Free Preparation Discussions
MENU
CrowdStrike IDP Exam - Topic 8 Question 8 Discussion
Topic #: 8
When creating an API key, which scope should be selected to retrieve Identity Protection detection and incident information?
To retrieve identity-based detections and incident-related data using the CrowdStrike APIs, the API key must include the correct permission scope. According to the CCIS curriculum, the Identity Protection Detections scope is required to access identity-based detection and incident information through GraphQL.
This scope allows API queries to retrieve:
Identity-based detections
Associated incident metadata
Detection attributes such as severity, status, and related entities
Incident data in Falcon Identity Protection is derived from detections, making the Detections scope the authoritative permission set for this information. Without this scope, GraphQL queries related to identity detections and incidents will fail authorization.
The other scopes are either too narrow or unrelated to detection retrieval. Therefore, Option A is the correct and verified answer.
Evette
4 hours agoDevora
5 days agoBlossom
10 days agoYen
16 days agoTatum
21 days agoAnnmarie
26 days agoShantay
1 month agoLouvenia
1 month agoLeanora
1 month agoCarin
2 months agoCrista
2 months agoLuis
2 months agoTamekia
3 months agoMelvin
4 months agoMariko
4 months agoDannie
4 months agoLeonor
4 months agoKarma
5 months ago