[UPDATED 2026] Read IDP Study Guide Cover to Cover as Literally [Q26-Q46]

Rate this post

[UPDATED 2026] Read IDP Study Guide Cover to Cover as Literally

100% Real & Accurate IDP Questions and Answers with Free and Fast Updates

CrowdStrike IDP Exam Syllabus Topics:

Section	Objectives
Topic 1: Risk Assessment & Management	– User Assessment – Risk Assessment – Domain Security Assessment – Risk Management with Policy Rules
Topic 2: Identity Protection Fundamentals & Zero Trust	– Falcon Identity Protection Fundamentals – Zero Trust Architecture – Identity Protection Tenets
Topic 3: Operations & Integration	– MFA and IDaaS Configuration Basics – Threat Hunting and Investigation – Configuration and Connectors – Falcon Fusion for Identity Protection – GraphQL API

NO.26 Describe the difference between a Human account and a Programmatic account.

A human account is an Administrator

A programmatic account is never authorized for multi-factor authentication

A programmatic account is only used interactively

A human account is often used interactively

NO.27 What trigger will cause a Falcon Fusion Workflow to activate from Falcon Identity Protection?

New endpoint detection

New incident

Alert > Identity detection

Spotlight user action > Host

NO.28 Which of the following are minimum requirements for showing the Falcon Identity Verification Dialog on the end user’s machine?

Internet Explorer 9 and Windows Server 2008

.NET 3.5 and PowerShell 5.1

Windows Vista and .NET 3.5

Windows Server 2008 and PowerShell 5.1

NO.29 For false positives, the Detection details can be set to new”Actions”using:

exits

remediations

exceptions

recommendations

NO.30 Where would a Falcon administrator enable authentication traffic inspection (ATI) for Domain Controllers?

Identity configuration policies

Identity management settings

Identity detection configuration

Identity protection settings

NO.31 Under which CrowdStrike documentation category could you find Identity Protection API information?

Tools and Reference

Falcon Management

CrowdStrike Store

CrowdStrike APIs

NO.32 Which option can be selected from the Threat Hunter menu to open the current Threat Hunter query in a new window as Graph API format?

Export to API Builder

Save as Custom Query

Save as Custom Report

Open Query in API Builder

NO.33 How does CrowdStrike Falcon Identity Protection help customers identify different types of accounts in their domain?

Implements advanced encryption algorithms for account metadata

Assigns a human authorizer to each programmatic account for approval

Analyzes authentication traffic and automatically classifies programmatic and human accounts

Conducts regular vulnerability assessments on programmatic accounts

NO.34 When creating an API client, which scope withWritepermissions must be enabled prior to using Identity Protection API?

Identity Protection Assessment

Identity Protection Health

There is no need for Write permissions in order to use IDP API

Identity Protection GraphQL

NO.35 Which menu option isNOTincluded in Falcon Identity Threat Detection (ITD)?

Event Analysis

Settings

Privileged Identities

Policy Rules

NO.36 Describe the difference between a Human account and a Programmatic account.

A programmatic account is only used interactively

A programmatic account is never authorized for multi-factor authentication

A human account is an Administrator

A human account is often used interactively

NO.37 Which of the following isNOTan available Goal within the Domain Security Overview?

Privileged Users Management

Business Privileged Users Management

AD Hygiene

Pen Testing

NO.38 Which of the following MFA providers areNOTsupported by Falcon Identity?

Firebase

Azure (Entra) MFA

Symantec VIP

DUO

NO.39 Where in the Identity Protection module can one view the monitoring status of domain controllers?

Settings

System Notifications

Domains

Connectors

NO.40 Which of the following would cause an identity-based incident type to change?

An exclusion added to the incident

A user linked detections to the incident in the console

A user changed the incident type in the console

Detections related to the incident

NO.41 Which of the following best describes how Policy Group and Policy Rule precedence works?

Policy Groups are evaluated in the order in which the groups appear on the page. The Policy Rules within those groups are evaluated in the order in which they appear in the group

There is no precedence with Policy Groups or Policy Rules; they enact policy if the conditions match

Policy Groups only group Policy Rules together. Precedence is dictated by the Rules

Policy Groups are evaluated in the order in which the groups appear on the page; however, Policy Rules within those groups have no precedence

NO.42 Which of the following statements isNOTtrue as it relates to Identity Events, Detections, and Incidents?

Events related to an incident that occur after the incident is marked In Progress will create a new incident

A detection can become an element of an incident that preceded it in time

An event can become an element of a detection that preceded it in time

Not all events are security events that become elements of detections

NO.43 The CISO of your organization recently read a report about the increased usage of identity brokers and is interested in finding a solution for the company. Which of the following makes Falcon Identity a valid solution for the organization?

Provides the ability to audit and record sessions across multiple methods, such as SSH, RDP, and SMB

Falcon Identity is able to be a middleware between Active Directory and a Human Resource Information System (HRIS)

Gives the organization the ability to proactively mitigate risks, as well as protect critical Active Directory infrastructure through Policy Rules

Allows administrators to store and delegate passwords to application servers

NO.44 In the Predefined ReportsSubjectdropdown, which category is associated with endpoints?

Insights

Events

Incidents

Accounts

NO.45 Falcon Identity Protection monitors network traffic to build user behavioral profiles to help identify unusual user behavior. How can this be beneficial to create a Falcon Fusion workflow?

Falcon Fusion is not identity based

Falcon Fusion will only work with certain users

Falcon Fusion will only send emails to the user

Falcon Fusion works with your IT policy enforcement through the use of identity and behavioral analytics

NO.46 To enforce conditional access policies with Identity Verification, an MFA connector can be configured for different authentication methods such as:

Page

Push

Pull

Alarm