3.5 Explain the Process of Applying Filters and Transformers to Manipulate Data in Playbook Tasks XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a playbook, you need to first filter a list of incidents to only those with status 'closed', then extract the 'owner' field from each filtered incident. What is the correct approach?

   • AUse a single Set task with a filter expression
   • BUse a Filter task followed by an Extract task
   • CUse an Extract task followed by a Filter task
   • DUse a single Parse task with a filter expression
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A playbook receives a list of IP addresses in the context field `Source.IP`. The analyst needs to convert each IP to its corresponding hostname using a DNS lookup, and then store the list of hostnames in context as `Host.Name`. Which transformer or task should be used?

   • AUse a custom script or integration that performs DNS lookup, then Set the result.
   • BParse
   • CSet
   • DExtract
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A playbook receives a text field `description` that contains a URL like `https://malicious.com/payload`. The playbook needs to extract the domain `malicious.com` and store it in context as `Malicious.Domain`. Which transformer should be used?

   • AParseURL
   • BExtract
   • CRegexExtract
   • DSet
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A transformer is used to extract a field from a JSON object, but the field is missing in some cases, causing the transformer to fail. What is the recommended way to handle this?

   • AUse a different transformer that does not fail
   • BUse a default value in the transformer configuration
   • CRemove the transformer from the playbook
   • DIgnore the error and continue
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A playbook receives an incident field 'ip_address' that contains a string like '192.168.1.1'. You need to extract only the last octet ('1') for use in a subsequent task. Which transformer would you use?

   • AA transformer that supports regex or string manipulation
   • BSet
   • CExtract
   • DParse
   Reveal Solution Discussion Select an answer first