Falcon Identity Specialist CCIS-200 Practice Questions & Answers • ExamPrepare

78 questions in this view

Page 1 of 13

Question 1

What does a modern zero trust security architecture offer compared to a traditional wall-and-moat (perimeter based firewall) approach?

Continuously authenticates entities regardless of origin
Issues trust certificates to internal entities and zero trust certificates to external entities
Secures the perimeter of a network and does not allow access to any entities deemed "zero trust"
Applies machine learning to gauge the trustworthiness of any external entities

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Entity Risk Scores are derived from which of the following assessment sources?

Weighted combination of risks and potentially involved incidents
Current number of accounts, privileged users, endpoints, and open incidents in the domain or tenant
Identity Protection research team’s extensive research into the ease of exploiting a vulnerability
Automatically from configured IDaaS connectors like Okta and Azure AD (Entra ID)

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

Which of the following is the BEST benefit of having Falcon Identity Protection alongside EDR?

End-to-end visibility across multiple attack vectors
The ability to provision endpoints as well as user accounts
Multiple agents on a machine to protect against identity based attacks, as well as malicious software
Configure key-based authentication on managed Linux hosts

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

How does Falcon Identity Protection perform authentication traffic analysis and inspection?

Near real-time network analysis on the Domain Controller
Endpoint and Domain Controller authentication log parsing and analysis
Relies on Falcon LogScale for log analysis
Logs are manually interpreted by SOC analysts

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

How does the Falcon sensor for Windows contribute to the enforcement in Falcon Identity Protection?

Collect and validates domain authentication events
Encrypts network traffic to ensure secure communication
Enforces strict password complexity rules for user accounts
Manages user access and permissions on domain controllers

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

By using compromised credentials, threat actors are able to bypass the Execution phase of the MITRE ATT&CK framework, and move directly into _______________.

Lateral Movement
Initial Access
Weaponization
Discovery

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.