SAUTO Practice Test 19 — 15 Questions

Question 1

You are automating the deletion of an old Umbrella API key. Why is it important to ensure that no active scripts are using this key before deletion?

Accepted Answer

The script will lose access immediately. Deleting an Umbrella API key immediately invalidates it, so any script still using that key will lose access and begin receiving authentication failures (401/403). Ensuring no active scripts depend on the key prevents automation outages, such as failed policy updates or broken reporting pipelines.

Answer

The Umbrella dashboard will crash

Answer

The firewall will block all future traffic

Answer

The API logs will become unreadable

Question 2

You are using the Cisco ASA REST API to retrieve the current status of an interface. Which HTTP method should be used to perform this read operation?

Accepted Answer

GET. The GET method is standard for retrieving resource state information from the REST API without modifying the configuration.

Answer

PATCH

Answer

PUT

Answer

POST

Question 3

A network engineer is using the Cisco Firepower Management Center (FMC) API to retrieve access control policy information. Which HTTP method should be used to perform a read-only request for a specific policy resource?

Accepted Answer

GET. The HTTP GET method is defined for safe, read-only retrieval of a resource and is the correct method to fetch access control policy information from the FMC API. GET requests do not modify server state and are idempotent, making them ideal for querying a specific policy resource by its identifier. The FMC REST API follows standard REST conventions, so GET is used for all read operations.

Answer

PATCH

Answer

POST

Answer

PUT

Question 4

You are writing a script to check for new security policy updates on a Cisco WSA. You notice that your script pulls the same configuration repeatedly. What should you use to check if the policy has changed?

Accepted Answer

ETag or Last-Modified header. HTTP conditional requests using the ETag or Last-Modified header allow a client to ask the server whether the resource has changed since the last retrieval. If the policy has not changed, the server returns HTTP 304 Not Modified with no body, saving bandwidth and processing. This is the standard, efficient way to poll for configuration changes without pulling the full payload every time.

Answer

The 'version' field in the config

Answer

The 'sleep' function

Answer

A full diff of the JSON payload

Question 5

When interacting with the Cisco WSA API, you want to retrieve the 'System Status'. What does the 'uptime' field in the JSON response represent?

Accepted Answer

Time elapsed since the last restart. In the Cisco WSA API, the 'uptime' field in the System Status response represents the amount of time that has elapsed since the last restart of the appliance or service. It is a common metric in system status APIs to indicate how long the system has been running continuously. Therefore, the correct answer is time elapsed since the last restart.

Answer

Time elapsed since the last log upload

Answer

Time elapsed since the last API call

Answer

Time elapsed since the last configuration change

Question 6

A network engineer is testing a Cisco ASA REST API call using Postman. The request returns a 401 Unauthorized status code. What is the most likely cause of this error?

Accepted Answer

The authentication token is missing or expired.. A 401 Unauthorized response from the Cisco ASA REST API indicates that the request lacks valid authentication credentials. The ASA REST API requires a valid authentication token, typically obtained by first calling the authentication endpoint with a username and password, and then including that token in the header of subsequent requests. If the token is missing, malformed, or expired, the ASA returns 401.

Answer

The requested resource does not exist on the ASA.

Answer

The JSON payload is malformed.

Answer

The ASA API service is disabled in the configuration.

Question 7

Which data format is primarily used by all Cisco Security APIs (Secure Endpoint, Umbrella, Threat Grid)?

Accepted Answer

JSON. All Cisco Security APIs (Secure Endpoint, Umbrella, Threat Grid) primarily use JSON (JavaScript Object Notation) as the data format for requests and responses. JSON is lightweight, easy to parse, and widely supported, making it the standard for these RESTful APIs.

Answer

Protobuf

Answer

XML

Answer

YAML

Question 8

When managing Cisco Umbrella policies, which TWO types of destination lists can you create via the API?

Accepted Answer

Block list. The Cisco Umbrella API supports creating destination lists of type 'block list' (option B) and 'allow list' (option C), which correspond to the two policy actions Umbrella enforces on destinations: blocking or allowing traffic. The block list is used to deny access to specified domains/URLs, while the allow list is used to explicitly permit destinations that might otherwise be blocked, and both are exposed via the Umbrella destination lists API endpoints (e.g., POST /policies/v2/destinationlists with a type of 'block' or 'allow'). The other options—guest list (A), warning list (D), and quarantine list (E)—are not destination list types available through the Umbrella API; Umbrella's destination list model is limited to block and allow types, so these do not apply.

Answer

Guest list

Answer

Warning list

Answer

Quarantine list

Question 9

When using the Cisco ISE ERS API, what is the impact of not specifying the 'Accept' header in your request?

Accepted Answer

The server may return an unintended data format.. If 'Accept' is not specified, the server might default to an unexpected content format, leading to parsing errors in the client application.

Answer

The request will always fail.

Answer

The connection will be encrypted with a weaker cipher.

Answer

The request will be treated as an unauthenticated request.

Question 10

You are using the Cisco Cloudlock API to retrieve a list of users. The API returns an 'error: 403 Forbidden'. What is the most likely cause?

Accepted Answer

The API token lacks the required permissions. A 403 Forbidden response from the Cisco Cloudlock API indicates that the request was authenticated but the token or credentials used do not have the necessary permissions/scope to access the requested resource (the user list). Unlike 401 Unauthorized, which signals missing or invalid authentication, 403 specifically means the server understood the request but refuses to authorize it. Therefore, the most likely cause is that the API token lacks the required permissions.

Answer

The URL is incorrect

Answer

The user list is empty

Answer

The API is down for maintenance

Question 11

Which Cisco security product uses the 'AsyncOS' platform, and for which automation tasks is its API most commonly used?

Accepted Answer

Cisco Secure Email and Web Appliances; configuration and monitoring. AsyncOS is the operating system used by Cisco Secure Email and Web Appliances (ESA and WSA). Their APIs are commonly used for configuration and monitoring tasks, such as managing policies, retrieving logs, and automating updates. This makes option D correct.

Answer

Cisco Cloudlock; SaaS file inspection

Answer

Cisco Umbrella; DNS filtering policies

Answer

Cisco Firepower; firewall rule orchestration

Question 12

Which THREE of the following are valid methods within a Python script to handle potential errors when making API calls to a Cisco platform?

Accepted Answer

Using a try-except block to catch 'requests.exceptions.RequestException'.. Option A is correct because wrapping API calls in a try-except block that catches 'requests.exceptions.RequestException' handles the base exception class for all requests-related errors, including ConnectionError, Timeout, and HTTPError, making it the standard Pythonic way to manage API call failures. Option B is correct because 'response.raise_for_status()' inspects the HTTP status code and raises an 'HTTPError' (a subclass of RequestException) whenever the server returns a 4xx client error or 5xx server error, allowing the script to detect and react to unsuccessful responses. Option E is correct because explicitly checking the 'status_code' attribute of the response object (e.g., comparing it to 200 or using it in conditional logic) lets the script branch on success or failure without relying on exceptions. Option C is not a valid error-handling method because a fixed 60-second sleep does not detect, catch, or respond to errors—it merely delays execution and cannot distinguish success from failure. Option D is not valid because suppressing all exceptions with a bare except or pass hides failures, prevents proper error handling, and can cause the script to loop indefinitely with corrupted state or silent data loss.

Answer

Hardcoding a 60-second sleep timer after every API call to ensure the server is ready.

Answer

Ignoring all exceptions to allow the script to continue running indefinitely.

Question 13

When working with Cisco security APIs, which authentication mechanism is most commonly required to maintain a session after the initial credentials have been exchanged?

Accepted Answer

Bearer Token. Cisco security APIs (such as Firepower, ISE, and Umbrella) typically authenticate initial credentials and then return a token that must be included as a Bearer token in subsequent requests to maintain the session. This token-based flow avoids resending credentials on every call and is the standard session mechanism. Bearer tokens are passed in the Authorization header and validated on each request.

Answer

SSH Public Key

Answer

IP Whitelisting

Answer

Basic Auth

Question 14

Which tool is best suited for testing Umbrella API queries before deploying them into your automated production script?

Accepted Answer

Postman. Postman is the best tool for testing Umbrella API queries before embedding them in production scripts because it provides a GUI to construct requests, manage authentication headers, inspect JSON responses, and save/organize collections. It allows rapid iteration on endpoints like /ips/ or /domains/ without writing code, making it ideal for validating API behavior before automation.

Answer

Cisco CLI

Answer

Wireshark

Answer

Telnet

Question 15

When managing Cisco devices via RESTCONF, what is the benefit of using the 'PATCH' method instead of 'PUT'?

Accepted Answer

PATCH performs partial updates to a resource.. In RESTCONF (RFC 8040), PATCH is used to perform a partial modification of a resource, allowing the client to send only the fields that need to change. PUT, by contrast, replaces the entire target resource with the representation in the request body, meaning any omitted fields are reset or removed. PATCH is therefore the correct choice when you want to update a subset of configuration without disturbing other existing settings.

Answer

PUT is deprecated in RESTCONF.

Answer

PATCH is only for JSON, not XML.

Answer

PATCH is faster.