SAUTO Practice Test 15 — 15 Questions

Question 1

In an HTTP request, what does the '201 Created' status code signify?

Accepted Answer

The resource was created successfully.. The 201 Created status code indicates that the request succeeded and a new resource was created as a result — typically returned in response to a POST or PUT that creates a resource. The response often includes a Location header pointing to the new resource's URI.

Answer

The request was accepted for processing but is not finished.

Answer

The request was received and processed successfully.

Answer

The request resulted in a temporary redirect.

Question 2

You are automating a threat hunt using SecureX. Which API response field confirms that an observable is malicious?

Accepted Answer

disposition. In Cisco SecureX, the Threat Intelligence API returns a 'disposition' field that indicates whether an observable is malicious, suspicious, neutral, or unknown. This field is the definitive confirmation of maliciousness, as it aggregates verdicts from multiple intelligence sources. Other fields like threat_level or malware_score may provide additional context but are not the primary confirmation field.

Answer

malware_score

Answer

threat_level

Answer

status_code

Question 3

Which THREE headers are commonly used when sending authenticated requests to Cisco Security APIs?

Accepted Answer

Content-Type. Content-Type (A) is correct because authenticated Cisco Security API requests must declare the media type of the request body (e.g., application/json) so the API can parse the payload correctly. Authorization (D) is correct because it carries the authentication credential, such as a Bearer token or Basic base64-encoded credentials, which the API validates to authenticate the caller. Accept (E) is correct because it tells the API which response media type the client expects, typically application/json, ensuring the response is returned in a usable format. Cookie (B) is not a standard header for these API authentications since Cisco Security APIs rely on Authorization tokens rather than session cookies, and User-Agent (C) is merely informational about the client and is not required for authentication.

Answer

Cookie

Answer

User-Agent

Question 4

Which Cisco technology provides a unified dashboard to visualize data from AMP, Umbrella, and Threat Grid?

Accepted Answer

Cisco SecureX. Cisco SecureX is the cloud-native platform that provides a unified dashboard and integrates data from multiple Cisco security products, including AMP, Umbrella, and Threat Grid. It aggregates alerts, provides threat hunting, and enables automated workflows across the security stack. SecureX is designed as the single pane of glass for Cisco's security portfolio.

Answer

Cisco Firepower Management Center

Answer

Cisco Stealthwatch

Answer

Cisco ISE

Question 5

Your automated script is designed to update a Cisco Umbrella policy. What is the correct procedure to ensure that changes do not cause downtime?

Accepted Answer

GET current, modify, then PUT the updated policy. The safe, idempotent procedure for updating an Umbrella policy via API is to GET the current policy, modify the returned JSON locally, and PUT the updated object back. This read-modify-write pattern preserves all existing fields and settings that the script does not intend to change, avoiding accidental removal of rules or settings. It also ensures the payload matches the current schema version returned by the API.

Answer

Use a direct database write to the Umbrella backend

Answer

POST a new policy and delete the old one

Answer

Simply overwrite the entire policy with a new static file

Question 6

An automation script is querying the Cisco Secure Endpoint (AMP for Endpoints) API to retrieve file trajectory data for a specific SHA-256 hash. The script is returning a 429 status code. What is the most efficient way to handle this in your automation code?

Accepted Answer

Implement an exponential backoff algorithm in the retry loop. HTTP 429 means 'Too Many Requests' — the API rate limit has been exceeded. The correct and most efficient client-side handling is exponential backoff: wait, retry, and progressively increase the delay between retries, ideally with jitter, until the request succeeds. This respects the server's rate limit while eventually completing the request without manual intervention.

Answer

Increase the API token expiration time in the Secure Endpoint console

Answer

Request a higher API privilege level from the administrator

Answer

Force the API to use a different base URL

Question 7

When automating threat hunting with the Cisco SecureX Threat Response API, which object type is commonly used as a search parameter?

Accepted Answer

Observable. Threat Response uses 'observables' (e.g., IP addresses, file hashes, domains) as the primary objects for investigation.

Answer

Session ID

Answer

Policy Name

Answer

Device ID

Question 8

You are automating Cisco Umbrella policy changes using the Umbrella API. Which resource is used to update the blocked destination list?

Accepted Answer

/policies/destinationlists. The Umbrella API exposes destination lists (the allow/block lists applied to policies) under the /policies/destinationlists resource. Updating a blocked destination list means issuing a PUT or POST to that endpoint with the list ID and the domains to add or remove.

Answer

/settings/domains

Answer

/security/blocked

Answer

/dns/policies

Question 9

Which Python library is the industry standard for sending HTTP requests to Cisco security APIs?

Accepted Answer

requests. The 'requests' library is the most widely used and recommended library for interacting with REST APIs in Python due to its simplicity and robust feature set.

Answer

netmiko

Answer

urllib

Answer

paramiko

Question 10

What is the purpose of the 'json.loads()' function in Python?

Accepted Answer

To parse a JSON string into a Python object.. 'json.loads()' parses a JSON-formatted string and converts it into a Python dictionary.

Answer

To read a JSON file from disk.

Answer

To convert a Python dictionary to a JSON string.

Answer

To validate the structure of a JSON document.

Question 11

In Python, which HTTP library is most recommended for interacting with Cisco Security APIs due to its simplicity and features?

Accepted Answer

requests. The 'requests' library is the industry standard for HTTP interactions in Python due to its human-readable syntax and built-in features.

Answer

socket

Answer

urllib

Answer

http.client

Question 12

You are integrating Cisco Cloudlock with an external SIEM using the Cloudlock API. Which mechanism should you implement to receive real-time security events instead of polling the API repeatedly?

Accepted Answer

Webhook integration. Cisco Cloudlock supports webhook integration as its primary mechanism for real-time event delivery. When a security event occurs (e.g., policy violation, anomalous user behavior), Cloudlock sends an HTTP POST request to a pre-configured endpoint with a JSON payload describing the event. This push model eliminates the need for constant polling, reduces API call overhead, and ensures near-instantaneous notification to external systems like a SIEM. Webhooks are the standard, documented approach for Cloudlock API event streaming.

Answer

WebSocket handshake

Answer

Server-Sent Events (SSE)

Answer

SNMP Traps

Question 13

What is the role of an 'OAuth Bearer Token' in Cisco security automation?

Accepted Answer

Provides temporary authorization for API access. An OAuth Bearer Token provides temporary authorization for API access, typically obtained after authenticating with credentials. It is time-limited and scoped, allowing secure, delegated access without sharing passwords. In Cisco security automation, it's used to authenticate API calls to platforms like FMC, ISE, or Umbrella.

Answer

Replaces the API key permanently

Answer

Encrypts the API traffic

Answer

Defines the user's GUI password

Question 14

When using the Cisco Threat Grid API, which TWO methods can be used to retrieve report data?

Accepted Answer

GET by ID. Option A (GET by ID) is correct because the Threat Grid API exposes a REST endpoint such as GET /api/v2/samples/{id} or /api/v2/submissions/{id} that returns the full report for a specific sample or submission identified by its unique ID. Option E (GET by search query) is correct because the API also supports GET requests against search endpoints (e.g., /api/v2/search/submissions or /api/v2/search/samples) with query parameters, allowing report data to be retrieved by matching criteria rather than a single ID. The remaining options do not belong: DELETE by report (B) removes or deletes a resource rather than retrieving report data, POST by ID (C) is used to create or submit resources, and PUT by search (D) is used to update or replace a resource, not to fetch reports.

Answer

DELETE by report

Answer

POST by ID

Answer

PUT by search

Question 15

You are developing a script to pull Threat Grid sandbox reports. You receive a 401 Unauthorized error. What is the most likely cause?

Accepted Answer

The API key is missing or invalid in the Authorization header. A 401 Unauthorized error from the Threat Grid API indicates that the request lacks valid authentication credentials. The most likely cause is that the API key is missing or invalid in the Authorization header. The API requires a valid API key to authenticate requests.

Answer

The file is still being analyzed

Answer

Rate limit exceeded

Answer

The API endpoint is deprecated