XSOAR-Engineer Playbook Development Practice Question
An engineer is configuring a playbook task that calls a sub-playbook. The parent playbook needs to pass a dynamic list of IP addresses stored in an incident field to the sub-playbook as an input argument. How should this be configured in the sub-playbook task mapping?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reference the incident field using context syntax such as ${incident.ipaddresses} in the sub-playbook input mapping.
To pass incident fields or context data to a sub-playbook, the engineer uses the Context or Incident field selector in the sub-playbook task configuration, referencing the path such as ${incident.ipaddresses}.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Reference the incident field using context syntax such as ${incident.ipaddresses} in the sub-playbook input mapping.
Why this is correct
Correct. Sub-playbook inputs are mapped using context path expressions to pull parent incident or context data.
- ✗
Write a custom Python automation script to manually push the incident field into the sub-playbook context every time.
Why it's wrong here
Incorrect. XSOAR sub-playbook mapping handles input arguments natively without requiring custom scripts.
- ✗
Hardcode the IP addresses into the sub-playbook's default argument values.
Why it's wrong here
Incorrect. Hardcoding prevents dynamic execution based on incident data.
- ✗
Create a global variable in the Server Configuration settings.
Why it's wrong here
Incorrect. Server configuration variables are global and not meant for dynamic playbook-to-sub-playbook incident mapping.
About these practice questions
This XSOAR-Engineer question is part of Courseiva's 219-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XSOAR-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XSOAR-Engineer exam.