Palo Alto Networks Certified Security Automation Engineer (PCSAE) — Question 42

An incident field is created having the display name as Source_IP.
How can the field be accessed?

Answer options

• A. ${incident.sourceip}
• B. ${incident.Source_IP}
• C. ${incident.srcip}
• D. ${incident.Source IP}

Correct answer: A

Explanation

The correct answer is A, ${incident.sourceip}, as field names in most systems are case-sensitive and typically utilize lowercase for variable access. Option B is incorrect due to the capitalization of 'Source_IP,' which does not match the expected format. Options C and D do not correspond to the field name and are therefore invalid references.