SAUTO Practice Test 18 — 15 Questions

Question 1

When using the Umbrella Investigate API, what does the 'co-occurrences' result represent?

Accepted Answer

Domains accessed in the same timeframe. In the Umbrella Investigate API, 'co-occurrences' returns a list of domains that were queried by the same client(s) within a similar time window as the domain being investigated. This helps analysts pivot from a suspicious domain to related infrastructure, revealing clusters of domains that may belong to the same campaign or threat actor.

Answer

The block rate of a policy

Answer

Malware infection rate

Answer

The number of users on a network

Question 2

Which statement best describes JSON?

Accepted Answer

It is a lightweight, language-independent data format.. JSON (JavaScript Object Notation) is a lightweight, text-based, language-independent data interchange format. Despite its name, it is not tied to JavaScript and is widely used across languages including Python, Java, and Go.

Answer

It is specific to JavaScript and cannot be used in Python.

Answer

It is a binary format for faster processing.

Answer

It is a schema language for XML.

Question 3

Which THREE of the following are common benefits of using REST APIs for network automation?

Accepted Answer

Reduced configuration errors. Option B (Reduced configuration errors) is correct because REST APIs let automation push structured, validated, programmatic changes (typically JSON over HTTPS) instead of error-prone manual CLI typing, eliminating typos and inconsistent commands. Option C (Increased operational efficiency) is correct because REST APIs enable repeatable, scripted workflows that apply changes across many devices in seconds, replacing slow manual per-device configuration. Option D (Scalability for large deployments) is correct because REST APIs are stateless, HTTP-based, and easily parallelized, so tools like Ansible, Python requests, or CI/CD pipelines can manage hundreds or thousands of devices consistently. Option A (Automatic optimization of routing tables) is not a benefit of REST APIs themselves; routing optimization is performed by routing protocols such as OSPF, EIGRP, or BGP, not by the API transport. Option E (Replacement of all network hardware) is incorrect because REST APIs are a software interface for managing existing devices and cannot substitute for physical or virtual network hardware.

Answer

Automatic optimization of routing tables

Answer

Replacement of all network hardware

Question 4

Which TWO of the following are valid methods for interacting with Cisco ISE programmatically?

Accepted Answer

pxGrid API. Cisco ISE provides the ERS (RESTful) API for configuration and the pxGrid API for context sharing.

Answer

Syslog streaming

Answer

CLI SSH Netmiko

Answer

SNMP Traps

Question 5

You are writing a Python script to retrieve a list of network objects from a Cisco Firepower Management Center (FMC) using its REST API. The script authenticates with a username and password and must maintain the session for subsequent requests. Which authentication mechanism should the script use to obtain a token that is valid for the duration of the session?

Accepted Answer

Send a POST request to /api/fmc_platform/v1/auth/generatetoken with the username and password, then use the returned X-auth-access-token header for subsequent requests.. The FMC REST API uses token-based authentication. A POST to the generatetoken endpoint with credentials returns an access token that must be included in the X-auth-access-token header for subsequent requests. This token remains valid for a limited time and can be refreshed. Basic Auth, OAuth, and API keys are not supported for FMC authentication.

Answer

Use OAuth 2.0 with a client ID and client secret to obtain a bearer token from the FMC authorization server.

Answer

Configure an API key in the FMC GUI and include it as a query parameter in each request.

Answer

Use HTTP Basic Authentication with the username and password in the Authorization header for each request.

Question 6

You are using the Cisco Umbrella API. Which TWO of the following are valid ways to manage domain blocking?

Accepted Answer

POST /destinationlists/{id}/destinations. Option A is correct because the Cisco Umbrella Investigate/Enforcement API exposes destination lists, and POST /destinationlists/{id}/destinations is the documented endpoint for adding one or more domains (destinations) to an existing destination list, which is how you build or extend a block list. Option E is correct because DELETE /destinationlists/{id}/destinations is the corresponding endpoint for removing domains from a destination list, allowing you to stop blocking specific domains. Both operate on the destinationlists resource, which is the API construct Umbrella uses to manage allowed/blocked domains. The unmarked options do not belong: PATCH /destinations/all is not a valid Umbrella API route, PUT /dns/settings is not an endpoint for domain blocking, and GET /policies/block is not a documented Umbrella API path for managing blocked domains.

Answer

PATCH /destinations/all

Answer

PUT /dns/settings

Answer

GET /policies/block

Question 7

You are automating Cisco Firepower Management Center (FMC) object creation using the REST API. You successfully POST a new network object, but the changes do not appear on the managed Firepower Threat Defense (FTD) device. What is the mandatory final step to ensure the changes take effect?

Accepted Answer

Call the /deploy endpoint using the deployment target devices list.. After creating or modifying objects via the FMC REST API, the changes exist only in the FMC configuration database and are not pushed to managed FTD devices until a deployment is triggered. The mandatory final step is to call the /deploy endpoint with the deployment target devices list, which pushes the pending configuration to the specified FTD devices. Without this deployment call, the new network object will not take effect on the FTD.

Answer

The FMC automatically pushes objects immediately after the POST request returns 201.

Answer

Send a commit command to the FTD device directly via SSH.

Answer

Restart the snort process via the API.

Question 8

What is the primary function of the Cisco SecureX 'Inspect' feature when using the browser extension?

Accepted Answer

To extract and lookup observables from web pages. The Cisco SecureX 'Inspect' feature in the browser extension extracts observables — such as IP addresses, domains, URLs, file hashes, and email addresses — from the current web page and performs threat intelligence lookups against integrated sources. This allows analysts to quickly pivot from a suspicious webpage or report to enrichment data without manual copying.

Answer

To scan local hard drives for malware

Answer

To configure sandbox policies

Answer

To debug API responses

Question 9

Which THREE of the following are examples of SaaS security posture automation tasks you can perform with the Cloudlock API?

Accepted Answer

Revoking third-party OAuth tokens. Option A is correct because the Cloudlock (Cisco Cloudlock) API exposes endpoints for investigating and revoking risky third-party OAuth applications and their tokens granted by SaaS users, which is a core SaaS security posture automation task. Option B is correct because Cloudlock's CASB capabilities include scanning SaaS collaboration platforms (e.g., Google Workspace, Microsoft 365) to audit file sharing permissions and exposure, and these findings are retrievable and actionable via the API. Option E is correct because the Cloudlock API allows programmatic creation and management of policy and threat detection triggers that alert on or remediate risky SaaS activity. Option C is not correct because updating system firmware is an endpoint/hardware management task, not something a SaaS CASB API performs. Option D is not correct because configuring SMTP routing is a mail-transport/infrastructure configuration task outside Cloudlock's SaaS security posture scope.

Answer

Updating system firmware

Answer

Configuring SMTP routing

Question 10

You are troubleshooting a Python script that uses the 'requests' library. The script fails with a 'SSLError'. What is the most likely cause?

Accepted Answer

The server certificate is self-signed or invalid.. An SSLError occurs when the client cannot verify the SSL certificate presented by the server.

Answer

The API endpoint is down.

Answer

The authentication token is invalid.

Answer

The JSON payload contains invalid characters.

Question 11

Which THREE types of observables can be looked up using the Cisco SecureX Threat Intelligence API?

Accepted Answer

SHA-256 hash. The Cisco SecureX Threat Intelligence API supports querying several observable types for enrichment, and among the listed options the correct ones are SHA-256 hash (B), domain (D), and IP address (E). SHA-256 hashes are file-based observables commonly submitted to threat intelligence services to check reputation and malware associations, which is a core capability of the Threat Intelligence API. Domains are network observables used to identify malicious infrastructure, and the API accepts them for reputation and related-indicator lookups. IP addresses are likewise standard network observables that the API enriches with reputation, geolocation, and associated threat data. MAC addresses (A) and user email addresses (C) are not supported observable types for this API's threat intelligence lookups, so they are not valid answers.

Answer

MAC address

Answer

User email

Question 12

You are configuring an Ansible playbook to manage Cisco Firepower policies. Which module is specifically designed to interact with FMC objects?

Accepted Answer

cisco.fmcansible.fmc_configuration. The cisco.fmcansible.fmc_configuration module is part of the Cisco FMC Ansible collection and is specifically designed to manage Firepower Management Center (FMC) objects, policies, and device configurations via the FMC REST API. It allows playbooks to create, update, and delete FMC objects such as network objects, access control policies, and port objects.

Answer

cisco.ise.ise_policy

Answer

cisco.asa.asa_config

Answer

cisco.ios.ios_config

Question 13

When integrating Cisco Umbrella with a SOAR platform, what is the best practice for handling API rate limits?

Accepted Answer

Implement exponential backoff. Exponential backoff is the standard best practice for handling API rate limits because it dynamically adjusts the request rate in response to 429 (Too Many Requests) responses. When a rate limit is hit, the client waits for an increasing amount of time before retrying, which prevents overwhelming the API and allows the limit to reset. This approach is recommended by Cisco Umbrella's API documentation and is a fundamental principle in resilient API integration, ensuring reliable data exchange without causing service disruptions.

Answer

Use a single API key for all threads

Answer

Send all requests simultaneously

Answer

Ignore the 429 status code

Question 14

Which component of Cisco SecureX allows users to create automation workflows without writing code?

Accepted Answer

The Workflow Designer. The Workflow Designer in Cisco SecureX is a graphical, drag-and-drop interface that lets users build automation workflows by connecting pre-built actions and triggers visually, with no coding required. It is the primary no-code automation component of the SecureX platform, enabling security teams to orchestrate responses across integrated products.

Answer

The API explorer

Answer

The Threat Intelligence Tool

Answer

The Script Editor

Question 15

Which THREE of the following are key considerations when designing an automated security script? (Choose three)

Accepted Answer

Robust error handling and logging. Option A is correct because automated security scripts must include robust error handling and logging so failures are detected, exceptions are caught gracefully, and an audit trail exists for troubleshooting and compliance. Option B is correct because scripts often need privileged credentials, and storing them in a dedicated secrets manager such as HashiCorp Vault (rather than hard-coding them) prevents credential leakage and supports rotation and least-privilege access. Option C is correct because automation must handle growing workloads and remain observable, so scalability and performance monitoring ensure the script does not become a bottleneck or silently degrade. Option D is not appropriate because default vendor passwords are well-known and easily exploited, violating basic security hardening. Option E is not appropriate because requiring manual intervention at every step defeats the purpose of automation, reducing speed, consistency, and reliability.

Answer

Using default vendor passwords

Answer

Manual intervention for every step