CCIS: CrowdStrike Certified Identity Specialist

By CrowdStrike · Question Mode

QuestionQ69

VerifiedFalcon Fusion for Identity Protection

Question Image

Given the Falcon Fusion workflow shown above, which of the following correctly describes this workflow?

Explanation

An Identity Protection detection named Anomalous RPC (ZeroLogon) satisfies the workflow condition. The configured actions add the source endpoint to a watchlist and contain the device, which network-contains that endpoint.

Community Discussion

No comments yet. Be the first to start the discussion!