Discuss CrowdStrike CCFA-200b Exam Topic 4 Question 4

You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

AClone the workflow and replace the existing email with your CISO's email

BAdd a sequential action to send a custom email to your CISO

CAdd a parallel action to send a custom email to your CISO

DAdd the CISO's email to the existing action

Suggested Answer: C

The best way to update the workflow is to add a parallel action to send a custom email to your CISO. A parallel action allows you to perform multiple actions simultaneously when a workflow is triggered, without affecting the order or outcome of other actions. A sequential action, on the other hand, requires one action to complete before another action can start.By adding a parallel action, you can ensure that both the escalation team and your CISO receive an email notification as soon as possible1.

Get Premium CCFA-200b Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

Wai 3 months ago

I feel like option A is unnecessary. Cloning adds complexity.

Theron 3 months ago

Option D seems simplest. Just add the CISO's email to the existing action.

Soledad 3 months ago

I prefer option C. Parallel actions are efficient for notifications.

Hui 3 months ago

I think option B is the best. Sequential actions keep it organized.

Rasheeda 3 months ago

I’m surprised they didn’t think of this sooner!

Adrianna 5 months ago

Wait, why not just clone the workflow? Seems easier!

Lenita 5 months ago

D seems too simple; it might not allow for customization.

Bok 5 months ago

I think C is better since it doesn't disrupt the original flow.

Jaime 5 months ago

Option B is the best choice for clarity.

Rosendo 6 months ago

Parallel action, eh? I bet the CISO will feel like a superhero, getting those emails in real-time!

Arlette 6 months ago

I wonder if the CISO has a secret desire to be the first to know about critical detections. Just a hunch.

Bethanie 6 months ago

A) seems like overkill. Cloning the workflow just to update the email recipient is unnecessary.

Bulah 6 months ago

D) is the simplest solution, but it may not provide the customized message the CISO wants.

Nell 6 months ago

B) is a good choice too. Sequential actions keep the workflow organized and easy to maintain.

Chara 6 months ago

C) is the best option. Parallel actions ensure the CISO is notified without delaying the original workflow.

Brunilda 7 months ago

I practiced a similar question, and I think adding a sequential action could be a good choice if we want to ensure the escalation team gets notified first before the CISO.

Serita 7 months ago

I feel like adding the CISO's email directly to the existing action could work, but then how would we customize the message for them?

Kerry 8 months ago

I'm not entirely sure, but I remember something about cloning workflows being a bit messy. It might be better to just modify the existing one instead.

Glendora 8 months ago

I think adding a parallel action might be the best option since it allows both emails to be sent simultaneously without disrupting the existing workflow.

Princess 8 months ago

Ugh, this is a tricky one. I'm torn between A and C. Cloning the workflow seems like it could get messy, but I also want to make sure the CISO's email is completely separate. I'll need to carefully consider the pros and cons of each approach.

Wilda 8 months ago

I'm pretty confident that option C is the way to go. Adding a parallel action will ensure the CISO is notified without impacting the existing workflow. I'll make sure to test it thoroughly, but I think this is the cleanest solution.

Veronika 8 months ago

Option D seems the easiest, but I'm not sure if that's the best long-term solution. I want to make sure the CISO's email is properly customized and not just tacked onto the existing action.

Albert 8 months ago

Hmm, I'm a bit unsure about this one. I'm trying to decide between options B and C. I'm leaning towards B since it keeps the workflow more linear, but I'll need to double-check the details on how each option works.

Christa 9 months ago

I think option C is the best approach here. Adding a parallel action to send a custom email to the CISO seems like the most straightforward way to update the workflow without disrupting the existing functionality.

Hassie 2 months ago

↳ replying to Christa

Definitely, no need to mess with the original workflow!

German 2 months ago

↳ replying to Christa

Parallel action keeps everything running smoothly.

Eun 3 months ago

↳ replying to Christa

I agree, option C is clean and efficient.

CrowdStrike CCFA-200b Exam - Topic 4 Question 4 Discussion