3.4 Demonstrate Understanding of Sub-Playbook (inputs, Outputs, Looping) Configuration XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A parent playbook calls a sub-playbook that returns a list of findings. The analyst wants to merge these findings with findings from another sub-playbook call. Both sub-playbooks have looping enabled. How should the analyst combine the outputs?

   • AUse a 'Join' task to merge the outputs.
   • BMap both outputs to the same parent context key, e.g., 'Findings.List'.
   • CMap both outputs to the same key and enable 'append' on the mapping.
   • DMap each output to a different key, then use a 'Set' task to combine them into a new list.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A sub-playbook 'ProcessItem' takes a single 'item' input and returns a 'result'. The parent playbook has a list of items, but some items are invalid and should be skipped. The analyst wants to loop over the list but only invoke the sub-playbook for valid items. What is the best approach?

   • AUse a 'Conditional' task in the parent to check each item and call the sub-playbook only for valid ones.
   • BEnable looping and set the loop input to the original list; the sub-playbook will handle invalid items gracefully.
   • CEnable looping on the sub-playbook task and use a 'Conditional' task inside the sub-playbook to skip invalid items.
   • DUse a 'Filter' script task before the sub-playbook to remove invalid items from the list, then enable looping on the sub-playbook task.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A parent playbook uses a looping sub-playbook to enrich multiple IPs. Each iteration returns a 'reputation' output. The analyst wants to create a single list of all reputations for a report. How should the analyst reference the accumulated outputs?

   • AUse a 'Set' task inside the sub-playbook to append each reputation to a global variable.
   • BReference the sub-playbook's task ID with a loop index, e.g., '${tasks.SubPlaybookTaskID.output.reputation[0]}'.
   • CReference the incident field where the sub-playbook writes its outputs.
   • DReference the mapped parent context key, e.g., '${Enrichment.Reputations}'.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In Cortex XSOAR, when configuring a sub-playbook task, what is the purpose of defining an input parameter as 'Required'?

   • AIt automatically populates the input with the current incident's ID.
   • BIt encrypts the input value in the sub-playbook's logs.
   • CIt makes the input value immutable and prevents the sub-playbook from modifying it.
   • DIt forces the parent playbook to provide a value before the sub-playbook can be executed.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is configuring a sub-playbook task with looping enabled. The sub-playbook takes a list of IPs as a single input and returns a list of findings. The analyst wants to run the sub-playbook once per IP and collect all findings. What should the analyst set as the loop input?

   • AA single IP from the list, e.g., '${inputs.ips[0]}'
   • BThe sub-playbook's input name, e.g., 'ip'
   • CThe list of IPs, e.g., '${inputs.ips}'
   • DThe output of the sub-playbook, e.g., '${outputs.findings}'
   Reveal Solution Discussion Select an answer first