CCIS: CrowdStrike Certified Identity Specialist

Review 121 CCIS practice questions with answer explanations and community insights.

Question 1

What does the following Icon indicate about the user?

  1. Never logged in
  2. Stale
  3. Not connected
  4. Disabled

Question 2

What is happening in the outlined section within this Fusion Workflow?

  1. Conditional Loop
  2. Sequential Loop
  3. Parallel Action
  4. Parallel Loop

Question 3

Given the Falcon Fusion workflow in the figure above, which of the following correctly explains this workflow?

  1. For Anomalous RPC detections of any kind, the source endpoint will be network contained
  2. For Anomalous RPC detections of any kind, the source endpoint will be added to a watchlist and network contained
  3. Any Identity Protection detections for Anomalous RPC (ZeroLogon) will result in the source endpoint being added to the watchlist and network contained
  4. Any Identity Protection detections for Anomalous RPC (ZeroLogon) will result in the source user being added to the watchlist and restricted from future logons

Question 4

Using the provided example detection, which of the following statements is TRUE in relation to Falcon detections and the MITRE ATT&CK Framework TTPs?

  1. CrowdStrike is able to identify TTPs that don't map directory to the MITRE Framework
  2. CrowdStrike is able to make updates to MITRE ATT&CK Framework TTPs with detection artifacts
  3. All Falcon detections have at least one TTP from the MITRE ATT&CK Framework
  4. CrowdStrike is able to combine TTPs from the MITRE ATT&CK Framework, the Cyber Kill Chain, as well as internal Falcon intelligence

Question 5

The meaning of the icons shown are watched, inactive, privileged and _______________?

  1. Unlocked
  2. Programmatic Account
  3. Compromised Password
  4. Stale