Prepare Smarter for the IDP Exam

Falcon Identity Protection classifies accounts based on observed authentication behavior and associated identity attributes , not solely on naming conventions. According to the CCIS curriculum, programmatic accounts (such as service accounts or application accounts) typically lack human-centric attributes like a phone number, assigned operating system, job title, or executive role (for example, CEO).

Human accounts generally have enriched identity context sourced from directory services and identity providers, including user profile details, interactive login behavior, and endpoint associations. In contrast, programmatic accounts authenticate non-interactively, often on predictable schedules, and do not require personal attributes to function.

Falcon analyzes authentication traffic to automatically identify these characteristics and classify the account accordingly. An account missing human identity signals—such as a phone number or endpoint ownership—strongly aligns with programmatic behavior.

Because the absence of personal attributes and interactive context is a defining indicator of a programmatic account , Option A is the correct and verified answer.

Cloud-based MFA connectors integrate Falcon Identity Protection with third-party MFA providers using application-based authentication , not user credentials. As outlined in the CCIS curriculum, these connectors require an application identifier (Client/Application ID) and secret keys to securely authenticate API communications.

This approach follows modern security best practices by avoiding the use of privileged user credentials and instead leveraging scoped, revocable application secrets. The connector uses these credentials to trigger MFA challenges and exchange authentication context securely.

Options involving usernames, passwords, or domain controller details are incorrect, as Falcon Identity Protection does not store or require privileged account credentials for MFA integrations. Therefore, Option D is the correct answer.

Falcon Identity Threat Detection (ITD) provides visibility, analytics, and detection of identity-based threats but does not include enforcement capabilities . According to the CCIS curriculum, ITD customers have access to investigative and analytical features such as Event Analysis , Privileged Identities , and relevant Settings for visibility and monitoring.

Policy Rules , however, are part of Identity Threat Protection (ITP) and reside in the Enforce section of the Falcon console. Policy Rules enable automated responses and enforcement actions, such as blocking access or enforcing MFA, which are not available under ITD-only subscriptions.

This distinction is critical in the CCIS material:

ITD = Detect and analyze identity threats

ITP = Detect + enforce policy actions

Because ITD does not include enforcement functionality, Policy Rules are not available , making Option D the correct answer.

Falcon Identity Protection follows a correlation and enrichment model where events, detections, and incidents are dynamically linked over time. According to the CCIS curriculum, events that occur after an incident is marked In Progress do not automatically create a new incident . Instead, related events and detections are typically added to the existing incident , provided they fall within the incident’s correlation and suppression window.

This behavior allows Falcon to present a single evolving incident , showing the full progression of an identity attack rather than fragmenting activity into multiple incidents. Therefore, statement A is not true .

The other statements are correct:

Detections can be retroactively associated with incidents that occurred earlier if correlation logic determines relevance.

Events can be linked to detections even if the detection is created after the event occurred.

Not all events are security-relevant; many remain informational and never become detections.

This adaptive correlation model is a core concept in CCIS training and supports efficient investigation and incident lifecycle management. Hence, Option A is the correct answer.

In Falcon Identity Protection, identity-based incidents are dynamic and can evolve over time as additional detections are associated with them. According to the CCIS curriculum, an incident’s type is automatically recalculated based on the detections related to the incident , not by manual user actions.

As new identity-based detections are generated—such as credential misuse, lateral movement attempts, or abnormal authentication behavior—the platform continuously reassesses the incident. If the newly added detections indicate a different or more severe attack pattern, Falcon may automatically change the incident type to better reflect the observed threat activity.

Manual actions such as adding exclusions or linking detections do not directly change the incident type. Similarly, users cannot manually override an incident’s classification. The classification logic is driven entirely by Falcon’s analytics engine to ensure consistent, objective threat categorization.

This automated behavior is emphasized in CCIS training to highlight Falcon’s ability to adapt incident context as attacks progress , making Option D the correct answer.