CrowdStrike IDP Exam - Topic 7 Question 4 Discussion

In Falcon Identity Protection, detection status is visually indicated using a toggle control within the detection configuration interface. According to the CCIS documentation, when a detection is enabled, the toggle next to Detection Enabled is displayed in green.

A green toggle indicates that the detection logic is active and that Falcon will generate detections when the defined conditions are met. When the toggle is gray, the detection is disabled and will not generate alerts or contribute to incident formation.

Falcon does not rely on textual ''Enabled'' or ''Disabled'' tags to indicate detection status. Instead, the toggle color provides a clear, immediate visual indicator to administrators.

Because a green toggle explicitly represents an enabled detection, Option B is the correct and verified answer.