SAUTO Practice Test 20 — 15 Questions

Question 1

Which TWO components are typically required to initiate a connection to the Cisco Umbrella API?

Accepted Answer

API Secret. The Cisco Umbrella API uses key-based authentication, so an API Key (option E) is required to identify the client making the request, and an API Secret (option C) is required to authenticate that client, typically via a token request to the Umbrella token endpoint. These two credentials are generated in the Umbrella dashboard under Admin > API Keys and are used together (for example, as the client_id and client_secret in an OAuth 2.0 token request) to obtain an access token for subsequent API calls. A Device Console Cable (option A) is a physical serial connection used for out-of-band management of appliances and has nothing to do with REST API authentication. An SSH Private Key (option B) is used for SSH-based device access, not for the Umbrella API, which authenticates over HTTPS. A Root user password (option D) is an OS-level credential and is not part of the Umbrella API authentication scheme.

Answer

Device Console Cable

Answer

SSH Private Key

Answer

Root user password

Question 2

You are writing a Python script to interact with the Cisco Secure Web Appliance (WSA) REST API to pull 'Access Logs'. When parsing the response, you notice the data is chunked. What is the most appropriate way to handle large log datasets when using the REST API?

Accepted Answer

Use the 'limit' and 'offset' query parameters to paginate through the log data. When dealing with large log datasets from the WSA REST API, the most appropriate approach is to use the 'limit' and 'offset' query parameters to paginate through the data. This allows you to retrieve manageable chunks, reducing memory usage and avoiding timeouts. The API supports pagination to efficiently handle large volumes of logs.

Answer

Increase the timeout on the HTTP request

Answer

Request the data in XML format instead of JSON

Answer

Switch to the SSH-based CLI API to download the logs

Question 3

Which TWO of the following are true regarding YANG models?

Accepted Answer

YANG supports hierarchical data modeling. Option A is correct because YANG (RFC 6020/7950) is a data modeling language that organizes configuration and state data into a tree-structured, hierarchical schema with containers, lists, and leaves. Option B is correct because YANG modules define the syntax and semantics of data manipulated by NETCONF (RFC 6241) and RESTCONF (RFC 8040), which use YANG-modeled datastores and payloads. Option C is incorrect because YANG is an open IETF standard, not a proprietary Cisco language. Option D is incorrect because YANG is vendor-neutral and used across many platforms and tools, not only Cisco IOS-XE. Option E is incorrect because YANG models are expressed in a human-readable text syntax (and can be represented in XML/JSON encodings), not exclusively binary formats.

Answer

YANG is a proprietary Cisco language

Answer

YANG is only used for Cisco IOS-XE

Answer

YANG uses binary data formats exclusively

Question 4

When using the Cisco IOS-XE RESTCONF API, which header is required to tell the server the format of the payload being sent?

Accepted Answer

Content-Type. In RESTCONF (and HTTP in general), the Content-Type header tells the server the media type of the request body being sent, such as application/yang-data+json or application/yang-data+xml. Without it, the server cannot correctly parse the payload, so it is the required header for declaring the format of data being transmitted to the device.

Answer

Cache-Control

Answer

Accept

Answer

Authorization

Question 5

You are automating the deployment of Cisco ASA firewall rules using the ASA REST API. You need to ensure that the API calls are secure and that changes are properly applied. Which two practices are essential for secure and successful automation? (Choose two.)

Accepted Answer

After making configuration changes via the API, commit them with a write memory command or equivalent.. Secure automation requires HTTPS with certificate validation to protect credentials and data. Additionally, changes made via the ASA REST API must be explicitly saved to the startup configuration to persist. These two practices ensure both security and successful application of changes.

Answer

Disable logging on the ASA to improve API performance.

Answer

Store API credentials in plaintext within the automation script for easy access.

Answer

Use the GET method to apply configuration changes to the ASA.

Question 6

You want to automate the download of 'Web Access Logs' from the WSA. You have authorized your session. What is the final step before the download begins?

Accepted Answer

Execute a GET request to the specific log file endpoint. After authorizing the session (obtaining a valid auth token), the final step to download Web Access Logs from the WSA is to issue a GET request to the specific log file endpoint. The WSA log retrieval API uses a two-phase pattern: first authenticate/authorize, then GET the named log file resource. The GET returns the log data (or a redirect to the file), which the script then saves.

Answer

Execute a POST request to the file

Answer

Issue a CLI 'reboot' command

Answer

Run a configuration commit

Question 7

Which THREE of the following are true about Postman environments?

Accepted Answer

Environments help organize your API collection variables. Option B is correct because Postman environments are variable scopes that let you organize and manage variables (such as base URLs, IDs, and credentials) separately from the collection itself, keeping collections portable. Option D is correct because environments support dynamic and variable-driven values, including tokens and secrets, which can be referenced via {{variable}} syntax and updated at runtime (e.g., through scripts or the token helper), enabling dynamic authentication flows. Option E is correct because a key purpose of environments is to define different value sets for the same variable names, so you can switch between environments (e.g., dev, staging, production) to point requests at different servers without editing the collection. Option A is not correct because Postman does not store sensitive API keys with 'no security'; environment values can be marked as secret and are encrypted/synced securely, and sensitive data handling is a security concern rather than a feature. Option C is not correct because environments are not shared with all Postman users by default; they are private to the user or team unless explicitly shared within a workspace or team.

Answer

Environments allow you to store sensitive API keys in the cloud with no security

Answer

Environments are shared across all Postman users by default

Question 8

What is the primary benefit of using a REST API over manual CLI configuration for security policy deployment?

Accepted Answer

It ensures consistent, repeatable policy enforcement across the fleet.. REST APIs enable programmatic, idempotent, and version-controlled policy deployment, so the same policy can be applied consistently across hundreds of devices without human error. This consistency and repeatability across the fleet is the primary benefit over manual CLI configuration, which is error-prone and slow at scale. Automation also supports audit trails and rollback.

Answer

It removes the need for firewalls.

Answer

It automatically encrypts all traffic.

Answer

It provides faster CLI access to the device.

Question 9

Which TWO of the following are true about Cisco Firepower API? (Choose two)

Accepted Answer

It provides access to policy management. Option B is correct because the Cisco Firepower Management Center (FMC) REST API exposes policy management endpoints, allowing administrators to programmatically create, read, update, and deploy access control, intrusion, and other policies via HTTPS requests to /api/fmc_config/v1/domain/{domainUUID}/policy/... . Option E is correct because the same REST API provides object management endpoints (e.g., /object/hosts, /object/networks, /object/ports) that let scripts and automation tools create, modify, and delete reusable network and port objects without manual GUI work. Option A is incorrect because the Firepower API is a RESTful/HTTP-based interface, not a C++ library or application. Option C is incorrect because the API requires authentication, typically via token-based access using /api/fmc_platform/v1/auth/generatetoken with valid credentials, and subsequent requests must include the auth token header. Option D is incorrect because the API is accessed over HTTPS/REST rather than being limited to the CLI, and it is in fact designed for programmatic and GUI-independent access.

Answer

It is written in C++

Answer

It has no authentication requirements

Answer

It is only available via the CLI

Question 10

Which THREE of the following are parameters that can be used to filter Cisco Secure Email Gateway reports via the Reporting API?

Accepted Answer

recipient. The Cisco Secure Email Gateway Reporting API accepts query parameters that scope report data by message attributes and time window, so option A (recipient) is correct because it filters report results to messages delivered to a specific recipient address. Option B (end_date) is correct because it defines the upper bound of the reporting time range, limiting results to events occurring on or before that date. Option E (start_date) is correct because it sets the lower bound of the reporting time range, so only events on or after that date are returned. Options C (fan_speed) and D (hardware_version) are not Reporting API filter parameters; they relate to physical appliance telemetry and system inventory data, not email message reporting queries.

Answer

fan_speed

Answer

hardware_version

Question 11

Your team automates Cisco Secure Email Gateway quarantine actions. A script must release a message from quarantine and simultaneously add the sender to a safelist so future messages bypass quarantine. Which combination of API actions accomplishes this?

Accepted Answer

Use the AsyncOS API to release the quarantined message, and add the sender to a safelist using the same API's sender group or content filter configuration endpoint.. Achieving both outcomes requires two distinct operations: releasing the specific quarantined message and modifying configuration to trust the sender. The Secure Email Gateway AsyncOS API supports quarantine actions and configuration updates, so it is the correct platform. Relying on release alone leaves the sender untrusted, and other Cisco security APIs do not manage email quarantine.

Answer

Use the Umbrella Enforcement API to release the message and add the sender to a block list so it is trusted.

Answer

Use the Secure Email Gateway AsyncOS API to release the message, and rely on the release action to automatically safelist the sender.

Answer

Use the Cisco Cloudlock API to release the quarantined message and update the sender reputation score.

Question 12

When using the 'requests' library to call an API with a self-signed certificate, which parameter can be used to disable verification for testing?

Accepted Answer

verify=False. The 'verify=False' parameter in the requests library instructs the client to ignore SSL certificate validation errors.

Answer

cert=False

Answer

ssl=False

Answer

auth=False

Question 13

An automation engineer is using Cisco SecureX Orchestration to build a workflow that automatically creates a ticket in a ticketing system when a high-severity alert is detected by Cisco Secure Endpoint. The engineer needs to pass the alert details, such as the endpoint hostname and the detection name, to the ticketing system. Which SecureX Orchestration feature should be used to extract these specific values from the alert payload?

Accepted Answer

Use a 'Parse JSON' activity to parse the alert payload and then reference the desired fields using JSONPath expressions.. SecureX Orchestration includes a 'Parse JSON' activity that uses JSONPath to extract values from JSON payloads. This is the correct approach to obtain specific fields like hostname and detection name from a Secure Endpoint alert, enabling the workflow to pass them to the ticketing system.

Answer

Use a 'Regex' activity to extract the hostname and detection name from the raw alert string.

Answer

Use the 'Run Python Script' activity to write a custom script that extracts the fields from the alert.

Answer

Use a 'Condition' activity to check if the alert contains the required fields and then reference them directly from the alert object.

Question 14

A security engineer is automating Cisco Firepower Management Center (FMC) using its REST API. The script must create a new access control policy and then deploy it to managed devices. After creating the policy, the engineer attempts to deploy it but receives an HTTP 400 error stating 'Deployment failed: policy not associated with any device.' What is the most likely cause?

Accepted Answer

The access control policy must be assigned to at least one managed device before deployment.. The error 'policy not associated with any device' clearly indicates that the access control policy has not been assigned to any managed devices in FMC. Before deployment, policies must be associated with devices. This is a required step in the FMC workflow, and automating policy creation must include updating device assignments to avoid this error.

Answer

The deployment request must include a valid 'version' parameter that matches the policy's current version.

Answer

The API user account lacks the 'Deploy' permission for the FMC domain.

Answer

The access control policy must be in 'Intrusion Prevention' mode before deployment.

Question 15

You are writing a Python script that authenticates to the Cisco Umbrella API using OAuth 2.0 client credentials and then calls multiple endpoints. Which two statements about this authentication flow are correct? (Choose two.)

Accepted Answer

The access token must be included in the Authorization header as Bearer <token> for subsequent API calls.. Umbrella's client credentials flow obtains a token by POSTing to the token endpoint with HTTP Basic authentication carrying the Base64-encoded client_id and client_secret, plus grant_type=client_credentials. The returned access token is then sent as a Bearer credential on every protected request until it expires and must be refreshed.

Answer

The client_secret must be embedded directly in each API request body so the server can validate the caller on every call.

Answer

The token endpoint requires an API key and secret key as query string parameters in the URL.

Answer

Access tokens are valid indefinitely, so the script only needs to authenticate once during its lifetime.