100+ Free CCIS Practice Questions
Pass your CrowdStrike Certified Identity Specialist (CCIS) exam on the first try — instant access, no signup required.
Which best describes the difference between a GraphQL query and a mutation?
Explore More CrowdStrike Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
Key Facts: CCIS Exam
60
Exam Questions
CrowdStrike CCIS Exam Guide
90 min
Exam Duration
CrowdStrike CCIS Exam Guide
$250
Exam Fee
CrowdStrike / Pearson VUE
3 years
Cert Validity
CrowdStrike Certification Program
12
Exam Domains
CCIS Exam Guide (Mar 2026)
100
Free Practice Qs
OpenExamPrep
The CCIS is CrowdStrike's identity-focused certification, targeting IAM administrators and identity-threat analysts who run Falcon Identity Protection. It is a 60-question, 90-minute Pearson VUE exam (online or test center) with a $250 attempt fee and a 3-year recertification cycle. The exam covers 12 domains: Zero Trust, identity tenets, Falcon Identity Protection fundamentals, Domain Security Assessment, risk and user assessment, threat hunting, policy rules, configuration and connectors, MFA/IDaaS, Falcon Fusion, and the GraphQL API. CrowdStrike does not publish the passing score or pass rate.
Sample CCIS Practice Questions
Try these sample questions to test your CCIS exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1Which NIST publication defines the canonical Zero Trust Architecture model that Falcon Identity Protection aligns with?
2Which statement best summarizes the core Zero Trust principle that drives identity-based access decisions?
3In the NIST SP 800-207 reference model, which logical component makes the actual access decision for a request?
4Which Zero Trust tenet directly justifies challenging a user with MFA even after they have an active Kerberos TGT?
5Which list correctly enumerates pillars commonly cited in Zero Trust architectures (CISA Zero Trust Maturity Model)?
6Why is identity considered the new perimeter in modern Zero Trust deployments?
7Which sentence most accurately describes how Falcon Identity Protection extends Zero Trust to legacy Active Directory?
8Which scenario is the WEAKEST justification for adopting a Zero Trust approach to identity?
9Which capability is foundational to the Identity Protection tenet of 'continuous visibility into all identities'?
10Which Identity Protection tenet is BEST illustrated by reducing the privileges granted to a service account from Domain Admin to a delegated GMSA scoped to one server?
About the CCIS Exam
The CrowdStrike Certified Identity Specialist (CCIS) validates an analyst's or administrator's ability to manage domain security and identity-based threats using Falcon Identity Protection (CrowdStrike's Identity Threat Detection and Response platform, formerly Preempt). Candidates are expected to fluently apply NIST SP 800-207 Zero Trust principles to Active Directory and Microsoft Entra ID, deploy and tune Falcon Identity Protection sensors and connectors, interpret Domain Security Assessment findings, score and tune identity risk, hunt classic AD attacks (Pass-the-Hash, Kerberoasting, Golden/Silver Tickets, DCSync), design policy rules with conditional-access actions including step-up MFA via supported IDaaS providers, build Falcon Fusion playbooks, and use the Identity Protection GraphQL API.
Assessment
Approximately 60 multiple-choice questions covering Zero Trust, Identity Protection tenets, Falcon Identity Protection fundamentals, Domain Security Assessment, risk and user assessment, threat hunting, policy rules, configuration and connectors, MFA/IDaaS, Falcon Fusion, and the GraphQL API.
Time Limit
90 minutes
Passing Score
Set by CrowdStrike (not publicly disclosed)
Exam Fee
$250 (CrowdStrike / Pearson VUE)
CCIS Exam Content Outline
Zero Trust Architecture
NIST SP 800-207 ZTA model, ZT tenets (verify explicitly, least privilege, assume breach), CISA ZT pillars (Identity, Device, Network, Application, Data), and how Falcon Identity Protection enforces ZT at the AD/Entra ID layer.
Identity Protection Tenets
Continuous identity visibility, least privilege, dynamic risk evaluation, automated response, and identity-as-perimeter principles for human, service, and shared accounts.
Falcon Identity Protection Fundamentals
Origin (Preempt acquired 2020 → Falcon Identity Protection / ITDR), domain controller sensor placement with passive monitoring of LDAP/Kerberos/NTLM/DNS/RPC, hybrid AD + Microsoft Entra ID coverage, and console areas (Detections, Risk, Threat Hunting, Policy, Configuration).
Domain Security Assessment
Reviewing AD authentication hygiene: NTLMv1 acceptance, LDAP signing/channel binding, anonymous LDAP bind, Kerberos pre-authentication misconfigurations, SMB signing, weak ciphers (RC4-HMAC), unconstrained delegation, and krbtgt rotation.
Risk Assessment
Composite, dynamic identity risk scoring across users, endpoints, and accounts; risk factor weighting; risk tuning with scoped exceptions; risk-aware policy enforcement.
User Assessment
Privileged users (Domain Admins, Tier 0), service accounts, dormant/shared/generic accounts, password hygiene flags (PasswordNotRequired, password never expires), and gMSA modernization.
Threat Hunting & Investigation
Hunting Pass-the-Hash, Kerberoasting, AS-REP roasting, Golden and Silver Tickets, DCSync, lateral movement, RC4 spikes, anomalous logons, and pivoting via entity timelines.
Risk Management with Policy Rules
Designing conditional-access style policy rules with allow, audit, deny, and MFA-challenge actions; staged rollout from audit to enforce; risk-aware conditions; break-glass exclusions.
Configuration & Connectors
DC sensor prerequisites, Falcon cloud connectivity, Microsoft Entra ID connector, detection tuning workflows, scoped exception management, change management, and post-deployment validation.
MFA & IDaaS Configuration Basics
MFA factors (FIDO2/WebAuthn, push with number matching, OTP, SMS), the MFA Connector and RADIUS-based MFA for legacy apps, IDaaS integrations (Duo, Okta, Microsoft Authenticator), enrollment, and protections against MFA fatigue.
Falcon Fusion for Identity Protection
Fusion SOAR triggers (detections, alerts, schedules), identity playbooks (auto-disable account, force MFA reset, isolate host, krbtgt rotation runbook), break-glass exclusions, and cross-module response with Falcon Insight and NG-SIEM.
GraphQL API
Identity Protection GraphQL queries (entities, detections, policies) and mutations (resolve, act), OAuth2 client-credentials flow with JWT bearer tokens, filtering and pagination, API credential hygiene, and CI/CD gating patterns.
How to Pass the CCIS Exam
What You Need to Know
- Passing score: Set by CrowdStrike (not publicly disclosed)
- Assessment: Approximately 60 multiple-choice questions covering Zero Trust, Identity Protection tenets, Falcon Identity Protection fundamentals, Domain Security Assessment, risk and user assessment, threat hunting, policy rules, configuration and connectors, MFA/IDaaS, Falcon Fusion, and the GraphQL API.
- Time limit: 90 minutes
- Exam fee: $250
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
CCIS Study Tips from Top Performers
Frequently Asked Questions
What is the CCIS exam format?
The CrowdStrike Certified Identity Specialist (CCIS) is a closed-book proctored exam delivered via Pearson VUE (test center or OnVUE) on behalf of CrowdStrike University. CrowdStrike's exam guide indicates approximately 60 multiple-choice questions in 90 minutes, covering Falcon Identity Protection across 12 domains including Zero Trust, AD posture, risk, hunting, policy, MFA, Fusion, and the GraphQL API.
How much does the CCIS exam cost?
The CCIS attempt fee is $250 USD per appointment via Pearson VUE. Recommended preparation includes the Falcon Identity Protection training through CrowdStrike University and hands-on time with the Falcon Identity Protection console covering AD and Microsoft Entra ID.
What is the CCIS passing score?
CrowdStrike does not publicly disclose the CCIS passing score or pass-rate statistics. Plan to be comfortable across all 12 exam domains rather than targeting a specific cut score, and aim for consistent 80%+ on full-length practice attempts before scheduling.
How long is the CCIS credential valid?
The CrowdStrike Certified Identity Specialist credential is valid for 3 years from the date of issue. Recertification requires passing the current CCIS exam (or a higher-tier identity credential where applicable) before the expiration date.
Who should take the CCIS?
CCIS is targeted at identity and access management (IAM) administrators, identity-threat analysts, and policy/access administrators who operate Falcon Identity Protection (formerly Preempt). It validates ability to manage domain security with identity-based controls, administer policy rules, automate identity threat response, and manage risk across the authentication landscape.
What hands-on skills should I have before sitting CCIS?
You should be comfortable with NIST SP 800-207 Zero Trust principles, AD authentication (Kerberos, NTLM, LDAP), Microsoft Entra ID basics, Falcon Identity Protection sensor and connector setup, the Domain Security Assessment, risk-tuning workflows, identity threat hunts (Pass-the-Hash, Kerberoasting, Golden/Silver Tickets, DCSync), policy rule design with MFA challenge, Falcon Fusion playbooks, and the Falcon Identity Protection GraphQL API with OAuth2/JWT auth.
Is the CCIS the same as CCFA, CCFH, or CCFR?
No. CCFA (Administrator) is platform configuration and policy, CCFH (Hunter) goes deepest on Event Search/FQL hunting, and CCFR (Responder) focuses on incident response. CCIS is the identity-focused specialist track centered on Falcon Identity Protection (Identity Threat Detection and Response) for AD and Entra ID.