SAUTO Practice Test 16 — 15 Questions

Question 1

Which TWO items are required to properly authenticate a SecureX API request using an API Client?

Accepted Answer

Client Secret. To authenticate a SecureX API request with an API Client, you must supply the Client ID (E) and Client Secret (D) that were generated when the API Client was created in the SecureX portal; these two values are exchanged for an access token via the OAuth 2.0 client-credentials flow, which is how SecureX authorizes machine-to-machine API calls. The Client ID identifies the specific API Client, while the Client Secret acts as its confidential credential, and both are required together for the token request to succeed. By contrast, a Username (B) and Password (A) are user-account credentials used for interactive/human login, not for API Client authentication, and a Device GUID (C) is an identifier for a registered device rather than an API credential, so none of those unmarked options belong in this scenario.

Answer

Password

Answer

Username

Answer

Device GUID

Question 2

Which TWO of the following are valid components of a YANG model definition?

Accepted Answer

leaf. Option A, leaf, is correct because a leaf is a fundamental YANG node type that holds a single scalar value (such as a string, integer, or boolean) and has no child nodes, making it a core building block of any YANG module. Option B, container, is also correct because a container is a valid YANG node that groups related nodes (leaves, lists, other containers) into a subtree but holds no value of its own, and it is used to organize the data tree hierarchy. The remaining options do not belong: socket is an operating-system networking abstraction, not a YANG statement; interface is a conceptual networking entity that in YANG would be modeled via a list or container, not as a YANG component itself; and packet is a unit of data on a network, not a construct defined by the YANG modeling language.

Answer

socket

Answer

interface

Answer

packet

Question 3

Which TWO methods are used by the Cisco Threat Grid API to notify external systems when a file analysis has completed?

Accepted Answer

Configuring a webhook URL in the analysis settings. Option B is correct because the Cisco Threat Grid API supports webhook callbacks: you configure a callback/webhook URL in the submission or analysis settings, and Threat Grid sends an HTTP POST to that URL when the sample analysis reaches a terminal state, allowing external systems to be notified without continuously asking for status. Option D is correct because the API also supports a pull model in which the external system periodically polls the analysis status endpoint (for example, the sample/analysis status resource) using the analysis ID until the state indicates completion, then retrieves the report. Options A, C, and E are not part of the Threat Grid API notification mechanisms: Threat Grid does not modify the local system registry, does not send email notifications to administrators as an API completion-notification method, and does not permit external systems to query its backend database directly via SQL; all access is through the supported REST API.

Answer

Modifying the local system registry

Answer

Sending an email notification to the IT administrator

Answer

Directly querying the Threat Grid database via SQL

Question 4

Which TWO actions must you perform to successfully integrate an automation script with the Cisco Secure Email API?

Accepted Answer

Use HTTP Basic Authentication in your request headers. Option B is correct because the Cisco Secure Email (ESA) REST API authenticates requests using HTTP Basic Authentication, where the script must send a Base64-encoded username:password pair in the Authorization header. Option C is correct because the REST API service is disabled by default on the appliance and must be explicitly enabled in the feature configuration (via the GUI or the `restapi` CLI command) before any API calls will be accepted. Option A is incorrect because no local Python agent is required on the appliance; scripts run externally and communicate over HTTPS. Option D is incorrect because SNMPv3 is used for monitoring and management via SNMP, not for REST API authentication. Option E is incorrect because registering with Cisco Defense Orchestrator is a separate cloud-management integration and is not a prerequisite for using the local Secure Email API.

Answer

Install a local Python agent on the appliance

Answer

Configure an SNMPv3 user for API access

Answer

Register the appliance with Cisco Defense Orchestrator

Question 5

Which TWO of the following are key features of the Cisco Cloudlock API?

Accepted Answer

Incident retrieval. Option A (Incident retrieval) is correct because the Cisco Cloudlock API exposes REST endpoints that let security teams programmatically pull incident data—such as policy violations and DLP events—from the Cloudlock platform for SIEM/SOAR ingestion and automated response. Option E (OAuth application auditing) is correct because Cloudlock's core CASB capability includes discovering and auditing third-party OAuth applications connected to SaaS tenants (e.g., Google Workspace, Microsoft 365), and the API surfaces this app-risk and permission data for review. The remaining options do not belong: firmware deployment (B) is a network-device management function, hardware firewall rule management (C) is performed on firewalls like Cisco Secure Firewall/ASA rather than a cloud CASB API, and Layer 2 packet inspection (D) is a network-layer function, whereas Cloudlock is an API-based cloud security service that inspects SaaS data and activity, not raw frames.

Answer

Firmware deployment

Answer

Hardware firewall rule management

Answer

Packet inspection at Layer 2

Question 6

Which THREE of the following are common challenges when automating Cisco Security appliance APIs?

Accepted Answer

Managing authentication token expiration. Option A is correct because Cisco Security appliance APIs (e.g., Firepower Management Center, Cisco Secure Firewall, ISE) typically issue time-limited authentication tokens or session IDs that expire, so automation scripts must detect expiration and re-authenticate to avoid 401 Unauthorized errors. Option B is correct because platforms such as FMC and Cisco Defense Orchestrator use a staged configuration model where API calls modify a pending configuration that must be explicitly committed/deployed (e.g., POST to /api/fmc_config/v1/domain/{id}/deployment/deployabledevices or a commit endpoint); forgetting this leaves changes unapplied. Option E is correct because Cisco Security APIs enforce rate limits (e.g., FMC's 120 requests per minute per user, or ISE's throttling), and automation that ignores 429 Too Many Requests responses or lacks backoff/retry logic will fail or be throttled. Option C is not relevant because these are programmatic REST APIs consumed by scripts, not browser-rendered interfaces, so browser compatibility does not apply. Option D is not a challenge specific to automating Cisco Security appliance APIs; lack of network connectivity is a generic infrastructure issue, not an API automation challenge inherent to these appliances.

Answer

Browser compatibility

Answer

Lack of network connectivity

Question 7

You are developing a script to interact with the Cisco Cloudlock API to identify risky OAuth applications. Which THREE actions are valid when using the Cloudlock REST API to manage application risk?

Accepted Answer

Revoke OAuth tokens for identified risky apps. The Cloudlock REST API is designed for CASB-style visibility and remediation of sanctioned and unsanctioned cloud apps, so option B (revoke OAuth tokens for identified risky apps) is valid because Cloudlock exposes remediation endpoints that let an administrator revoke a user's or app's OAuth grant to cut off risky third-party access. Option C (retrieve risk score for an application) is correct because Cloudlock assigns each discovered application a risk score based on its community/CISO rating and exposes it through API queries so scripts can triage apps programmatically. Option E (list users who have authorized a specific app) is also correct because the API can enumerate the users and OAuth authorizations tied to a given application, which is essential for investigating exposure and scoping remediation. Option A is wrong because DNS filtering policies are managed in Cisco Umbrella's policy API, not the Cloudlock application-risk API, and option D is wrong because global cloud infrastructure firewall rules are not a Cloudlock API function—Cloudlock governs SaaS/app authorization risk, not underlying network firewall configuration.

Answer

Update the Cisco Umbrella DNS filtering policies

Answer

Modify the global cloud infrastructure firewall rules

Question 8

Which TWO of the following are benefits of using the Cisco Secure Endpoint API for automated threat hunting?

Accepted Answer

Cross-platform integration with other security tools. Option B is correct because the Cisco Secure Endpoint API exposes RESTful endpoints that let automated threat-hunting scripts and SOAR/SIEM platforms (e.g., Splunk, Cortex XSOAR) pull telemetry and push verdicts, enabling cross-platform integration with other security tools rather than requiring manual console work. Option E is correct because the API provides programmatic access to file trajectory data—the record of a file's observed activities such as execution, network connections, and child processes—which is exactly the evidence threat hunters query to trace malicious behavior at scale. Option A is wrong because the API does not automatically delete administrative accounts; account remediation is a separate IAM/administrative function, not a Secure Endpoint API capability. Option C is wrong because the API's value is automation and bulk operations, not manual management of individual workstation policies, which is the opposite of a benefit for automated threat hunting. Option D is wrong because the API does not reduce the amount of stored data; it retrieves and correlates endpoint telemetry, and any retention reduction would come from separate data-management settings, not from API use.

Answer

Automatic removal of all administrative accounts

Answer

Manual management of individual workstation policies

Answer

Reduction in the amount of data stored

Question 9

Which THREE actions are essential when designing a secure automation script that interacts with the Cisco Secure Endpoint API?

Accepted Answer

Implement exponential backoff for rate-limited responses. Option B is correct because the Cisco Secure Endpoint API enforces rate limits and returns HTTP 429 responses; exponential backoff with retry logic prevents the script from being throttled or blocked while handling transient failures gracefully. Option C is correct because hardcoding credentials in scripts exposes secrets in source control and logs; storing them in environment variables or a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) keeps API keys and client secrets out of the codebase and supports rotation. Option E is correct because robust logging of API requests and responses provides an audit trail for troubleshooting, detecting anomalies, and meeting compliance requirements, while ensuring sensitive data like tokens is redacted. Option A is wrong because embedding the root admin password in a script violates least-privilege and secret-management principles, and the API should use dedicated API credentials rather than the root admin account. Option D is wrong because disabling SSL/TLS verification enables man-in-the-middle attacks and exposes credentials and data in transit, which is never acceptable for a secure automation script.

Answer

Use the root admin password directly in the script

Answer

Disable SSL verification to increase script speed

Question 10

Which TWO actions can be automated via the Cisco Secure Endpoint API to improve incident response?

Accepted Answer

Scan host. Option A (Scan host) is correct because the Cisco Secure Endpoint API exposes endpoints such as /computers/{id}/scan that let an incident responder programmatically trigger an on-demand malware scan of a specific computer, which is a core containment/triage action. Option C (Isolate host) is correct because the API provides a network isolation endpoint (e.g., /computers/{id}/isolation) that can be automated to quarantine an infected endpoint from the network during incident response. Option B (Reboot device) is not a supported Secure Endpoint API incident-response action for this purpose, as the API focuses on scanning, isolation, and policy/event management rather than remote reboots. Option D (Provision user) belongs to identity/access management systems, not the Secure Endpoint API. Option E (Update firewall rule) is a network-security function handled by firewall management tools, not the endpoint API.

Answer

Reboot device

Answer

Provision user

Answer

Update firewall rule

Question 11

When managing Secure Endpoint through the API, which TWO pieces of information are used to track endpoint health?

Accepted Answer

Event logs. Event logs (A) are correct because the Secure Endpoint API exposes event streams (e.g., /v1/event or /v1/events endpoints) that report detections, quarantines, and other activity used to gauge an endpoint's security health. Connector status (D) is correct because the API's computer/endpoint resource reports the connector's state (e.g., connected, disconnected, or the connector version and last-seen time), which directly indicates whether the endpoint is protected and communicating. Network speed (B) is a performance metric unrelated to endpoint security health, BIOS version (C) is a hardware/firmware attribute not used for health tracking, and installed printer drivers (E) are peripheral software details with no bearing on Secure Endpoint health.

Answer

Network speed

Answer

BIOS version

Answer

Installed printer drivers

Question 12

Which TWO of the following are valid ways to obtain threat intelligence data within the Cisco SecureX ecosystem?

Accepted Answer

Querying the SecureX CTIA API. Option A is correct because the SecureX Cognitive Threat Intelligence API (CTIA) is a documented, supported interface that lets analysts programmatically query threat intelligence (for example, observables such as IPs, domains, and file hashes) and integrate those results into their own tools and workflows. Option E is correct because SecureX provides integrated threat intelligence modules and dashboard tiles that pull data from sources like Cisco Talos and other integrated feeds, allowing analysts to view and act on threat intelligence directly within the SecureX ribbon and dashboard without custom coding. Option B is not a valid SecureX method, since scraping the Dark Web with a local script is not a supported or sanctioned SecureX capability and raises legal and reliability concerns. Option C is not valid because manually downloading CSV files from random websites is neither a SecureX-integrated nor a trustworthy threat intelligence acquisition method. Option D is not valid because directly modifying the underlying Cisco Talos database is impossible for customers and would be an unauthorized change to a Cisco-managed backend system.

Answer

Using a local script to scrape the Dark Web

Answer

Manually downloading CSV files from random websites

Answer

Directly modifying the underlying Cisco Talos database

Question 13

Which TWO of the following are accurate regarding the structure and usage of YANG data models?

Accepted Answer

A 'leaf-list' is used to define an array of values of the same type.. Option D is correct because a leaf-list in YANG defines a collection of multiple leaf nodes that all share the same data type, effectively functioning as an array of values of that type. Option E is correct because within a YANG list node, the key statement names one or more leaf children that uniquely identify each list entry, which is required for configuration lists. Option A is wrong because uploading a YANG model does not automatically apply it; the model must be implemented or supported by the device's software and explicitly used. Option B is wrong because YANG is a modeling language that is independent of encoding; models are typically written in YANG syntax and can be encoded in XML or JSON for NETCONF and RESTCONF. Option C is wrong because YANG models are used by both NETCONF and RESTCONF, not exclusively by RESTCONF.

Answer

All YANG models are automatically applied to the device upon being uploaded.

Answer

YANG models must always be written in JSON format for the device to understand them.

Answer

YANG models are exclusively used for RESTCONF and cannot be used with NETCONF.

Question 14

Which THREE of the following are true regarding REST API design in Cisco security products?

Accepted Answer

Standard HTTP methods should be used for CRUD. Option A is correct because REST API design in Cisco security products follows the standard HTTP verb mapping for CRUD operations: GET to read, POST to create, PUT/PATCH to update, and DELETE to remove resources. Option D is correct because REST is resource-oriented, so each resource is addressed by a unique URL (for example, /api/fmc_config/v1/domain/{domainUUID}/object/networks/{objectId}), which clients use to identify and manipulate that resource. Option E is correct because REST APIs return meaningful HTTP status codes such as 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, and 404 Not Found to indicate whether a request succeeded or failed. Option B is not correct because REST APIs can support asynchronous operations, and Cisco security APIs commonly return task or job identifiers that clients poll for completion rather than requiring every request to be synchronous. Option C is not correct because Cisco security REST APIs typically support JSON, and many also support XML, so XML is not the only supported format.

Answer

All requests must be synchronous

Answer

XML is the only supported format

Question 15

Which TWO of the following are valid ways to test Cisco APIs before deployment? (Choose two)

Accepted Answer

Using a dedicated lab/sandbox environment. Option A is correct because a dedicated lab or sandbox environment provides an isolated, non-production space where Cisco API calls (for example against Cisco DNA Center or Meraki sandbox endpoints) can be exercised safely without impacting live infrastructure. Option B is correct because Postman and similar API client tools let you construct and send HTTP requests (GET, POST, PUT, DELETE) with headers, authentication tokens, and JSON bodies, then inspect status codes and responses to validate the API before deployment. Option C is wrong because running scripts directly in production risks service disruption and is not a valid pre-deployment test method. Option D is wrong because having a colleague rewrite the script does not test the API. Option E is wrong because guessing the API structure cannot validate endpoints, parameters, or authentication.

Answer

Running scripts directly in the production environment

Answer

Asking a colleague to rewrite the script

Answer

Guessing the API structure