Responder asks what you would do about the alert. Administrator asks how the platform that raised it was configured. CCFA-200b covers roles, sensors, host groups, prevention and containment policy, custom rules and workflows, and it wants 48 of 60 right.
