CrowdStrike Certified Falcon Administrator (CCFA) — Question 62

An analyst has reported they are not receiving workflow triggered notifications in the past few days. Where should you first check for potential failures?

Answer options

• A. Custom Alert History
• B. Workflow Execution log
• C. Workflow Audit log
• D. Falcon UI Audit Trail

Correct answer: B

Explanation

The correct answer is B, the Workflow Execution log, because it provides detailed information about the execution of workflows, including any errors that may have occurred. The other options, while useful for different aspects of alerts and workflows, do not specifically focus on the execution process that would affect notification delivery.