IDP Certification Exam Guide + Practice Questions

Explanation:
In the Domain Security Overview, Scope is a configurable setting that allows administrators to switch between Active Directory domains and Azure tenants. This capability is essential for organizations managing multiple identity environments, as it enables targeted risk assessment and comparison across different identity infrastructures.
The CCIS documentation explains that Scope determines which domain or tenant’s identity data is displayed in the Overview dashboard, including risk scores, trends, and prioritized remediation guidance. Changing the scope does not alter risk calculations; it simply refocuses the analysis on the selected identity environment.
Other options are incorrect because:
Privileged Identities represent a subset of users, not a switchable setting.
Domains are entities, not a dashboard control.
Goal changes how risks are evaluated, not which environment is displayed.
By allowing granular control over which domain or tenant is analyzed, Scope supports accurate identity risk management in complex, hybrid environments.
Therefore, Option Dis the correct answer.

Explanation:
Falcon Identity Protection uses incident suppression windows to prevent alert fatigue while still maintaining accurate incident tracking. According to the CCIS documentation, when new events related to an existing identity-based incident occur, the incident is suppressed for 5 days.
This suppression means that Falcon does not generate a new incident for the same activity during this window. Instead, additional detections are added to the existing incident, allowing analysts to view the full progression of the threat in a single investigative context.
The 5-day suppression window ensures that ongoing identity attacks―such as repeated authentication abuse or lateral movement―are consolidated rather than fragmented across multiple incidents. This improves investigation efficiency and aligns with Falcon’s incident lifecycle management approach.
Because the suppression period is fixed at5 days,
Option Dis the correct and verified answer.

Explanation:
Falcon Identity Protection integrates with Identity-as-a-Service (IDaaS) providers to ingest cloud authentication activity and enforce identity-based policies. According to the CCIS curriculum, Okta SSO is a supported IDaaS connector that enables Falcon to ingest cloud authentication events while also applying Single Sign-On (SSO) policies.
Okta SSO provides rich identity telemetry, including login attempts, device context, and authentication outcomes. This data allows Falcon Identity Protection to correlate on-premises and cloud-based identity activity, extending identity risk analysis beyond Active Directory.
The other options are incorrect:
ADFS is an on-premises federation service, not a cloud IDaaS.
Azure NPS is used for RADIUS-based MFA, not SSO ingestion.
SAML is a protocol, not an IDaaS connector.
Because Okta SSO provides both cloud activity ingestion and SSO enforcement,
Option Bis the correct and verified answer.

Explanation:
Falcon Identity Protection automatically differentiates human and programmatic accounts by analyzing authentication traffic patterns. According to the CCIS curriculum, the platform uses behavioral analytics to observe how accounts authenticate, including frequency, protocol usage, timing, and access patterns.
Human users typically authenticate interactively and exhibit variable behavior, while programmatic or service accounts authenticate predictably and non-interactively. Falcon leverages these differences to automatically classify account types without requiring manual tagging or administrative input.
This classification is critical for accurate risk scoring, privilege analysis, and detection logic. Programmatic accounts often carry elevated privileges and long-lived credentials, making them attractive targets for attackers. Automatically identifying them allows Falcon to apply appropriate risk models and detections.
Because Falcon uses authentication traffic analysis to classify account types,
Option Cis the correct and verified answer.

Explanation:
To integrate Falcon Identity Protection with Azure AD (Entra ID) as an Identity-as-a-Service (IDaaS) provider, specific application-level credentials are required. According to the CCIS curriculum, the connector configuration requires Tenant Domain, Application (Client) ID, and Application Secret.
These values are generated when registering an application in Azure AD and are used to authenticate Falcon Identity Protection securely via OAuth-based API access. This method ensures least-privilege access and allows the connector to ingest cloud authentication activity and apply SSO-related policy enforcement.
Other options list incomplete or incorrect credential combinations.
Therefore, Option D is the correct and verified answer.