Falcon Identity Protection follows acorrelation and enrichment modelwhere events, detections, and incidents are dynamically linked over time. According to the CCIS curriculum,events that occur after an incident is marked In Progress do not automatically create a new incident. Instead, related events and detections are typicallyadded to the existing incident, provided they fall within the incident's correlation and suppression window.
This behavior allows Falcon to present asingle evolving incident, showing the full progression of an identity attack rather than fragmenting activity into multiple incidents. Therefore, statementA is not true.
The other statements are correct:
* Detections can be retroactively associated with incidents that occurred earlier if correlation logic determines relevance.
* Events can be linked to detections even if the detection is created after the event occurred.
* Not all events are security-relevant; many remain informational and never become detections.
This adaptive correlation model is a core concept in CCIS training and supports efficient investigation and incident lifecycle management. Hence,Option Ais the correct answer.

A modern Zero Trust security architecture fundamentally differs from the traditional wall-and-moat model by eliminating implicit trust based on network location. As defined inNIST SP 800-207and reinforced in the CCIS curriculum, Zero Trust requirescontinuous authentication and authorization of all entities, regardless of whether they originate from inside or outside the network.
Traditional perimeter-based security assumes that users and devices inside the network are trusted, focusing defenses at the boundary. This approach fails in modern environments where cloud access, remote work, and compromised credentials allow attackers to operate internally without triggering perimeter controls.
Zero Trust replaces this assumption with continuous validation using identity, behavior, device posture, and risk signals. Falcon Identity Protection operationalizes this concept by continuously inspecting authentication traffic and reassessing trust throughout a session, not just at login time.
Because Zero Trust applies universally and continuously,Option Dis the correct and verified answer.

Falcon Identity Protection provides flexible control over how identity-based detections are handled through the Detection Exclusionsframework. According to the CCIS curriculum, administrators can eitherdisable an entire detection typeor, where supported,exclude specific entitiessuch as users, service accounts, or endpoints from triggering that detection.
Not all detections support entity-level exclusions. For detections that do, exclusions allow organizations to suppress known benign behavior without disabling the detection globally. This is particularly useful for service accounts or legacy systems that generate expected but non-malicious activity. When entity-level exclusion is not supported, administrators may choose todisable the detection entirely, which stops it from generating alerts across the environment.
The CCIS documentation clearly explains this dual model:
* All detections can be disabled, regardless of type
* Only some detections support entity-based exclusions
This approach balances operational flexibility with security integrity and avoids the misconception that exclusions automatically create security gaps. Therefore,Option Cis the correct and verified answer.

Falcon Threat Hunter provides a direct integration with theAPI Builderto support advanced investigation workflows and automation. According to the CCIS curriculum, analysts can take an existing Threat Hunter query and convert it into aGraphQL-compatible formatby selectingOpen Query in API Builderfrom the Threat Hunter menu.
This option opens the current query in a new window within API Builder, automatically translating the query structure into GraphQL syntax where applicable. This enables security teams to reuse validated hunting logic for automation, reporting, or external integrations without rewriting queries from scratch.
The other menu options serve different purposes:
* Export to API Builderis not a valid menu action.
* Save as Custom Querystores the query for reuse inside Threat Hunter.
* Save as Custom Reportgenerates a reporting artifact, not an API query.
BecauseOpen Query in API Builderis the only option that opens the query in GraphQL format in a new window,Option Dis the correct and verified answer.

In Falcon Identity Protection, theExploresection of the Falcon menu is used to investigate analytical views such as theEvent Analysis dashboard. This aligns with the CCIS framework, which defines Explore as the primary area forinteractive investigation, analytics, and risk explorationacross identity data.
The Event Analysis dashboard is designed to help administrators analyzeidentity-related authentication events, behavioral patterns, and anomalous activity derived from domain traffic inspection and domain controller telemetry. These analytical capabilities are intentionally placed underExplorebecause this menu category supports hypothesis-driven investigation rather than enforcement or configuration actions.
By contrast:
* Enforceis used to apply policy rules and automated controls.
* Threat Hunteris focused on proactive hunting using queries and detection pivots.
* Configureis used to manage settings, connectors, policies, and integrations.
The CCIS documentation explicitly associates dashboards such asRisk AnalysisandEvent Analysiswith the Explore menu, emphasizing its role in understandingwhyrisk exists before taking action. Therefore,Option C (Explore)is the correct and verified answer.