CCIS: CrowdStrike Certified Identity Specialist

CCIS: CrowdStrike Certified Identity Specialist practice questions, page 4 of 5, with answer review and explanations.

Question 16

Which of the following is the best use case for Honeytoken accounts?

  1. Luring attackers that may be in the organization
  2. Alerting on unauthorized access to Domain Controllers
  3. Notifying the use of a ‘Break Glass’ account
  4. Collecting passwords from failed logon attempts

Question 17

What basic configuration fields are typically required for cloud Multi-Factor Authentication connectors?

  1. Service account user name and password
  2. Connector application identifier & secret keys
  3. Domain controller host name and IP address
  4. Domain Administrator user name and password

Question 18

Due to a ransomware incident, the previous administrator disabled the Identity Protection detection for Suspicious lateral movement. Which answer describes the potential risk of this configuration?

  1. This will prevent legitimate lateral movement from occurring
  2. Any potentially malicious lateral movement activity will not have detections within Identity Protection
  3. This configuration is acceptable, as long as the source user is added to the watch list
  4. This configuration is acceptable, as long as an Identity-based policy is configured to prevent all ransomware lateral movement

Question 19

The Monitor section of Identity Protection can be used to:

  1. Configure domains, appliances, subnets, connectors, risk configuration, and settings
  2. Modify predefined reports and review a list of saved & custom reports
  3. Search through raw events, detect and identify security events, or further investigate security events reported by the system
  4. View the overall AD hygiene, risk level and the priorities facing the domain from the security posture perspective

Question 20

Which of the following demonstrates a detection is enabled?

  1. The toggle next to the Detection Enabled is marked in gray
  2. The toggle next to the Detection Enabled is marked in green
  3. The detection has a Disabled tag next to it
  4. The detection has an Enabled tag next to it