3.4 Demonstrate Understanding of Sub-Playbook (inputs, Outputs, Looping) Configuration XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A sub-playbook 'Analyze' takes a single input 'data' and returns a 'result'. The parent playbook has a list of data items, but the list may be empty. The analyst wants to avoid running the sub-playbook if the list is empty. What is the best way to handle this?

   • AEnable looping on the sub-playbook task; XSOAR automatically skips the task if the loop input is empty.
   • BUse a 'Set' task to default the list to a single dummy item if empty.
   • CEnable looping and set the loop input to the list; the sub-playbook will handle an empty list gracefully.
   • DAdd a 'Conditional' task before the sub-playbook to check if the list is empty, and only then call the sub-playbook.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In Cortex XSOAR, when configuring looping on a sub-playbook task, what is the 'Loop Value' used for?

   • AIt specifies the list of items that the loop will iterate over.
   • BIt sets the condition that must be true for the loop to continue.
   • CIt defines the maximum number of iterations the loop can perform.
   • DIt determines the delay between each iteration of the loop.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is configuring a sub-playbook task that should loop over a list of URLs. The sub-playbook has an input 'url' that expects a single URL. What should the analyst set as the loop input?

   • AA single URL from the list, e.g., '${inputs.urls[0]}'
   • BThe output of the sub-playbook, e.g., '${outputs.result}'
   • CThe list of URLs, e.g., '${inputs.urls}'
   • DThe sub-playbook's input name, e.g., 'url'
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In Cortex XSOAR, when a sub-playbook task is configured with looping, how are the outputs from each iteration handled?

   • AThe outputs are merged into a single object, with later iterations overriding earlier ones.
   • BThe outputs from all iterations are accumulated into an array under the mapped output key.
   • CThe outputs are discarded unless the sub-playbook explicitly writes them to the incident.
   • DOnly the output from the last iteration is stored, overwriting previous results.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In Cortex XSOAR, how are the outputs of a sub-playbook made available to the parent playbook?

   • AThey are written to the incident's notes and can be referenced via the notes API.
   • BThey are stored in a separate context namespace and must be mapped to parent context keys.
   • CThey are only available within the sub-playbook itself and cannot be accessed by the parent.
   • DThey are automatically merged into the parent's context using the same keys.
   Reveal Solution Discussion Select an answer first