3.4 Demonstrate Understanding of Sub-Playbook (inputs, Outputs, Looping) Configuration XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When configuring a sub-playbook input in Cortex XSOAR, which field determines whether the parent playbook must supply a value?

   • ARequired
   • BDescription
   • CKey
   • DDefault Value
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A looping sub-playbook task processes a list of file hashes. Each iteration returns a 'malicious' boolean output. The parent playbook needs to know if any iteration returned true. Which approach should the analyst use?

   • ADisable looping and call the sub-playbook manually for each hash, checking the output each time.
   • BMap the 'malicious' output to a parent context key and use a conditional task to check if the list contains 'true'.
   • CUse a 'Set' task inside the sub-playbook to set a global flag when malicious is true.
   • DConfigure the sub-playbook to return a single aggregated output using a 'Join' task.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In Cortex XSOAR, what is the purpose of the 'Outputs' section when configuring a sub-playbook task?

   • ATo configure the looping behavior for the sub-playbook task.
   • BTo specify which context keys from the sub-playbook should be passed back to the parent playbook.
   • CTo define the input parameters that the sub-playbook expects.
   • DTo set the timeout and retry behavior for the sub-playbook.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A sub-playbook 'EnrichEntity' has an input 'entity_type' and an output 'enrichment_data'. The parent playbook needs to call this sub-playbook for both 'ip' and 'domain' entities. How should the analyst configure the sub-playbook task to handle both entity types?

   • ACreate two separate sub-playbook tasks, one for 'ip' and one for 'domain'.
   • BUse a 'Conditional' task to branch on entity type and call the sub-playbook accordingly.
   • CSet the 'entity_type' input to '${inputs.entity_types}' and rely on the sub-playbook to handle the list.
   • DEnable looping on the task and set the loop input to a list containing 'ip' and 'domain'.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A sub-playbook 'GetUserInfo' has an optional input 'include_manager' that defaults to false. The parent playbook wants to call this sub-playbook and set 'include_manager' to true. What is the correct way to pass this input?

   • AIn the sub-playbook task configuration, set the 'include_manager' input to 'true'.
   • BUse the 'include_manager' input as a loop input.
   • CModify the sub-playbook's default value for 'include_manager' to true.
   • DAdd a 'Set' task before the sub-playbook to set 'include_manager' in the context.
   Reveal Solution Discussion Select an answer first