3.2 Explain the Process of Referencing and Manipulating Context Data to Manage Automation Workflow XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A playbook enriches an IP address and stores the result in context under `IPData`. The enrichment script returns a list of objects, each with `address` and `malicious` fields. The playbook must check if ANY of the IPs are malicious. Which condition expression correctly accomplishes this?

   • A${IPData} contains true
   • B${IPData.malicious} == true
   • C${IPData.malicious} contains true
   • D${IPData[0].malicious} == true
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A playbook has a conditional task that checks if `User.Active` is true. If true, it runs a task to send a welcome email. The playbook is not sending the email even though `User.Active` is true. Upon investigation, you find that `User.Active` is stored as the string 'true'. What is the most likely reason the condition fails?

   • AThe string 'true' is not equal to the boolean true in the condition.
   • BThe `User.Active` key is not accessible from the conditional task.
   • CThe conditional task is using the wrong operator, such as `==` instead of `is true`.
   • DThe `User.Active` key is set after the conditional task runs.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A playbook task requires an input that is a concatenation of the incident name and the current date. The incident name is stored in context as `incident.name`. How should the input be configured to achieve this?

   • A${incident.name} - ${date}
   • B${incident.name} - ${now}
   • C${incident.name} - ${currentDate}
   • D${incident.name} - ${timestamp}
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which playbook feature allows repeating a set of tasks for each item in a context list?

   • ALoop
   • BManual input task
   • CConditional task
   • DSet indicator task
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In Cortex XSOAR, how is context data organized and accessed within playbook tasks?

   • AAs a flat list of key-value pairs that can be accessed using dot notation, such as ${ip}
   • BAs a JSON array where elements are accessed by index only, such as ${IP[0]}
   • CAs a relational database table where rows are accessed using SQL queries in task fields
   • DAs a hierarchical key-value store where nested keys are accessed using dot notation, such as ${IP.Address}
   Reveal Solution Discussion Select an answer first