CrowdStrike Certified Falcon Identity Specialist

CCIS · ● Active · Professional · CrowdStrike

Note: This certification focuses on identity threat detection and management within CrowdStrike Falcon Identity Protection, the platform built on the acquisition of Preempt Security (2020). CCIS is a professional-level credential above the associate-level CCFA, targeting IAM analysts and identity security administrators managing Zero Trust and identity-centric security strategies across enterprise domains.

Exam facts

Vendor source — CrowdStrike Falcon Certification Program ↗

Official exam guide — CCIS Certification Guide PDF ↗

Exam registration — Pearson VUE CrowdStrike Testing ↗

Event testing — CrowdStrike Fal.Con Certification ↗

About

The CrowdStrike Certified Falcon Identity Specialist (CCIS) validates expertise in identity threat detection, risk-based authentication, Active Directory hardening, and lateral movement prevention within CrowdStrike's Falcon Identity Protection platform. This professional-level credential targets identity and access management (IAM) analysts, security policy administrators, domain security engineers, and threat hunters managing identity-based risk across enterprise environments.

The CCIS sits above the administrator-track CCFA (Certified Falcon Administrator), representing a specialized discipline in identity-centric security and Zero Trust architecture. Practitioners holding the CCIS credential demonstrate ability to architect conditional access policies, investigate identity-based incidents, detect anomalous authentication behavior, and prevent privilege escalation and lateral movement attacks.

Strategic context: CrowdStrike acquired Preempt Security in September 2020 for $96 million, integrating its Zero Trust and conditional access technology into the Falcon platform. This acquisition significantly enhanced CrowdStrike's ability to detect and prevent identity-based attacks, lateral movement, and privilege escalation—the three pillars of the MITRE ATT&CK KILL CHAIN that Falcon Identity Protection now monitors at the identity layer.

Audience: The CCIS is designed for security professionals who spend 30%+ of their time managing identity security, configuring authentication policies, investigating identity-based incidents, or architecting zero-trust access controls. It is particularly valuable for SOC teams with dedicated identity tiers, IAM engineers supporting threat-driven access decisions, incident responders specializing in credential-based attacks, and domain security specialists implementing Zero Trust.

Domain context — Security

Endpoint detection and response (EDR), extended detection and response (XDR), and identity protection unified into a single Falcon platform. Identity security is a foundational pillar of modern threat prevention and Zero Trust architecture.

Read full deep dive — CrowdStrike Falcon Ecosystem →

Topics covered

The CCIS exam blueprint covers identity threat management and Zero Trust architecture through the Falcon Identity Protection lens. Official exam objectives organize content across five major knowledge domains, each weighted in exam scoring:

Identity Threat Detection & Response (25–30%)

• Detecting and responding to identity-based attacks: pass-the-hash, golden ticket, silver ticket, credential stuffing, brute force, dictionary attacks, password spray attacks
• Understanding attacker behavior patterns and techniques leveraging compromised credentials and lateral movement tactics
• Configuring detection rules and response actions in Falcon Identity Protection console
• Automated response workflows: block authentication, challenge with MFA, force re-authentication, escalate to SOC, log for audit
• Investigating identity-based incidents and reconstructing attack chains from authentication telemetry and event logs
• Integrating identity signals with endpoint and network signals for comprehensive correlation and detection
• Threat hunting in authentication logs: identifying patterns of reconnaissance, lateral movement, data exfiltration, persistence
• Identity-based indicators of compromise (IoCs) and behavioral anomalies that indicate breach

Active Directory Security & Hardening (20–25%)

• Domain security best practices: tier 0 (critical assets), tier 1 (servers), tier 2 (workstations) defense strategy and segmentation
• Kerberos and NTLM authentication protocols: security implications, attack surface expansion, delegation attack vectors
• Active Directory abuse detection: privilege escalation, object modification, group policy manipulation, schema modification attacks
• Delegation risks: unconstrained delegation, constrained delegation, resource-based constrained delegation (RBCD) security implications
• NTLM relay attack prevention, signing enforcement, sealing mechanisms, and protocol hardening
• Modern authentication enforcement: disabling legacy protocols, enforcing Kerberos, blocking NTLM downgrades
• Password policies, account lockout strategies, account security monitoring, and password hash extraction prevention
• Service account hardening, monitoring for anomalous usage, and privilege abuse detection
• Domain controller security, replication monitoring, and unauthorized access detection
• AdminSDHolder and access control list (ACL) management for high-privilege objects

Risk-Based Authentication (20–25%)

• Implementing conditional access rules based on user, location, device, and behavior signals
• Risk scoring algorithms: how Falcon Identity Protection calculates identity risk in real time and adapts policies
• Risk factors: impossible travel detection, unusual sign-in locations, anomalous authentication times, failed attempts, session anomalies
• Multi-Factor Authentication (MFA) enforcement and risk-adaptive challenge decisions based on risk scores
• Continuous authentication and step-up authentication workflows for sensitive operations
• Policy rule configuration and automation: condition-based actions, triggers, and enforcement
• Anomaly detection and user behavior analytics (UBA) in authentication logs and domain telemetry
• Machine learning models for authentication anomaly detection and false positive reduction

Lateral Movement Prevention (15–20%)

• Detecting lateral movement via identity telemetry: AD logs, NTLM traffic analysis, Kerberos ticket request patterns
• Privilege escalation patterns: pass-the-hash, pass-the-ticket, Kerberoasting, credential stuffing within domain, token impersonation
• Domain telemetry collection and analysis: Windows security event forwarding, advanced audit policies, SIEM integration
• Monitoring and blocking suspicious authentication patterns within the domain: impossible travel, unusual hours, unusual locations
• Service account abuse detection and privileged account monitoring for anomalous behavior
• Lateral movement attack chains and their prevention: reconnaissance, credential acquisition, movement, persistence, data exfiltration
• Attack path analysis: identifying potential pivot points in the domain, high-risk privilege paths, service dependencies

Policy Administration & Incident Response (10–15%)

• Configuring policy rules and response actions in Falcon Identity Protection management console
• Automated response workflows and escalation procedures for different threat levels
• Investigating identity-based detections: drill-down analysis, contextual information gathering, forensic reconstruction
• Root cause analysis of identity breaches: identifying initial compromise vector, lateral movement steps, persistence mechanisms
• Incident timeline reconstruction from authentication events, event logs, and correlated endpoint data
• Reporting and metrics for identity security posture and key performance indicators (KPIs) for management
• Zero Trust identity architecture principles in practice: continuous verification, assume breach, minimize privileged access
• Compliance considerations: audit trails, evidence preservation, investigation procedures for regulatory requirements

Source: CrowdStrike CCIS Exam Guide ↗

Common skills at Security · Professional

Shared security analyst and engineer competencies at professional (post-associate) level, applicable across identity, endpoint, and threat hunting disciplines.

• Identity threat intelligence and behavioral analysis
• Security policy design and enforcement at enterprise scale
• Incident investigation and forensic reconstruction
• Cloud and hybrid identity architecture planning
• Risk assessment and compliance alignment (SOX, HIPAA, PCI-DSS, NIST)
• Zero Trust and defense-in-depth security strategy
• Advanced authentication and authorization protocol expertise
• Lateral movement detection and prevention techniques
• Log analysis and SIEM query construction
• Threat modeling and attack chain analysis
• Vulnerability assessment and security hardening
• Stakeholder communication and technical reporting
• Vendor platform administration and troubleshooting

Recommended courses at Security · Professional

Course selection note: CrowdStrike University delivers instructor-led and on-demand training with hands-on labs in a cloud-based Falcon training environment, providing direct access to Falcon Identity Protection functionality. Udemy options provide affordable practice and Q&A review. No dedicated bootcamp for CCIS exists; candidates typically combine vendor training with self-study using exam guides and practice exams. Budget 60–80 hours of study time for adequate preparation.

Practice exams

Practice exam rule: Most platforms offer 300–500 unique questions across 4–6 full-length mock exams. Practice exams are critical for CCIS preparation; aim to score 85%+ consistently before attempting the live exam. Focus on scenario-based questions rather than simple memorization, as the exam tests applied knowledge of real-world identity threat scenarios.

Books

No published books dedicated solely to the CrowdStrike CCIS exam currently exist. Candidates should rely on CrowdStrike official training materials (via CrowdStrike University), exam guides, knowledge base articles, and Active Directory security deep-dives from Microsoft.

Recommended background reading on identity security and Zero Trust:

Book note: While no CCIS-specific textbook exists, "Zero Trust Networks" covers foundational concepts that CCIS validates. Gartner's IAM research is valuable for understanding industry best practices and risk frameworks. Microsoft's Active Directory security documentation is also essential reference material.

Exam preparation strategy

Week-by-week study plan (8 weeks recommended):

Weeks 1–2: Foundations

• Complete CrowdStrike University Falcon Identity Protection training (or equivalent)
• Review exam guide and identify knowledge gaps
• Study Active Directory and Kerberos fundamentals from Microsoft documentation
• Take your first diagnostic practice test to establish baseline (aim for 60%+)

Weeks 3–4: Domain deep-dives

• Focus on Identity Threat Detection & Response (25–30% weight)
• Study Active Directory Security & Hardening (20–25% weight)
• Complete practice questions from Udemy and VMExam
• Score target: 70%+ on domain-specific questions

Weeks 5–6: Risk & Lateral Movement

• Study Risk-Based Authentication (20–25% weight)
• Study Lateral Movement Prevention (15–20% weight)
• Complete additional practice exams (aim for 2–3 full-length exams)
• Score target: 75%+ on practice exams

Weeks 7–8: Final review & testing

• Review weak areas identified in practice testing
• Take 2–3 final full-length practice exams in exam-like conditions (90 minutes, no interruptions)
• Score target: 85%+ on two consecutive exams before scheduling live exam
• Review scenario-based questions and practice incident investigation workflows

Key study tips:

• Hands-on experience matters: spend time in Falcon Identity Protection console if possible
• Focus on real-world scenarios, not just theoretical knowledge
• Study attack chains and lateral movement patterns extensively
• Practice time management: 90 minutes for 60 questions = 1.5 minutes per question average
• Join study groups or forums to discuss difficult concepts with peers

Typical job titles at Security · Professional

Identity and Access Management (IAM) Analyst · Identity Threat Analyst · Security Policy Administrator · Domain Security Engineer · Zero Trust Security Architect · Access Management Specialist · Risk-Based Authentication Engineer · Incident Response Analyst (Identity Focus) · Security Operations Center (SOC) Analyst (Identity Tier) · Privileged Access Management (PAM) Specialist

(Job titles drawn from current job-board postings that list CCIS or equivalent identity security certifications as required or preferred.)

Salary

Salary context: Ranges reflect IAM analyst and identity security specialist roles at the professional level; CCIS-certified professionals typically command premiums (5–15%) over unaccredited peers in mature security operations. Regional variation reflects cost-of-living, market maturity in identity security, and local certification demand. Data sourced from 2025–2026 surveys.

Skills validated

Cert-specific technologies and methodologies tested by CCIS.

• CrowdStrike Falcon Identity Protection platform – Detection rules, response actions, policy administration, investigation workflows
• Active Directory (AD) – Domain structure, security delegation, abuse detection, hardening best practices
• Kerberos Protocol – Authentication flows, ticket-granting service (TGS), ticket-granting ticket (TGT), delegation risks, Kerberoasting
• NTLM Authentication – Protocol flow, relay attacks, signing and sealing, NTLM traffic analysis
• Identity Threat Detection Patterns – Pass-the-hash, golden ticket, silver ticket, credential stuffing, brute force, spray attacks, Kerberoasting
• Risk-Based Authentication – Risk scoring algorithms, conditional access, continuous authentication, step-up authentication, MFA
• Multi-Factor Authentication (MFA) – Enforcement policies, risk-adaptive challenges, integration with access controls
• Lateral Movement Detection – Domain telemetry analysis, anomaly detection, attack chain reconstruction
• Zero Trust Identity Architecture – Trust-no-one principles, microsegmentation via identity, continuous verification
• Policy Rules and Automation – Detection rule logic, response orchestration, escalation workflows
• Privilege Access Management (PAM) – Monitoring, risk detection, service account hardening
• Incident Investigation – Forensic analysis, log parsing, root cause analysis of identity breaches

Related certifications

• Foundational prerequisite: CrowdStrike Certified Falcon Administrator (CCFA) ↗ – Administrator track at entry level
• Related CrowdStrike certifications: CCFR (Falcon Responder) ↗ · CCFH (Falcon Hunter) ↗ · CCCS (Cloud Specialist) ↗
• Vendor ecosystem: CrowdStrike Falcon Platform Overview ↗
• Cross-vendor equivalent: Microsoft Certified: Identity and Access Administrator Associate (SC-300)

Sources

• CrowdStrike Falcon Certification Program ↗
• CrowdStrike CCIS Exam Guide PDF ↗
• Pearson VUE CrowdStrike Exams ↗
• CrowdStrike University Training Catalog ↗
• CrowdStrike Acquires Preempt Security ↗
• CrowdStrike Falcon Identity Protection ↗
• Udemy CCIS Exams 2026 Course ↗
• PayScale ZA Cyber Security Analyst ↗
• Glassdoor Cyber Security Analyst Salary ↗
• Robert Half IT Salary Guide 2025 ↗

Last verified: 2026-05-01 Parent ecosystem: CrowdStrike Falcon Platform Parent domain: Security

Exam difficulty and prerequisites

Difficulty level: Professional (intermediate-to-advanced)

The CCIS exam is designed for practitioners with substantial experience in security operations, not entry-level candidates. The exam tests applied knowledge and scenario-based problem-solving, not just theoretical understanding. Expect questions that require:

• Understanding of real-world attack scenarios and how attackers leverage identity
• Ability to diagnose and respond to identity-based incidents
• Knowledge of both detection and remediation workflows
• Understanding of policy trade-offs and security vs. usability balancing
• Familiarity with identity protocols and their security implications

Prerequisites (recommended, not required):

• 6 months hands-on experience with CrowdStrike Falcon platform
• Foundational knowledge of Active Directory and Windows authentication
• Basic understanding of Kerberos, NTLM, LDAP, and OAuth
• Experience investigating security incidents or working in SOC environment
• Familiarity with identity threat detection concepts and Zero Trust architecture
• CCFA (Certified Falcon Administrator) certification is highly recommended as foundation

Difficulty compared to other certifications:

• Comparable to Microsoft SC-300 (Identity and Access Administrator Associate)
• More specialized than CCFA but less technical than CCFH (Falcon Hunter)
• Requires hands-on lab experience; study guides and practice exams alone are insufficient
• Average first-time pass rate estimated at 65–75% (higher for candidates with direct Falcon experience)

Post-certification value and career impact

Career advancement: CCIS certification typically leads to:

• Role advancement from analyst to senior analyst or team lead within 12–24 months
• Ability to lead identity security initiatives and architecture decisions
• Higher baseline compensation (5–15% premium over uncertified peers)
• Better positioning for identity-focused roles (IAM, PAM, Zero Trust architect)
• Qualification for consulting and professional services roles

Employer recognition: The CCIS credential is recognized by:

• CrowdStrike customers and partners (highest value audience)
• Enterprise security teams evaluating vendor expertise
• Managed service providers (MSPs) and managed detection and response (MDR) providers
• Third-party risk assessors and compliance auditors
• Government and defense contractors requiring vendor-specific expertise

Continuing professional development: CCIS holders should:

• Stay current with CrowdStrike platform updates (released quarterly)
• Monitor MITRE ATT&CK framework changes and new attack techniques
• Participate in CrowdStrike community forums and webinars
• Consider complementary certifications: Azure AD, Okta, or SailPoint credentials
• Pursue higher-level CrowdStrike certifications (architecture, specialist roles)

Recertification and renewal

Validity period: 3 years from pass date

Renewal options:

• Retake exam: Pass current version of CCIS exam (cost: $250)
• No continuing education (CE) credits: CrowdStrike does not offer CE credit alternative; recertification requires passing current exam
• Renewal timeline: Begin renewal process 3–6 months before expiration to avoid credential gap
• Version updates: Exam content may be updated annually; newer exam versions will reflect platform updates

What changes between exam versions:

• New attack patterns and detection capabilities
• Updated Falcon Identity Protection features and UI
• Latest Active Directory security guidance from Microsoft
• Recent CrowdStrike threat intelligence findings
• Industry changes in Zero Trust architecture and PAM practices

Credly badge and digital credential

Upon passing the CCIS exam, CrowdStrike awards a digital badge via Credly that:

• Verifies certification status to employers and peers
• Can be shared on LinkedIn, resumes, and email signatures
• Includes metadata: certification date, expiration date, credential ID
• Links to official CrowdStrike verification page
• Remains accessible in Credly portfolio after expiration (marked as expired)

Badge features:

• Official CrowdStrike branding and security features
• Tamper-proof digital credential with verification chain
• Shareable via LinkedIn, social media, email
• Embeddable on websites and professional profiles
• Accessible via QR code for recruiters and employers

Comparison with related identity security certifications

Comparison note: CCIS is the most vendor-specific (CrowdStrike Falcon-focused) and most operationally-focused (incident response, detection). SC-300 is broader (covers multiple Azure identity tools) but less vendor-neutral than CCIS due to Microsoft focus. CAMS is most vendor-neutral but less technical than CCIS.