CCIS: CrowdStrike Certified Identity Specialist

Domain risk is lowered by remediating each identified risk on its related entities. Falcon Identity Protection provides Recommended Actions to mitigate the risk; completing those actions removes or reduces the underlying conditions contributing to the domain risk score.

Guest accounts should be disabled on endpoints unless their use is explicitly necessary, because they can allow anonymous access. The corrective action is to disable Guest accounts on all endpoints where they are enabled.

Falcon Identity Protection policy rules are managed in the Enforce section. CrowdStrike documents Policy Rules as an Enforce resource used to create, edit, and manage rules, so Policy Rule groups are managed under Enforce.

The Workflow Author role grants the capability to build Falcon Fusion workflows, including workflows that use Identity Detections as their trigger.

Falcon Identity Protection provides identity threat detection and response across Active Directory and cloud identity providers. It helps identify Active Directory misconfigurations and vulnerabilities, detects identity-based threats, and supports prevention and response to attacks such as compromised-credential abuse and lateral movement.