CCISPreview

When an endpoint which has not been used in the last _______________ becomes active, a detection for Use of Stale Endpoint is reported.

What is the purpose behind creating Policy Rules?

Using the Identity Protection API, which role is used to return any admin user?

Which of the following is a valid format for uploading a custom dictionary for compromised passwords?

Which of the following are minimum requirements for showing the Falcon Identity Verification Dialog on the end user's machine?

When creating an API client, which scope with Write permissions must be enabled prior to using Identity Protection API?

What is the minimum risk score for an entity to be considered "High Risk"?

How could a conditional access policy prevent a threat actor from using a privileged account?

Which section of the Falcon menu holds information about Domain Security Overview, Identity Based Detections, Detections Dashboard, Identity-Based Incidents, and Privileged Identities?

What role does a human authorizer play in the context of CrowdStrike Falcon Identity Protection?

Which of the following actions under the Investigate menu will pivot to Falcon Identity Protection from an Identity-based detection?

Remediating which severity level would have the most impact on a user's risk score?

A detection is a warning about a(n) _______________ security event; an event that does not conform to the pattern of behavior for an entity.

On the Risk Analysis dashboard, ________________ displays a four-quadrant graph that plots the risk score and impact for each department or OU.

You have been tasked with protecting shares on the Human Resources file server with Multi-Factor Authentication. Which of the following policy conditions would you use to trigger a Policy Rule?

Where in the Identity Protection Module can one view the monitoring status of domain controllers?

The Enforce section of Identity Protection is used to:

To enable sending Multi-factor authentication (MFA) requests to an end user, the external MFA provider must be configured first. How long does it take to register the change?

In the _______________ view, user accounts will have some of the following data: Organizational Unit, Domain / Tenant, Title, Department.

An administrator wants to remove a rule from an existing rule group. How would that be accomplished?

Falcon Identity Protection can continuously assess identity events and associate them with potential threats WITHOUT which of the following?

How does Falcon Identity Protection work to mitigate threats that bypass the traditional MITRE framework?

Which of the following would cause an identity based incident type to change?

In CrowdStrike Falcon Identity Protection, what can be done when abnormal or risky user behavior is detected?