Cisco · Free Practice Questions · Last reviewed May 2026
24real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?
OAuth 2.0 Client Credentials flow
HMAC-SHA256 signature verification
SecureX uses HMAC-SHA256 signatures to verify that the payload was sent by the trusted source.
Mutual TLS (mTLS) certificate exchange
Basic Authentication with fixed credentials
When automating threat hunting using the Cisco Umbrella Reporting API, which THREE of the following request parameters are commonly used to filter DNS query logs?
threat_score
from
Required to define the start time of the query range.
domain
Used to filter specifically for requested domain queries.
source_ip
to
Required to define the end time of the query range.
You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?
Implement an exponential backoff algorithm before retrying
Exponential backoff is the standard approach to handle API rate limits gracefully.
Immediately retry the request with the same parameters
Update the API key to a higher privilege level
Switch to the secondary API endpoint URL
You are automating threat hunting in Cisco SecureX. You want to execute a workflow that pivots from an IP address to associated domains. Which SecureX API component allows you to perform these relationship lookups?
Pivot API
Orchestration Query API
Threat Intelligence API
The Threat Intelligence API provides observable relationship data.
Relationship Discovery Service
You are using the Cisco Secure Endpoint (formerly AMP for Endpoints) API to query file trajectory data for a specific SHA-256 hash. The API returns a 429 Too Many Requests status code. What is the most efficient way to handle this in your automation script?
Switch from HTTPS to HTTP to reduce overhead.
Increase the API rate limit in the Cisco Secure Endpoint dashboard.
Force an authentication refresh on every request.
Implement an exponential backoff strategy with a retry logic.
Exponential backoff is the standard method for handling rate limits.
You are automating threat hunting using the Cisco Umbrella Investigate API. Which TWO parameters are required to perform a standard DNS lookup for a specific domain? (Choose two)
The threat category ID
The global user ID
The domain name string
The domain is the primary subject of the lookup.
The API key in the request header
The API key is mandatory for authentication with the Investigate service.
The IP address of the local DNS recursive resolver
Want more Advanced Threat And Endpoint Security practice?
Practice this domainA network engineer is using the Cisco Firepower Management Center (FMC) API to retrieve access control policy information. Which HTTP method should be used to perform a read-only request for a specific policy resource?
GET
GET is used to retrieve data.
PATCH
POST
PUT
You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?
POST /ers/config/guestuser/update
UPDATE /ers/config/guestuser/{id}
PATCH /ers/config/guestuser/{id}
PUT /ers/config/guestuser/{id}
The ERS API follows standard REST conventions where PUT is used for updates.
You are using the Cisco Firepower Management Center (FMC) API to retrieve a list of Access Control Policies. Which URL endpoint is correct?
/api/fmc_config/v1/policy/access
/api/v1/fmc/acp
/api/fmc_config/v1/domain/{uuid}/policy/accesspolicies
This is the correct path for accessing ACPs.
/api/fmc_config/v1/domain/policy/accesspolicies
You are automating Cisco Firepower Management Center (FMC) object creation using the REST API. You successfully POST a new network object, but the changes do not appear on the managed Firepower Threat Defense (FTD) device. What is the mandatory final step to ensure the changes take effect?
Call the /deploy endpoint using the deployment target devices list.
Deployment is a separate asynchronous operation from the configuration update in the FMC API.
The FMC automatically pushes objects immediately after the POST request returns 201.
Send a commit command to the FTD device directly via SSH.
Restart the snort process via the API.
Which TWO steps are required to properly authenticate to the Cisco Firepower Management Center (FMC) API using the REST API Explorer?
Use Basic Auth in the header with admin credentials
Send a POST request to /api/fmc_platform/v1/auth/generatetoken
This is the entry point for API authentication.
Perform a GET request to the root URL
Send credentials in the URL query string
Capture the X-auth-access-token header from the response
The token is provided in the header for subsequent calls.
You are automating Cisco Firepower Management Center (FMC) via the REST API. You need to update an existing object. Which HTTP method must you use to ensure a full update of the resource representation?
PUT
PUT is the standard method for full resource updates in RESTful APIs.
POST
GET
PATCH
Want more Network Security practice?
Practice this domainYou are writing a Python script to interact with the Cisco Firepower Management Center (FMC) API. You need to authenticate to obtain an authentication token. Which HTTP method and endpoint must your script utilize to initiate this process?
PUT /api/fmc_platform/v1/auth/generatetoken
POST /api/fmc_platform/v1/auth/generatetoken
POST is the correct method for authentication requests.
GET /api/fmc_platform/v1/auth/generatetoken
POST /api/fmc_platform/v1/auth/login
When working with YANG data models in Cisco security automation, which TWO statements accurately describe the role of the 'leaf' and 'leaf-list' nodes?
A 'leaf-list' node allows for multiple instances of a specific value type.
This correctly describes a leaf-list.
A 'leaf' node can contain child nodes.
Both 'leaf' and 'leaf-list' support default values.
A 'leaf' node contains a single value of a specific type.
This is the definition of a leaf node.
A 'leaf-list' node is used for hierarchical grouping.
You are parsing a complex JSON response from a Cisco ASA API call using the json.loads() method in Python. The response contains a nested list of access control entries. Which method is most efficient to extract all 'destination_ip' fields from every entry in the list?
Iterating through the dictionary using dict.values().
A list comprehension: [item['destination_ip'] for item in response['data']]
List comprehensions are optimized for this type of data extraction in Python.
A nested for loop with a list.append() call.
Using the json.find() method.
You are developing a NETCONF client to modify the configuration of a Cisco IOS-XE device. You have sent an <edit-config> operation. What must you include in your message to ensure the changes are committed only if the validation succeeds, using the confirmed-commit capability?
<commit-check/>
<confirm/>
<confirmed/>
The <confirmed/> tag is required within the commit operation to trigger the confirmed-commit feature.
<verify/>
In the context of REST APIs, which status code indicates that a request was successful and a new resource was created on the server?
201 Created
201 is specifically for resource creation.
200 OK
202 Accepted
204 No Content
You are testing a Cisco FMC REST API endpoint using Postman. Which TWO of the following configurations are mandatory to successfully authenticate and receive a 200 OK response?
Using Basic Auth in the Postman Auth tab.
Setting the 'X-Auth-Access-Token' header with a valid token.
The token is required for all subsequent API requests after the initial authentication.
Adding a 'Cookie' header with session ID.
Setting 'Content-Type' to 'application/json'.
The API requires the header to specify the data format sent in the body.
Disabling SSL certificate verification.
Want more Network Programmability Foundation practice?
Practice this domainWhen integrating Cisco Umbrella with a SIEM using the Cisco Umbrella Investigate API, which TWO pieces of information are required to authenticate and query domain status?
API Token
The API token is the primary credential for Investigate API access.
WSA Admin password
Authorization Header
The Authorization header (Bearer token) is required for REST authentication.
Internal DNS server IP
Organization ID
Which Cisco security product provides an API to automate the management of web proxy policies and access logs?
Cisco Tetration
Cisco Duo
Cisco Secure Endpoint
Cisco Secure Web Appliance (WSA)
WSA is the platform specifically designed for web proxy and policy management.
You are configuring a Webex CASB integration. To automate the reporting of anomalous file sharing events from a third-party cloud storage service, which API mechanism should you configure to receive real-time updates?
Direct database query access
Registering a Webhook endpoint
Webhooks are designed to push event data to your automation service as they occur.
SNMP Traps
Using an SSH tunnel to the cloud provider
Polling the REST API every 60 seconds
You are developing a script to interact with the Cisco Cloudlock API to identify risky OAuth applications. Which THREE actions are valid when using the Cloudlock REST API to manage application risk?
Update the Cisco Umbrella DNS filtering policies
Revoke OAuth tokens for identified risky apps
The API allows revoking access tokens for specific applications.
Retrieve risk score for an application
Risk scores are accessible via the application discovery endpoint.
Modify the global cloud infrastructure firewall rules
List users who have authorized a specific app
The API provides visibility into user-to-app authorization mappings.
When using the Cisco Secure Email (formerly ESA) AsyncOS API to fetch message tracking data, what is the mandatory header required for authentication?
Cookie: session_id
Authorization
The AsyncOS API utilizes standard HTTP Basic Auth via the Authorization header.
Bearer-Token
X-API-Key
You are automating the retrieval of security logs from Cisco Umbrella using the Reporting API. You need to pull logs for a specific time range. Which parameter must be included in the API request to ensure the response is correctly paginated and contains the requested data slice?
slice_id
page_token
session_id
limit
The 'limit' parameter defines the number of records returned per request.
Want more Cloud Web And Email Security Automation practice?
Practice this domainThe SAUTO exam has 200 questions and must be completed in 120 minutes. Cisco passing scores vary by exam version and are not always publicly listed. Check the official Cisco exam page before booking.
CLI output interpretation, network topology analysis, routing behaviour, switching concepts, troubleshooting, and configuration questions.
The exam covers 4 domains: Advanced Threat And Endpoint Security, Network Security, Network Programmability Foundation, Cloud Web And Email Security Automation. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Cisco SAUTO exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.