Settings

Enforce > Policy Rules

Enforce > Policy Settings

Configure > Identity Configuration Policies

QUESTION 30
Where would a Falcon administrator enable authentication traffic inspection (ATI) for Domain Controllers?

Identity configuration policies

Identity management settings

Identity detection configuration

Identity protection settings

QUESTION 31
Which of the following isNOTa default insight but can be created with a custom insight?

Using Unmanaged Endpoints

GPO Exposed Password

Compromised Password

Poorly Protected Accounts with SPN

QUESTION 32
Where in the Identity Protection module can one view the monitoring status of domain controllers?

Settings

System Notifications

Domains

Connectors

QUESTION 33
The events are excluded by default while Low, Medium, and High detections are visible.

Informational

Indiscrete

Internal

Inferior

QUESTION 34
What is the recommended action for the”Guest Account Enabled”risk?

Add related endpoints to a watchlist

Apply a policy rule with an “Access” trigger and “Block” action on the Guest account

Disable Guest accounts on all endpoints

Disable the endpoint in Active Directory

QUESTION 35
Describe the difference between a Human account and a Programmatic account.

A human account is an Administrator

A programmatic account is never authorized for multi-factor authentication

A programmatic account is only used interactively

A human account is often used interactively

QUESTION 36
To enforce conditional access policies with Identity Verification, an MFA connector can be configured for different authentication methods such as:

Page

Push

Pull

Alarm

QUESTION 37
For false positives, the Detection details can be set to new”Actions”using:

exceptions

remediations

exits

recommendations

QUESTION 38
When creating an API key, which scope should be selected to retrieve Identity Protection detection and incident information?

Identity Protection Detections

Identity Protection Incidents

Identity Protection Assessment

Identity Protection Data

QUESTION 39
Which of the following areNOTincluded within the three-dot menu on Identity-based Detections?

Which of the following are not included within the three-dot menu on Identity-based Detections?

Edit status

Add to Watchlist

Add exclusion

Add comment

QUESTION 40
By using compromised credentials, threat actors are able to bypass theExecutionphase of the MITRE ATT&CK framework and move directly into:

Initial Access

Weaponization

Discovery

Lateral Movement

QUESTION 41
Which of the following Falcon rolesCANNOTenable and disable policy rules?

Identity Protection Domain Administrator

Identity Protection Administrator

Identity Protection Policy Manager

Falcon Administrator

QUESTION 42

Considering the following example, what MITRE ATT&CK tactic would you use to complete the workflow?

Initial Access

Credential Access

Lateral Movement

Privilege Escalation

QUESTION 43
Which CrowdStrike documentation category would you search to find GraphQL examples?

CrowdStrike APIs

Threat Intelligence

XDR

Identity Protection APIs

QUESTION 44
Falcon Identity Protection can continuously assess identity events and associate them with potential threats WITHOUTwhich of the following?

Machine-learning-powered detection rules

API-based connectors

Ingesting logs

The need for string-based queries

QUESTION 45
What trigger will cause a Falcon Fusion Workflow to activate from Falcon Identity Protection?

New endpoint detection

New incident

Alert > Identity detection

Spotlight user action > Host

QUESTION 46
Any countries or regions included in the _ will trigger a geolocation detection.

Blocklist

Allowlist