CCIS: CrowdStrike Certified Identity SpecialistDemo

Guest accounts should be disabled on endpoints unless their use is explicitly necessary, because they can allow anonymous access. The corrective action is to disable Guest accounts on all endpoints where they are enabled.

Falcon Identity Protection policy rules are managed in the Enforce section. CrowdStrike documents Policy Rules as an Enforce resource used to create, edit, and manage rules, so Policy Rule groups are managed under Enforce.

The Workflow Author role grants the capability to build Falcon Fusion workflows, including workflows that use Identity Detections as their trigger.

Falcon Identity Protection provides identity threat detection and response across Active Directory and cloud identity providers. It helps identify Active Directory misconfigurations and vulnerabilities, detects identity-based threats, and supports prevention and response to attacks such as compromised-credential abuse and lateral movement.

Searching timeline records requires Identity Protection Timeline: Read. Falcon Identity Protection GraphQL searches require Identity Protection GraphQL: Write, because queries are submitted through the GraphQL API using its write scope.

Falcon Identity Verification Dialog on-screen notifications require Internet Explorer 9 or later and are supported on the applicable Windows platforms, including Windows Server 2008. PowerShell 5.1 is not required to display the dialog.

A risk score of 7.0 is the lower boundary of the High severity band on the standard 0–10 security-risk scale.

Falcon Identity Protection performs real-time inspection of authentication protocols, including Kerberos, NTLM, and LDAP, through its visibility at the Domain Controller. This enables live authentication-traffic analysis rather than log-only analysis. CrowdStrike: Detecting Kerberos Relay Attack via DNS CNAME Abuse

Informational events are lower-priority notifications and are excluded from the default display, while Low, Medium, and High detections remain visible. Microsoft Sentinel defines Informational, Low, Medium, and High as alert severity values.

Falcon Identity Protection automatically classifies identities as human or programmatic by analyzing live authentication traffic and behavioral patterns. This account classification enables separate visibility and policy treatment for different identity types.

Honeytoken accounts are decoy accounts designed to lure and detect malicious actors within an organization. Activity involving such accounts provides a high-confidence alert of potentially unauthorized behavior.

NIST SP 800-207 defines zero trust and zero trust architecture, including zero-trust principles, deployment models, implementation guidance, and use cases for improving enterprise security.

Falcon Identity Protection can enforce risk-based adaptive authentication policies that challenge a user with multifactor authentication when suspicious behavior or elevated risk is detected. CrowdStrike documents policy-based MFA challenges as an automatic response to identity-risk conditions.

Falcon Identity Protection detection events are exposed to Falcon Fusion through the Alert trigger category using the Identity detection subtype.

API Builder displays the Threat Hunter query in GraphQL format together with the query results, enabling the hunt to be used through the Graph API.

Policy evaluation follows the displayed sequence at both hierarchy levels: Policy Groups are processed in their page order, and the Policy Rules within each Policy Group are processed in their order within that group.

A baseline captures normal user behavior and context, including whether the source endpoint is one the user owns or routinely uses.

A For Each step iterates through every item in the search-results collection and performs the following watchlist action for each item. This is a sequential loop, not a conditional branch or parallel execution.

An account icon paired with a web/automation symbol denotes a programmatic account, meaning an account used by an application, service, or automated process rather than a human user.

An Analysis-based risk is disabled by setting the toggle associated with that risk to the off position and saving the configuration.

AdminAccountRole is the general Identity Protection API role classification for administrator accounts, so filtering on it returns administrator users across applicable admin-role types. DomainAdminsRole is limited to the Domain Admins role, while BusinessPrivilegeRole is a separate, more specific classification.

Domain Security Overview includes the goals Reduce Attack Surface, Pen Testing, AD Hygiene, and Privileged Users Management. Privileged Groups Management is not an available goal.

The enabled exclusion suppresses the detection when the destination is a domain controller, the initiating user belongs to Domain Admins, and the source host has a Zero Trust Assessment score from 90 through 100.

A programmatic account represents software, automation, or a service rather than an individual person, so human-associated attributes such as a phone number, an operating system, and an executive role do not normally apply.