CrowdStrike IDP Dumps

The Domain Security Overview in Falcon Identity Protection usesGoalsto frame identity risks into focused security assessment perspectives. These goals allow organizations to evaluate identity posture based on specific security priorities such as directory hygiene, privilege exposure, or overall attack surface reduction.

According to the CCIS curriculum, theavailable GoalsincludePrivileged Users Management,AD Hygiene,Pen Testing, andReduce Attack Surface. These goals are predefined by CrowdStrike and determine how risks are grouped, weighted, and presented in reports.

Business Privileged Users Managementisnot an available Goalwithin the Domain Security Overview. While Falcon Identity Protection does support the concept ofbusiness privilegesand evaluates their impact on users and entities, this concept is handled through risk analysis and configuration—not as a selectable Domain Security Goal.

The CCIS documentation clearly distinguishes betweenGoals(which control reporting and assessment views) andbusiness privilege modeling(which influences risk scoring). Therefore,Option Bis the correct and verified answer.

Falcon Identity Protection automatically differentiateshuman and programmatic accountsby analyzingauthentication traffic patterns. According to the CCIS curriculum, the platform uses behavioral analytics to observe how accounts authenticate, including frequency, protocol usage, timing, and access patterns.

Human users typically authenticate interactively and exhibit variable behavior, while programmatic or service accounts authenticate predictably and non-interactively. Falcon leverages these differences to automatically classify account types without requiring manual tagging or administrative input.

This classification is critical for accurate risk scoring, privilege analysis, and detection logic. Programmatic accounts often carry elevated privileges and long-lived credentials, making them attractive targets for attackers. Automatically identifying them allows Falcon to apply appropriate risk models and detections.

Because Falcon usesauthentication traffic analysisto classify account types,Option Cis the correct and verified answer.

Falcon Identity Protection supportsgeolocation-based detectionsto identify potentially risky authentication activity originating from unexpected or prohibited locations. According to the CCIS curriculum, any countries or regions added to theBlocklistwill automatically trigger a geolocation-based detection when authentication traffic is observed from those locations.

The Blocklist is designed to explicitly definedisallowed geographic regions. When an authentication attempt originates from a blocklisted country or region, Falcon treats the activity as suspicious and generates a detection or contributes to increased identity risk.

By contrast:

An Allowlist defines approved locations and suppresses detections.

A Dictionary is used for password-related analysis.

An Exclusion suppresses detections rather than generating them.

Because geolocation detections are triggered byblocklisted locations,Option Ais the correct answer.