3.2 Explain the Process of Referencing and Manipulating Context Data to Manage Automation Workflow XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a playbook task, which field would you use to store the output of an automation script into context?

   • AOutputs
   • BTimeout
   • CInputs
   • DCondition
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A playbook enriches an incident with threat intelligence. After the enrichment task completes, the playbook must store the reputation score of a file hash in a custom context key named `FileReputation` so that later tasks can use it. Which task type should be used to accomplish this?

   • ASet context task
   • BSet indicator task
   • CManual task output
   • DAutomation script task
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A playbook needs to iterate over a list of hostnames stored in context under `Hosts`. For each hostname, it must run a reputation check. Which playbook construct should be used to achieve this?

   • AA Set context task that assigns each hostname to a separate key
   • BA conditional task that checks if `Hosts` is not empty
   • CA loop task that iterates over `Hosts`
   • DA manual task that asks the analyst to run the check for each hostname
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A playbook has a task that queries a database and returns a list of user IDs under the context key `UserIDs`. The next task is a conditional that must check if a specific user ID `12345` is in the list. Which condition expression should be used?

   • A${UserIDs} in 12345
   • B${UserIDs[0]} == 12345
   • C${UserIDs} == 12345
   • D${UserIDs} contains 12345
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   A playbook needs to update the `Severity` field of an incident based on the number of affected endpoints. The number of endpoints is stored in context as `EndpointCount`. If the count is greater than 10, the severity should be set to 'high'. Which task type should be used to update the incident severity?

   • AUpdate incident task
   • BSet indicator task
   • CAutomation script task
   • DSet context task
   Reveal Solution Discussion Select an answer first