CrowdStrike CCFA-200b Exam - Topic 4 Question 4 Discussion

Actual exam question for CrowdStrike's CCFA-200b exam

Question #: 4
Topic #: 4

You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

AClone the workflow and replace the existing email with your CISO's email

BAdd a sequential action to send a custom email to your CISO

CAdd a parallel action to send a custom email to your CISO

DAdd the CISO's email to the existing action

Show Suggested Answer

Suggested Answer: C

The best way to update the workflow is to add a parallel action to send a custom email to your CISO. A parallel action allows you to perform multiple actions simultaneously when a workflow is triggered, without affecting the order or outcome of other actions. A sequential action, on the other hand, requires one action to complete before another action can start.By adding a parallel action, you can ensure that both the escalation team and your CISO receive an email notification as soon as possible1.

by Lucina at Jan 28, 2026, 02:16 AM

Limited Time Offer

25%

Off

Get Premium CCFA-200b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Kerry

8 days ago

I'm not entirely sure, but I remember something about cloning workflows being a bit messy. It might be better to just modify the existing one instead.

upvoted 0 times

...

Glendora

13 days ago

I think adding a parallel action might be the best option since it allows both emails to be sent simultaneously without disrupting the existing workflow.

upvoted 0 times

...

Princess

18 days ago

Ugh, this is a tricky one. I'm torn between A and C. Cloning the workflow seems like it could get messy, but I also want to make sure the CISO's email is completely separate. I'll need to carefully consider the pros and cons of each approach.

upvoted 0 times

...

Wilda

23 days ago

I'm pretty confident that option C is the way to go. Adding a parallel action will ensure the CISO is notified without impacting the existing workflow. I'll make sure to test it thoroughly, but I think this is the cleanest solution.

upvoted 0 times

...

Veronika

28 days ago

Option D seems the easiest, but I'm not sure if that's the best long-term solution. I want to make sure the CISO's email is properly customized and not just tacked onto the existing action.

upvoted 0 times

...

Albert

1 month ago

Hmm, I'm a bit unsure about this one. I'm trying to decide between options B and C. I'm leaning towards B since it keeps the workflow more linear, but I'll need to double-check the details on how each option works.

upvoted 0 times

...

Christa

1 month ago

I think option C is the best approach here. Adding a parallel action to send a custom email to the CISO seems like the most straightforward way to update the workflow without disrupting the existing functionality.

upvoted 0 times

...