SAUTO Practice Test 12 — 15 Questions

Question 1

Which THREE of the following are common issues encountered when automating Cisco Security APIs? (Choose three)

Accepted Answer

Incorrect URL endpoints or API versioning. Option B is correct because Cisco Security APIs (e.g., Cisco Firepower, Umbrella, ISE, and SecureX) expose versioned REST endpoints, and automation scripts frequently fail when they hard-code an outdated path such as /v1/ instead of the current /v2/ or when they target the wrong base URL for a given tenant or region. Option C is correct because Cisco Security API gateways enforce rate limits (for example, Umbrella enforces per-organization request quotas and Firepower Management Center enforces concurrent API call limits), so automation that polls too aggressively receives HTTP 429 Too Many Requests responses and must implement backoff/retry logic. Option D is correct because Cisco Security APIs rely on OAuth 2.0 bearer tokens or API keys that expire after a set lifetime, so long-running automation fails with HTTP 401 Unauthorized unless it refreshes tokens or rotates credentials. Option A is not a software/API automation concern at all, since power supply compatibility is a hardware issue unrelated to REST calls. Option E is likewise irrelevant, as Ethernet cable color has no bearing on API authentication, endpoint routing, or rate limiting.

Answer

Incompatible physical power supply

Answer

Wrong color of Ethernet cables

Question 2

Which TWO of the following are components of a URL? (Choose two)

Accepted Answer

Protocol (e.g., https). A URL's structure begins with the scheme, so option A (Protocol, e.g., https) is correct because it specifies how the resource is accessed, such as http, https, or ftp, and appears before the '://' delimiter. Option D (Host/Domain name) is also correct because it identifies the server hosting the resource, e.g., www.example.com, and is a required authority component of a URL. Option B is incorrect because a URL contains a hostname or domain name, not the local machine's IP address, which is the client's own address. Option C is incorrect because a URL never includes the server's physical CPU type, as that is hardware information unrelated to addressing. Option E is incorrect because credentials such as a password are not part of a standard URL structure and would be a serious security risk if embedded there.

Answer

The local machine's IP address

Answer

The server's physical CPU type

Answer

The user's password

Question 3

Which THREE components are typically involved in a SecureX orchestration workflow that automates the isolation of a host based on an Umbrella alert?

Accepted Answer

Event trigger. In a SecureX orchestration workflow, an Event trigger (A) is the component that starts the workflow automatically when a signal such as an Umbrella alert is received, making it essential for alert-driven automation. An Activity block (C) performs the actual work in the workflow, such as calling the Umbrella or Cisco ISE/Firepower APIs to isolate the host, so it is required to execute the isolation action. A Target appliance configuration (D) defines the connection and credentials for the device or service (e.g., firewall, ISE, Umbrella) that the workflow will act upon, which is necessary for the activity to reach and isolate the host. A Local SQL database server (B) is not a standard component of SecureX orchestration workflows, as data handling is done through activities and variables rather than a dedicated local SQL server. A Physical hardware switch console (E) is also not part of the orchestration workflow; isolation is performed via API-driven network/security appliances, not manual console access.

Answer

Local SQL database server

Answer

Physical hardware switch console

Question 4

In a Cisco security automation environment, what does the 'API Rate Limit' represent?

Accepted Answer

The number of requests allowed per time unit.. Rate limits restrict the number of requests a client can make in a specified time window to protect API availability.

Answer

The speed of the network connection.

Answer

The timeout value for an API request.

Answer

The maximum size of an API payload.

Question 5

Which THREE steps are required to automate the update of an Umbrella policy using the Umbrella Management API?

Accepted Answer

Perform a GET request to fetch the current policy configuration. To automate an Umbrella policy update via the Umbrella Management API, you must first perform a GET request to retrieve the current policy configuration (option B), because the API requires the existing policy object and its identifiers to build a valid update payload. Next, you modify the JSON structure to reflect the desired policy changes (option E), adjusting the relevant fields in the retrieved JSON so it represents the new intended state. Finally, you send a PUT request with the updated JSON payload (option C), which replaces the existing policy resource with the modified configuration. A DELETE request before the PUT (option A) is not required and would remove the policy rather than update it, converting the policy to binary (option D) is unnecessary since the API uses JSON, and no other steps beyond GET, modify, and PUT are needed for this automation.

Answer

Send a DELETE request before the PUT request

Answer

Convert the policy into a binary format

Question 6

Which TWO of the following are true regarding the Cisco Firepower Management Center (FMC) API?

Accepted Answer

It supports OAuth 2.0 token-based authentication. Option A is correct because the Cisco FMC API supports OAuth 2.0 token-based authentication, where clients POST credentials to /api/fmc_platform/v1/auth/generatetoken to obtain a short-lived access token (and a refresh token) that is then sent in the X-auth-access-token header. Option B is correct because the FMC API is built on a REST-based architecture, exposing versioned HTTPS endpoints such as /api/fmc_config/v1/domain/{domainUUID}/... that use standard HTTP methods (GET, POST, PUT, DELETE) for CRUD operations. Option C is incorrect because the FMC API does not use SOAP/XML web services; it is RESTful and communicates over HTTPS with JSON payloads. Option D is incorrect because the API supports full read-write operations, including creating, modifying, and deleting policies, objects, and device configurations, not just reads. Option E is incorrect because the FMC API uses JSON as its payload format, not XML exclusively.

Answer

It requires SOAP/XML formatting

Answer

It is limited to read-only operations

Answer

It exclusively uses the XML format for payloads

Question 7

When using the Cisco Umbrella Reporting API, what is the default limit for the number of records returned in a single GET request?

Accepted Answer

100. The Umbrella Reporting API enforces a default limit (typically 100) on the number of results per request to ensure system performance; pagination is required for larger sets.

Answer

1000

Answer

50

Answer

500

Question 8

When designing secure network automation, which practice is considered the most critical for API credentials?

Accepted Answer

Using environment variables or a vault solution. Storing credentials in plaintext is a severe security vulnerability. Using secret managers (like HashiCorp Vault) or environment variables is the required best practice.

Answer

Hardcoding credentials in the script

Answer

Using a shared service account with no password

Answer

Saving credentials in a local text file

Question 9

You are running a script that interacts with the Cisco ISE ERS API. The script is designed to perform a bulk import of users. Which HTTP code should you expect for a successful creation request?

Accepted Answer

201 Created. HTTP 201 Created is the standard response for a successful POST request that creates a new resource.

Answer

200 OK

Answer

202 Accepted

Answer

204 No Content

Question 10

Which THREE actions are essential when implementing a Python-based automation script that interacts with a Cisco REST API using the 'requests' library to ensure secure communication?

Accepted Answer

Always ensure the connection uses the 'https' protocol scheme in the URL.. Option A is correct because Cisco REST APIs (e.g., DNA Center, IOS-XE RESTCONF) require TLS, so the URL must use the https:// scheme to encrypt credentials and payloads in transit rather than sending them in cleartext over http://. Option D is correct because keeping tokens and passwords out of source code via environment variables or a secrets vault prevents credential leakage through version control, logs, or shared scripts. Option E is correct because requests defaults to verify=True, and explicitly passing verify=True ensures the server's certificate chain and hostname are validated against trusted CAs, preventing man-in-the-middle attacks. Option B is wrong because hardcoding credentials in plain text exposes them to anyone with file or repository access. Option C is wrong because disabling SSL verification (verify=False) removes certificate validation and enables MITM interception, which is unacceptable in production.

Answer

Store API credentials in plain text in the script for easy portability.

Answer

Disable SSL verification for all production API connections.

Question 11

You are performing a bulk update of Security Group Tags (SGTs) in Cisco ISE. Which mechanism should you prioritize to minimize load on the API when processing thousands of tags?

Accepted Answer

ISE ERS Batch API endpoints. The ISE ERS (External RESTful Services) Batch API endpoints allow multiple operations to be submitted in a single API call, drastically reducing the number of HTTP requests and the load on ISE when updating thousands of SGTs. This is the recommended mechanism for bulk operations. Iterative single-POST requests would overwhelm the API and are inefficient.

Answer

Iterative single-POST requests

Answer

pxGrid streaming

Answer

Direct SQL injection to the ISE DB

Question 12

When automating security, which methodology is used to treat infrastructure configurations as code?

Accepted Answer

Infrastructure as Code (IaC). Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure through machine-readable definition files.

Answer

Continuous Integration

Answer

DevOps

Answer

Agile Security

Question 13

Which THREE of the following actions can be automated via the Cisco ASA REST API?

Accepted Answer

Monitoring Interface Statistics. The Cisco ASA REST API exposes configuration and monitoring endpoints for supported ASA features, so option A (Monitoring Interface Statistics) is correct because interface counters and status can be retrieved programmatically via the monitoring/operational endpoints. Option C (Updating Access Control Rules) is correct because access lists and access-group bindings are configurable objects that the REST API can create, modify, and delete. Option E (Creating Network Objects) is correct because network objects and object groups are among the primary configuration resources the ASA REST API manages. Option B (Modifying physical chassis fan speed) is not correct because fan speed is controlled by the hardware/environmental subsystem and is not exposed as a REST API configuration resource. Option D (Updating device firmware/BIOS) is not correct because firmware/BIOS/ASA software image upgrades are performed through the CLI, ASDM, or ROMmon, not through the REST API.

Answer

Modifying physical chassis fan speed

Answer

Updating device firmware/BIOS

Question 14

You are troubleshooting a Python script using the Cisco pxGrid API. The script fails to receive notifications from ISE. Which component must be verified first?

Accepted Answer

The pxGrid controller status and connection state.. The pxGrid connection state must be established and 'active' to receive notifications. The connection is a two-way handshake process.

Answer

The local machine's DNS settings.

Answer

The ISE ERS API status.

Answer

The TACACS+ shared secret.

Question 15

Which mechanism in YANG allows you to group multiple data nodes that are used in various parts of the model to reduce duplication?

Accepted Answer

grouping. A grouping in YANG is a reusable container of data nodes (leaf, leaf-list, list, container, etc.) that can be instantiated multiple times across the model using the 'uses' statement. This avoids duplicating identical node definitions in different parts of the tree, which is exactly the deduplication purpose described. Groupings are defined once and referenced wherever the same structure is needed.

Answer

typedef

Answer

module

Answer

augment