Free CrowdStrike CrowdStrike-IDP Exam Questions

Become CrowdStrike Certified with updated CrowdStrike-IDP exam questions and correct answers

Page: 1 / 72

Total 358 Questions | Updated On: Aug 20, 2026

Add To Cart

Question 1

When an endpoint that has not been used in the last 90 days becomes active, a detection for Use ofStale Endpoint is reported.

A : 180 days

B : 90 days

C : 30 days

D : 60 days

Answer: B

Question 2

Your organization conducts weekly risk reviews, and the security team needs an automated report summarizing "Anomalous Logon Activities" for all privileged accounts. The report should be scheduled to run every Friday and emailed directly to the team. What configuration should you use to schedule the custom report to meet these requirements?

A : Use the Reports tab to schedule a weekly report with filters for "Privileged Account" and "Anomalous Logon Activities", and configure email delivery.

B : Configure a new dashboard view with the required filters and rely on the team to manually check it every Friday.

C : Export the audit logs every Friday, filter them for anomalies, and manually email the team.

D : Set up a filter for "Anomalous Logon Activities" in the Event Analysis dashboard, and manually export it every Friday.

Answer: A

Question 3

In the context of potential risk factors related to identity, what does the "Severity" component assess?

A : The number of identities impacted by a breach

B : The likelihood that a vulnerability will be exploited

C : The probability that an attack will occur

D : The impact of a potential security breach if the risk materializes

Answer: D

Question 4

While monitoring your CrowdStrike dashboard, you notice an incident that initially appeared as "Suspicious File Download" but was later escalated to "Malware Execution." To determine why the type changed and understand the incident’s progression, which action should you take?

A : Run a manual antivirus scan on the endpoint to verify the threat level.

B : Check if similar files were flagged in other incidents across your organization.

C : Review the incident’s activity history and associated event logs in the CrowdStrike platform.

D : Inspect the file properties and compare them with CrowdStrike’s threat intelligence database.

Answer: C

Question 5

Where in the Identity Protection module can one view the monitoring status of domain controllers?

A : Settings

B : System Notifications

C : Domains

D : Connectors

Answer: C

Page: 1 / 72

Total 358 Questions | Updated On: Aug 20, 2026

Add To Cart