CrowdStrike CCFA-200b Exam - Topic 4 Question 4 Discussion

Actual exam question for CrowdStrike's CCFA-200b exam

Question #: 4
Topic #: 4

You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

AClone the workflow and replace the existing email with your CISO's email

BAdd a sequential action to send a custom email to your CISO

CAdd a parallel action to send a custom email to your CISO

DAdd the CISO's email to the existing action

Show Suggested Answer

Suggested Answer: C

The best way to update the workflow is to add a parallel action to send a custom email to your CISO. A parallel action allows you to perform multiple actions simultaneously when a workflow is triggered, without affecting the order or outcome of other actions. A sequential action, on the other hand, requires one action to complete before another action can start.By adding a parallel action, you can ensure that both the escalation team and your CISO receive an email notification as soon as possible1.

by Lucina at Jan 28, 2026, 02:16 AM

Limited Time Offer

25%

Off

Get Premium CCFA-200b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rosendo

5 days ago

Parallel action, eh? I bet the CISO will feel like a superhero, getting those emails in real-time!

upvoted 0 times

...

Arlette

10 days ago

I wonder if the CISO has a secret desire to be the first to know about critical detections. Just a hunch.

upvoted 0 times

...

Bethanie

15 days ago

A) seems like overkill. Cloning the workflow just to update the email recipient is unnecessary.

upvoted 0 times

...

Bulah

20 days ago

D) is the simplest solution, but it may not provide the customized message the CISO wants.

upvoted 0 times

...

Nell

26 days ago

B) is a good choice too. Sequential actions keep the workflow organized and easy to maintain.

upvoted 0 times

...

Chara

1 month ago

C) is the best option. Parallel actions ensure the CISO is notified without delaying the original workflow.

upvoted 0 times

...

Brunilda

1 month ago

I practiced a similar question, and I think adding a sequential action could be a good choice if we want to ensure the escalation team gets notified first before the CISO.

upvoted 0 times

...

Serita

1 month ago

I feel like adding the CISO's email directly to the existing action could work, but then how would we customize the message for them?

upvoted 0 times

...

Kerry

2 months ago

I'm not entirely sure, but I remember something about cloning workflows being a bit messy. It might be better to just modify the existing one instead.

upvoted 0 times

...

Glendora

2 months ago

I think adding a parallel action might be the best option since it allows both emails to be sent simultaneously without disrupting the existing workflow.

upvoted 0 times

...

Princess

2 months ago

Ugh, this is a tricky one. I'm torn between A and C. Cloning the workflow seems like it could get messy, but I also want to make sure the CISO's email is completely separate. I'll need to carefully consider the pros and cons of each approach.

upvoted 0 times

...

Wilda

3 months ago

I'm pretty confident that option C is the way to go. Adding a parallel action will ensure the CISO is notified without impacting the existing workflow. I'll make sure to test it thoroughly, but I think this is the cleanest solution.

upvoted 0 times

...

Veronika

3 months ago

Option D seems the easiest, but I'm not sure if that's the best long-term solution. I want to make sure the CISO's email is properly customized and not just tacked onto the existing action.

upvoted 0 times

...

Albert

3 months ago

Hmm, I'm a bit unsure about this one. I'm trying to decide between options B and C. I'm leaning towards B since it keeps the workflow more linear, but I'll need to double-check the details on how each option works.

upvoted 0 times

...

Christa

3 months ago

I think option C is the best approach here. Adding a parallel action to send a custom email to the CISO seems like the most straightforward way to update the workflow without disrupting the existing functionality.

upvoted 0 times

...