How do sub-playbooks affect the Incident Context Data?

How do sub-playbooks affect the Incident Context Data?

An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

In the DBotScore context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?

In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )