CrowdStrike Falcon Fusion workflows are designed for security automation and orchestration. A workflow is initiated by a trigger, which can be highly specific, such as a new detection with a severity level of 'High' or 'Critical'. Once triggered, the workflow can execute a sequence of multiple, distinct actions. This allows for the creation of complex response plans, like the one described in the scenario, where a single high-severity detection leads to both isolating the host and creating a ticket in an external system. This multi-action capability is a core feature of the Falcon Fusion framework.

A. Only administrators with full permissions can create workflows. This is incorrect. Workflow creation is controlled by Role-Based Access Control (RBAC) and requires the specific 'Fusion Workflows' permission, which can be assigned to custom roles, not just the full Falcon Administrator role.
C. Workflows cannot be configured to integrate with external ITSM tools. This is incorrect. Falcon Fusion is designed for integration and includes pre-built actions for popular ITSM tools (e.g., ServiceNow) and a generic 'Send to Webhook' action to connect with virtually any external API-driven service.
D. A workflow can only have one trigger and one action. This is incorrect. While a workflow starts with a single trigger, it can be configured to execute a chain of multiple actions, either sequentially or in parallel, to automate a complete response process.

1. CrowdStrike Falcon® Platform Documentation, "Getting started with Falcon Fusion": This document outlines the fundamental components of Fusion workflows. It explicitly states, "A workflow consists of a trigger and a series of connected nodes that perform actions." The examples provided demonstrate workflows with a single trigger (e.g., New detection) followed by multiple actions (e.g., Contain host, Update detection, Send notification). The trigger configuration section details how to filter based on attributes like Severity. (Accessed via official CrowdStrike support portal).

2. CrowdStrike Falcon® Platform Documentation, "User management": This section details the Role-Based Access Control (RBAC) model. It specifies that permissions for features like Falcon Fusion are granular. The "Fusion Workflows" permission, with Read and Write access levels, is required to manage workflows and is not exclusive to the default "Falcon Administrator" role. (Accessed via official CrowdStrike support portal).

3. CrowdStrike Falcon® Platform Documentation, "Workflow actions": This part of the documentation provides a comprehensive list of available actions. It includes both internal Falcon actions like Contain host and external integration actions such as Create ServiceNow Incident and Send to Webhook, confirming the platform's integration capabilities with ITSM and other external tools. (Accessed via official CrowdStrike support portal).