SAUTO Exam Questions and Answers

A network engineer is using the Cisco Firepower Management Center (FMC) API to retrieve access control policy information. Which HTTP method should be used to perform a read-only request for a specific policy resource?

GET

GET retrieves a representation of the specified policy resource without altering server state, satisfying the read-only constraint. The other HTTP methods (POST, PUT, DELETE) modify or create resources, so they cannot fulfil a read-only request.

PATCH

POST

PUT

Why: The HTTP GET method is defined for safe, read-only retrieval of a resource and is the correct method to fetch access control policy information from the FMC API. GET requests do not modify server state and are idempotent, making them ideal for querying a specific policy resource by its identifier. The FMC REST API follows standard REST conventions, so GET is used for all read operations.

You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?

POST /ers/config/guestuser/update

UPDATE /ers/config/guestuser/{id}

PATCH /ers/config/guestuser/{id}

PUT /ers/config/guestuser/{id}

Updating an existing guest user is an idempotent modification of a known resource, so ERS expects PUT against the collection path plus the resource ID. The body carries the changed attributes, and the ID in the URI identifies which guestuser record to modify.

Why: Cisco ISE ERS uses PUT to update an existing guest user resource, with the URI pattern /ers/config/guestuser/{id} where {id} is the guest user's unique identifier. This follows REST conventions where PUT replaces or updates the identified resource.

You are using the Cisco Firepower Management Center (FMC) API to retrieve a list of Access Control Policies. Which URL endpoint is correct?

/api/fmc_config/v1/policy/access

/api/v1/fmc/acp

/api/fmc_config/v1/domain/{uuid}/policy/accesspolicies

The FMC REST API nests policy resources under the config version and domain UUID, so access control policies are addressed at /policy/accesspolicies within /api/fmc_config/v1/domain/{uuid}. This endpoint satisfies the stem's requirement to list Access Control Policies via the FMC API.

/api/fmc_config/v1/domain/policy/accesspolicies

Why: The correct FMC REST API endpoint for Access Control Policies is /api/fmc_config/v1/domain/{uuid}/policy/accesspolicies, where {uuid} is the domain UUID obtained from the platform info endpoint. This follows FMC's standard config API URL structure.

You are automating Cisco Firepower Management Center (FMC) object creation using the REST API. You successfully POST a new network object, but the changes do not appear on the managed Firepower Threat Defense (FTD) device. What is the mandatory final step to ensure the changes take effect?

Call the /deploy endpoint using the deployment target devices list.

FMC stores object changes in its configuration database; the FTD devices only receive them when a deployment job is triggered. POSTing to /deploy with the target device list pushes the pending configuration, satisfying the requirement that changes actually take effect on managed devices.

The FMC automatically pushes objects immediately after the POST request returns 201.

Send a commit command to the FTD device directly via SSH.

Restart the snort process via the API.

Why: After creating or modifying objects via the FMC REST API, the changes exist only in the FMC configuration database and are not pushed to managed FTD devices until a deployment is triggered. The mandatory final step is to call the /deploy endpoint with the deployment target devices list, which pushes the pending configuration to the specified FTD devices. Without this deployment call, the new network object will not take effect on the FTD.

Which TWO steps are required to properly authenticate to the Cisco Firepower Management Center (FMC) API using the REST API Explorer?

Use Basic Auth in the header with admin credentials

Send a POST request to /api/fmc_platform/v1/auth/generatetoken

Sending a POST to /api/fmc_platform/v1/auth/generatetoken returns the authentication token required for subsequent FMC REST API calls, satisfying the stem's authentication requirement. The token is supplied via the X-auth-access-token header, and the call uses HTTP Basic credentials.

Perform a GET request to the root URL

Send credentials in the URL query string

Capture the X-auth-access-token header from the response

The FMC REST API Explorer authenticates via a token-based flow, so the response to a successful login returns an X-auth-access-token header. Capturing that token satisfies the stem's authentication requirement, because subsequent API calls must present it to prove the session is authorised.

Why: Option B is correct because the FMC REST API requires you to POST to the token-generation endpoint /api/fmc_platform/v1/auth/generatetoken, supplying credentials (typically Basic Auth) to obtain an authentication token. Option E is correct because the token returned in the response's X-auth-access-token header must be captured and reused in subsequent API calls as the authentication credential. The other options are incorrect: A is not one of the two required steps since Basic Auth is only the mechanism used within the generatetoken POST, not a standalone required step; C is unnecessary because a GET to the root URL does not authenticate you; and D is wrong because credentials must not be placed in the URL query string, as the FMC API expects them in the request header/body of the token request.

You are automating Cisco Firepower Management Center (FMC) via the REST API. You need to update an existing object. Which HTTP method must you use to ensure a full update of the resource representation?

PUT

PUT replaces the entire resource representation, sending the complete object body so unspecified fields are overwritten. POST would create or invoke actions, and PATCH applies partial merges, so PUT is required for a full update of the existing FMC object.

POST

GET

PATCH

Why: PUT is the HTTP method defined by RFC 7231 to replace the entire resource representation at the target URI. When updating an existing FMC object via the REST API, PUT sends the complete object body, so any field omitted from the payload is reset to its default or removed. This full-replacement semantic is exactly what the question requires for a 'full update' of the resource.

Want more Network Security practice?

All Advanced Threat And Endpoint Security questions

Domain 2: Advanced Threat And Endpoint Security

You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?

Implement an exponential backoff algorithm before retrying

A 429 signals rate limiting, so exponential backoff spaces retries progressively, letting the client recover without hammering the API. This satisfies the need for a programmatic response that respects throttling, unlike immediate retries or ignoring the error, which worsen the condition.

Immediately retry the request with the same parameters

Update the API key to a higher privilege level

Switch to the secondary API endpoint URL

Why: HTTP 429 means 'Too Many Requests' — the client has exceeded the API rate limit. The correct programmatic response is to back off and retry, ideally using exponential backoff (with jitter) to avoid hammering the endpoint and to respect the server's Retry-After header when present. This is the standard, RFC-aligned way to handle rate limiting gracefully.

You are using the Cisco Secure Endpoint (formerly AMP for Endpoints) API to query file trajectory data for a specific SHA-256 hash. The API returns a 429 Too Many Requests status code. What is the most efficient way to handle this in your automation script?

Switch from HTTPS to HTTP to reduce overhead.

Increase the API rate limit in the Cisco Secure Endpoint dashboard.

Force an authentication refresh on every request.

Implement an exponential backoff strategy with a retry logic.

Exponential backoff waits progressively longer after each 429, for example 1, 2, 4 and 8 seconds, with random jitter so many clients do not retry at once, and gives up after a set number of tries. If the response includes a Retry-After header or rate-limit reset time, use that value. In Python, urllib3's Retry or the tenacity library implement this pattern.

Why: HTTP 429 Too Many Requests means the client has exceeded the API's rate limit, and the correct, standards-aligned response is to back off and retry. Exponential backoff (e.g., wait 1s, 2s, 4s, 8s, with jitter) with retry logic prevents hammering the API, respects the server's Retry-After header when present, and lets the script eventually succeed once the window resets. This is the recommended pattern in Cisco's Secure Endpoint API documentation and in RFC 6585, which defines 429.

You are developing a script to pull Threat Grid sandbox reports. You receive a 401 Unauthorized error. What is the most likely cause?

The file is still being analyzed

The API key is missing or invalid in the Authorization header

Threat Grid authenticates every API request using an API key supplied in the Authorization header. A 401 Unauthorized response means that credential is absent, malformed, or revoked, so the request is rejected before any report data is returned.

Rate limit exceeded

The API endpoint is deprecated

Why: A 401 Unauthorized error from the Threat Grid API indicates that the request lacks valid authentication credentials. The most likely cause is that the API key is missing or invalid in the Authorization header. The API requires a valid API key to authenticate requests.

You are automating Cisco Umbrella policy changes using the Umbrella API. Which resource is used to update the blocked destination list?

/settings/domains

/policies/destinationlists

The Umbrella API exposes destination lists under `/policies/destinationlists`, and blocked destinations are managed as entries within a destination list resource. Updating that list is what changes which domains the policy blocks, satisfying the stem's requirement to modify the blocked destination list rather than a policy or rule object.

/security/blocked

/dns/policies

Why: The Umbrella API exposes destination lists (the allow/block lists applied to policies) under the /policies/destinationlists resource. Updating a blocked destination list means issuing a PUT or POST to that endpoint with the list ID and the domains to add or remove.

In Cisco SecureX Orchestration, you are building an atomic workflow to isolate an endpoint. Which input parameter is required to identify the target host in the Secure Endpoint 'Isolate Host' activity?

connector_guid

The Isolate Host activity identifies the target endpoint through its connector_guid, the unique Secure Endpoint connector identifier. Hostname or IP address alone cannot reliably map to the registered connector, so the GUID is the required input.

ipv4_address

mac_address

hostname

Why: In Cisco SecureX Orchestration, the Secure Endpoint 'Isolate Host' activity requires the connector_guid input parameter to uniquely identify the target endpoint. The connector_guid is the unique identifier assigned to each Secure Endpoint connector when it registers with the cloud, and it is the authoritative key used by the Secure Endpoint API to address a specific host. Other identifiers like IP address, MAC address, or hostname are not guaranteed to be unique or stable and are not accepted by the isolation activity.

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

Retry-After

X-RateLimit-Remaining

SecureX returns rate-limit status through standard X-RateLimit headers. X-RateLimit-Remaining reports the number of requests still available in the current window, which is exactly the value the monitoring script needs to track against the API's limits.

X-Request-Limit

Status-Remaining

Why: SecureX (and most REST APIs following the IETF draft rate-limit header convention) returns the X-RateLimit-Remaining header to indicate how many requests the client can still make in the current window before being throttled. This header is paired with X-RateLimit-Limit (total allowed) and X-RateLimit-Reset (epoch time when the window resets), allowing scripts to pace API calls proactively.

Want more Advanced Threat And Endpoint Security practice?

All Network Programmability Foundation questions

Domain 3: Network Programmability Foundation

You are writing a Python script to interact with the Cisco Firepower Management Center (FMC) API. You need to authenticate to obtain an authentication token. Which HTTP method and endpoint must your script utilize to initiate this process?

PUT /api/fmc_platform/v1/auth/generatetoken

POST /api/fmc_platform/v1/auth/generatetoken

Token generation is a state-changing action, so FMC requires POST rather than GET. The generatetoken endpoint under fmc_platform/v1 accepts Basic credentials and returns the auth token plus refresh token in response headers, which the script then reuses for subsequent API calls.

GET /api/fmc_platform/v1/auth/generatetoken

POST /api/fmc_platform/v1/auth/login

Why: The FMC API authentication flow requires a POST request to /api/fmc_platform/v1/auth/generatetoken with the username and password (typically Basic auth) to obtain an access token and refresh token. The token is then used in the X-auth-access-token header for subsequent API calls. POST is correct because the operation creates a new session token.

When working with YANG data models in Cisco security automation, which TWO statements accurately describe the role of the 'leaf' and 'leaf-list' nodes?

A 'leaf-list' node allows for multiple instances of a specific value type.

A leaf-list defines a node holding multiple instances of the same data type, unlike a leaf. This satisfies the stem's requirement by describing the multi-value collection behaviour that distinguishes leaf-list from single-value leaf nodes in YANG models.

A 'leaf' node can contain child nodes.

Both 'leaf' and 'leaf-list' support default values.

A 'leaf' node contains a single value of a specific type.

A leaf node holds exactly one value of a defined type and cannot repeat, which is the defining contrast with leaf-list. This matches the stem's demand for an accurate statement about leaf node semantics in YANG data models.

A 'leaf-list' node is used for hierarchical grouping.

Why: A 'leaf' contains a single value, while a 'leaf-list' contains a sequence of values of a specific type.

In the context of REST APIs, which status code indicates that a request was successful and a new resource was created on the server?

201 Created

A 201 status code confirms the request succeeded and a new resource was created on the server, typically returned after a POST. It satisfies the stem's constraint of signalling both success and creation, unlike 200 OK, which indicates success without implying a new resource.

200 OK

202 Accepted

204 No Content

Why: HTTP 201 Created is the standard response code for a successful POST request that results in a resource creation.

When parsing a JSON response from a Cisco Adaptive Security Appliance (ASA) REST API call using the Python requests library, you notice the data structure contains a list of objects under the key 'items'. Which Python expression correctly accesses the 'name' field of the first object in that list?

response.json()['items'][1]['name']

response.json().items[0].name

response.json()['items'].get('name')[0]

response.json()['items'][0]['name']

`response.json()` deserialises the body into a Python dictionary, so `['items']` retrieves the list, `[0]` indexes its first element, and `['name']` reads that object's field. This directly satisfies the stem's requirement to access the first object's name within the parsed JSON structure.

Why: The correct expression is response.json()['items'][0]['name']. The .json() method deserializes the HTTP response body into Python objects — here a dict containing the key 'items', whose value is a list of dicts. Python lists are zero-indexed, so [0] retrieves the first element, and ['name'] then extracts the 'name' key from that dict. This matches the documented structure of Cisco ASA REST API responses, which wrap collections in an 'items' array.

You are writing a Python script using the Requests library to retrieve information from a Cisco FTD device. Which HTTP method should be used to ensure the operation is idempotent and does not modify the device configuration state?

GET

GET is defined as a safe, idempotent method: repeated identical requests return the same representation without altering device state. POST, PUT, PATCH and DELETE can all modify configuration, so GET uniquely satisfies the stem's constraint of retrieving information without changing the FTD configuration.

POST

PUT

PATCH

Why: The GET method is correct because it is defined as a safe and idempotent HTTP method, meaning it should only retrieve data and never alter the state of the resource. In the context of a Cisco FTD device, using GET ensures that the script reads configuration or status information without making any changes. This aligns with the requirement to not modify the device configuration state.

You are parsing a complex JSON response from a Cisco ISE API. You need to extract the value of the 'macAddress' field nested inside an object named 'endpoint'. Which Python library is best suited for handling this data structure?

configparser

xml.etree.ElementTree

json

The `json` library parses JSON text into native Python dictionaries and lists, so nested values are reached by key indexing such as `data['endpoint']['macAddress']`. This directly satisfies the stem's requirement to extract a field nested inside an object, without extra dependencies or schema definitions.

pickle

Why: The json library is purpose-built for parsing and manipulating JSON data in Python, making it the correct choice for extracting a nested field like 'macAddress' inside an 'endpoint' object from a Cisco ISE API response. It converts JSON into native Python dictionaries and lists, allowing straightforward key access.

Want more Network Programmability Foundation practice?

All Cloud Web And Email Security Automation questions

Domain 4: Cloud Web And Email Security Automation

Which Cisco security product provides an API to automate the management of web proxy policies and access logs?

Cisco Tetration

Cisco Duo

Cisco Secure Endpoint

Cisco Secure Web Appliance (WSA)

Cisco Secure Web Appliance exposes a REST API for configuring web proxy policies and retrieving access logs programmatically. This satisfies the stem's requirement for a Cisco security product whose API automates proxy policy management and log access, unlike email or endpoint offerings.

Why: Cisco Secure Web Appliance (WSA) is the secure web gateway that enforces web proxy policies and generates access logs, and it exposes a REST API that allows administrators to automate policy management and retrieve access log data. This makes it the correct product for automating web proxy policy and log operations.

You are configuring a Webex CASB integration. To automate the reporting of anomalous file sharing events from a third-party cloud storage service, which API mechanism should you configure to receive real-time updates?

Direct database query access

Registering a Webhook endpoint

Registering a Webhook endpoint lets the third-party service push event notifications to your listener as sharing anomalies occur, satisfying the real-time updates constraint. Unlike polling APIs, which introduce latency between scheduled requests, webhooks deliver each event immediately on occurrence, enabling automated reporting without continuous querying.

SNMP Traps

Using an SSH tunnel to the cloud provider

Polling the REST API every 60 seconds

Why: Webhooks are the standard push-based mechanism for receiving real-time event notifications from cloud services. By registering a Webhook endpoint with the third-party cloud storage provider, the service will HTTP POST event payloads (such as anomalous file sharing events) to your listener as they occur, enabling near-instantaneous CASB reporting without polling overhead.

You are developing a script to interact with the Cisco Cloudlock API to identify risky OAuth applications. Which THREE actions are valid when using the Cloudlock REST API to manage application risk?

Update the Cisco Umbrella DNS filtering policies

Revoke OAuth tokens for identified risky apps

The Cloudlock API exposes token revocation endpoints that invalidate an application's granted OAuth access, directly removing the risky app's permissions. This satisfies the stem's requirement to manage application risk through remediation rather than read-only inspection.

Retrieve risk score for an application

Retrieving an application's risk score is a supported Cloudlock REST API operation, letting the script quantify OAuth risk per app. This satisfies the stem's requirement to identify risky OAuth applications by returning the numeric score used for triage and policy decisions.

Modify the global cloud infrastructure firewall rules

List users who have authorized a specific app

Listing users who authorised a specific app is a supported Cloudlock API operation, letting you enumerate the OAuth grants tied to that application. This satisfies the stem's requirement to identify risky OAuth applications by exposing which accounts granted access, enabling revocation or investigation of the offending app's user base.

Why: The Cloudlock REST API is designed for CASB-style visibility and remediation of sanctioned and unsanctioned cloud apps, so option B (revoke OAuth tokens for identified risky apps) is valid because Cloudlock exposes remediation endpoints that let an administrator revoke a user's or app's OAuth grant to cut off risky third-party access. Option C (retrieve risk score for an application) is correct because Cloudlock assigns each discovered application a risk score based on its community/CISO rating and exposes it through API queries so scripts can triage apps programmatically. Option E (list users who have authorized a specific app) is also correct because the API can enumerate the users and OAuth authorizations tied to a given application, which is essential for investigating exposure and scoping remediation. Option A is wrong because DNS filtering policies are managed in Cisco Umbrella's policy API, not the Cloudlock application-risk API, and option D is wrong because global cloud infrastructure firewall rules are not a Cloudlock API function—Cloudlock governs SaaS/app authorization risk, not underlying network firewall configuration.

When using the Cisco Secure Email (formerly ESA) AsyncOS API to fetch message tracking data, what is the mandatory header required for authentication?

Cookie: session_id

Authorization

The AsyncOS API requires an HTTP `Authorization` header carrying a Base64-encoded `username:password` credential pair, satisfying the stem's mandatory authentication constraint. Without it, tracking requests are rejected outright. Other headers, such as `Content-Type` or `Accept`, govern payload negotiation only and cannot authenticate the caller.

Bearer-Token

X-API-Key

Why: The Cisco Secure Email AsyncOS API requires the Authorization header for authentication when fetching message tracking data. This header must contain a valid API token or credentials, typically in the format 'Authorization: Basic <base64-encoded-credentials>' or 'Authorization: Bearer <token>'. The API uses this header to authenticate and authorize the request, ensuring that only authorized users can access sensitive message tracking information.

You are automating policy updates for Cisco Umbrella using the Umbrella Management API. You need to identify the correct endpoint to retrieve the list of destination lists for a specific organization. Which HTTP method and path should you use?

GET /v1/organizations/{organizationId}/destinationlists

The GET method on /v1/organizations/{organizationId}/destinationlists targets the organisation-scoped collection, returning destination lists for that org. The path parameter binds the request to the specific organizationId, satisfying the requirement to retrieve lists for one organisation rather than all.

GET /v1/policies/destinationlists

POST /v1/organizations/{organizationId}/destinationlists

PUT /v1/organizations/{organizationId}/destinationlists

Why: The Umbrella Management API exposes destination lists as a sub-resource of an organization, so the correct call is GET /v1/organizations/{organizationId}/destinationlists. GET is the HTTP verb used for read/retrieve operations, and the organizationId path parameter scopes the request to the correct tenant. This matches the documented Umbrella API pattern where all org-scoped resources are nested under /v1/organizations/{organizationId}/.

You are automating the retrieval of threat intelligence logs from Cisco Secure Email Cloud Gateway. Which API interface provides the most efficient way to fetch historical message tracking logs for automated analysis?

AsyncOS API

External Threat Feeds API

Web Security Appliance API

Reporting API

The Reporting API is purpose-built for bulk retrieval of historical message tracking data, exposing endpoints that query stored logs by time range and filter. Unlike the live Message Tracking or quarantine interfaces, it satisfies the stem's requirement to fetch historical logs efficiently for automated analysis.

Why: The Reporting API on Cisco Secure Email Cloud Gateway is purpose-built for retrieving historical message tracking data, including delivered, bounced, and quarantined messages over a time range. It exposes endpoints that query the message tracking database efficiently, making it the correct choice for automated historical log analysis. Other APIs serve different functions such as threat feeds or web security.

Want more Cloud Web And Email Security Automation practice?

Browse all SAUTO questions Take a timed practice test

Frequently asked questions

How many questions are on the SAUTO exam?

The vendor does not publish an exact question count for the SAUTO. Always confirm current details on the vendor's official exam page.

What types of questions appear on the SAUTO exam?

CLI output interpretation, network topology analysis, routing behaviour, switching concepts, troubleshooting, and configuration questions.

How are SAUTO questions organised by domain?

The exam covers 4 domains: Network Security, Advanced Threat And Endpoint Security, Network Programmability Foundation, Cloud Web And Email Security Automation. Questions are weighted by domain — higher-weight domains appear more on your actual exam.

Are these the actual SAUTO exam questions?

No. These are original exam-style practice questions written against the official Cisco SAUTO exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.

Ready to practice all 272 SAUTO questions?

Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.

Cisco · Free Practice Questions · Last reviewed May 2026

SAUTO Exam Questions and Answers

24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.

4 exam domains

Overview Domain Blueprint Study Guide All QuestionsSample by Domain

1. Network Security 2. Advanced Threat And Endpoint Security 3. Network Programmability Foundation 4. Cloud Web And Email Security Automation

Domain 1: Network Security

All Network Security questions

GET

PATCH

POST

PUT

You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?

POST /ers/config/guestuser/update

UPDATE /ers/config/guestuser/{id}

PATCH /ers/config/guestuser/{id}

PUT /ers/config/guestuser/{id}

You are using the Cisco Firepower Management Center (FMC) API to retrieve a list of Access Control Policies. Which URL endpoint is correct?

/api/fmc_config/v1/policy/access

/api/v1/fmc/acp

/api/fmc_config/v1/domain/{uuid}/policy/accesspolicies

/api/fmc_config/v1/domain/policy/accesspolicies

Call the /deploy endpoint using the deployment target devices list.

The FMC automatically pushes objects immediately after the POST request returns 201.

Send a commit command to the FTD device directly via SSH.

Restart the snort process via the API.

Which TWO steps are required to properly authenticate to the Cisco Firepower Management Center (FMC) API using the REST API Explorer?

Use Basic Auth in the header with admin credentials

Send a POST request to /api/fmc_platform/v1/auth/generatetoken

Perform a GET request to the root URL

Send credentials in the URL query string

Capture the X-auth-access-token header from the response

PUT

POST

GET

PATCH

Want more Network Security practice?

All Advanced Threat And Endpoint Security questions

Domain 2: Advanced Threat And Endpoint Security

You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?

Implement an exponential backoff algorithm before retrying

Immediately retry the request with the same parameters

Update the API key to a higher privilege level

Switch to the secondary API endpoint URL

Switch from HTTPS to HTTP to reduce overhead.

Increase the API rate limit in the Cisco Secure Endpoint dashboard.

Force an authentication refresh on every request.

Implement an exponential backoff strategy with a retry logic.

You are developing a script to pull Threat Grid sandbox reports. You receive a 401 Unauthorized error. What is the most likely cause?

The file is still being analyzed

The API key is missing or invalid in the Authorization header

Rate limit exceeded

The API endpoint is deprecated

You are automating Cisco Umbrella policy changes using the Umbrella API. Which resource is used to update the blocked destination list?

/settings/domains

/policies/destinationlists

/security/blocked

/dns/policies

connector_guid

ipv4_address

mac_address

hostname

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

Retry-After

X-RateLimit-Remaining

X-Request-Limit

Status-Remaining

Want more Advanced Threat And Endpoint Security practice?

All Network Programmability Foundation questions

Domain 3: Network Programmability Foundation

PUT /api/fmc_platform/v1/auth/generatetoken

POST /api/fmc_platform/v1/auth/generatetoken

GET /api/fmc_platform/v1/auth/generatetoken

POST /api/fmc_platform/v1/auth/login

When working with YANG data models in Cisco security automation, which TWO statements accurately describe the role of the 'leaf' and 'leaf-list' nodes?

A 'leaf-list' node allows for multiple instances of a specific value type.

A 'leaf' node can contain child nodes.

Both 'leaf' and 'leaf-list' support default values.

A 'leaf' node contains a single value of a specific type.

A 'leaf-list' node is used for hierarchical grouping.

Why: A 'leaf' contains a single value, while a 'leaf-list' contains a sequence of values of a specific type.

In the context of REST APIs, which status code indicates that a request was successful and a new resource was created on the server?

201 Created

200 OK

202 Accepted

204 No Content

Why: HTTP 201 Created is the standard response code for a successful POST request that results in a resource creation.

response.json()['items'][1]['name']

response.json().items[0].name

response.json()['items'].get('name')[0]

response.json()['items'][0]['name']

GET

POST

PUT

PATCH

configparser

xml.etree.ElementTree

json

pickle

Want more Network Programmability Foundation practice?

All Cloud Web And Email Security Automation questions

Domain 4: Cloud Web And Email Security Automation

Which Cisco security product provides an API to automate the management of web proxy policies and access logs?

Cisco Tetration

Cisco Duo

Cisco Secure Endpoint

Cisco Secure Web Appliance (WSA)

Direct database query access

Registering a Webhook endpoint

SNMP Traps

Using an SSH tunnel to the cloud provider

Polling the REST API every 60 seconds

You are developing a script to interact with the Cisco Cloudlock API to identify risky OAuth applications. Which THREE actions are valid when using the Cloudlock REST API to manage application risk?

Update the Cisco Umbrella DNS filtering policies

Revoke OAuth tokens for identified risky apps

Retrieve risk score for an application

Modify the global cloud infrastructure firewall rules

List users who have authorized a specific app

When using the Cisco Secure Email (formerly ESA) AsyncOS API to fetch message tracking data, what is the mandatory header required for authentication?

Cookie: session_id

Authorization

Bearer-Token

X-API-Key

GET /v1/organizations/{organizationId}/destinationlists

GET /v1/policies/destinationlists

POST /v1/organizations/{organizationId}/destinationlists

PUT /v1/organizations/{organizationId}/destinationlists

AsyncOS API

External Threat Feeds API

Web Security Appliance API

Reporting API

Want more Cloud Web And Email Security Automation practice?