nerdexam
CrowdStrike

CCFA-200B · Question #198

Your organization has determined that your cybersecurity architect needs to be notified via email whenever Falcon generates detections of a medium severity or higher. Additionally, the architect…

The correct answer is D. Create a custom Fusion SOAR workflow to send an email every time a new detection or incident. You've hit your limit · resets 12:50am (America/New_York)

Fusion SOAR Workflow Management

Question

Your organization has determined that your cybersecurity architect needs to be notified via email whenever Falcon generates detections of a medium severity or higher. Additionally, the architect should be notified about any incidents with a CrowdScore of 1.0 or higher. What can the Falcon Administrator do to ensure the architect is properly alerted?

Options

  • ACreate a new Falcon user for the architect then create and assign a custom Falcon user role so
  • BAdd the architect's email address to the manage list for detection and incident emails from the
  • CCreate a new Falcon user for the architect and assign the Detections and Exceptions Manager
  • DCreate a custom Fusion SOAR workflow to send an email every time a new detection or incident

How the community answered

(17 responses)
  • A
    6% (1)
  • B
    12% (2)
  • C
    6% (1)
  • D
    76% (13)

Explanation

You've hit your limit · resets 12:50am (America/New_York)

Topics

#Fusion SOAR#detection notifications#incident alerts#CrowdScore

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice