IDP Dumps With Exact Questions and Answers

Identity Protection API documentation is part of CrowdStrike’s centralized API documentation structure. According to the CCIS curriculum,Identity Protection API information is located under the “CrowdStrike APIs” documentation category.

This category includes:

API authentication and scopes

Identity Protection GraphQL schemas

Query examples for detections, incidents, users, and risk

Usage guidance and limitations

CrowdStrike consolidates all API-related documentation in one location to ensure consistent access and maintenance across Falcon modules. Identity Protection APIs are not documented under Falcon Management, Store, or general reference sections.

Because all product APIs—including Identity Protection—are documented underCrowdStrike APIs,Option Dis the correct and verified answer.

Falcon Identity Protection calculates user risk scores based on a combination ofprivilege level,credential exposure, andbehavioral indicators. According to the CCIS curriculum, aprivileged user with a compromised passwordrepresents one of the highest-risk identity scenarios.

Privileged accounts—such as administrators or service accounts with elevated access—already pose increased risk due to their access scope. When Falcon detects that such an account’s credentials have been compromised, the risk escalates significantly because attackers can immediately gain high-impact access without further escalation.

The other options do not inherently represent the same level of risk:

Logging in from a shared endpoint may increase risk but is context-dependent.

Stale users are risky but typically lower risk than active compromised credentials.

Domain Admin group membership alone does not imply compromise.

Becausecredential compromise combined with privilegedramatically increases attack potential,Option Bis the correct and verified answer.

In Falcon Identity Protection, thethree-dot (⋮) action menuon anidentity-based detectionprovides analysts with a limited set of actions that applydirectly to the detection itself. According to the CCIS curriculum, these actions are designed to support investigation workflow, tuning, and documentation.

The supported actions in the detection-level three-dot menu include:

Edit status, which allows analysts to update the detection state (for example, New, In Progress, or Closed).

Add comment, which enables collaboration and documentation directly on the detection.

Add exclusion, where supported, to suppress future detections that match known benign behavior.

Add to Watchlistisnot includedin this menu because watchlists are applied toentities(such as users, service accounts, or endpoints), not to detections. Watchlists are managed from entity views or investigation workflows and are used to increase visibility and monitoring priority for specific identities—not to act on individual detections.

This distinction is emphasized in CCIS training to reinforce the separation betweenentity-centric actionsanddetection-centric actions. Because watchlists operate at the entity level,Option Bis the correct and verified answer.