Detect, prevent, and respond to identity-based attacks across Active Directory and Microsoft Entra ID using CrowdStrike Falcon Identity Protection. Transition from alert handling to automated, policy-driven prevention that lowers both risk and operational load.
Key Responsibilities
Deploy, configure, and fine tune CrowdStrike Falcon Identity Protection across AD and Entra ID.
Identify and drive remediation of identity exposures, including stale and privileged accounts, weak or compromised passwords, risky delegations, and attack paths.
Implement identity-based policies, such as MFA challenge or block on risky authentication, to stop attacks in real time.
Investigate identity threats such as credential theft, lateral movement, and privilege escalation.
Automate response playbooks (e.g. using Falcon Fusion SOAR or other) to reduce manual triage.
Run POCs on new identity threat detection and response capabilities to ensure compatibility with existing Microsoft controls to avoid duplication.
Collaborate with SOC and the Entra resource to correlate identity signals and agree on response ownership.
Provide backup cover for service account and non-human identity protection, especially in Active Directory.
This guide is for students and freshers in India preparing for security analyst, SOC and application security interviews, and for engineers with a few years of experience moving into security roles. It has 60 questions with answers in three levels: the core ideas every fresher must explain clearly, such as the CIA triad, common attacks, MFA and hashing; the day-to-day work of an analyst, such as OWASP Top 10 fixes, SIEM rules, CVSS scoring, incident handling and cloud permissions; and the design questions asked of senior candidates. Hashes, scores and numbers in the answers were computed, not guessed. Everything is written from the defender's side. Answer each question aloud before reading ours, then take the mock test.
Questions you may be asked
What is the CIA triad? Give an example of each part.
What is the difference between a vulnerability, a threat, an exploit and a risk?
What do least privilege and defence in depth mean?
What is the difference between authentication and authorisation?
