SAUTO Practice Exam 3 — 20 Questions

Question 1

Which THREE of the following are common JSON data types?

Accepted Answer

number. JSON (JavaScript Object Notation, defined by RFC 8259) supports a fixed set of value types, and option A (number) is one of them: JSON numbers are written as decimal literals such as 42, -3.14, or 1.5e10, with no distinction between integers and floats. Option B (string) is correct because JSON strings are sequences of Unicode characters enclosed in double quotes, using backslash escapes like 
 and \uXXXX. Option D (boolean) is correct because JSON defines the literal values true and false as a native boolean type. The unmarked options do not belong: option C (class) is an object-oriented construct, not a JSON type — JSON only has objects (unordered key/value collections), not classes — and option E (pointer) is a memory-address concept from languages like C/C++, with no representation in the JSON specification.

Answer

class

Answer

pointer

Question 2

Your team runs a Cisco Secure Email Gateway (AsyncOS) and wants to automate message tracking lookups for incident response. A script authenticates with a valid session and queries /esa/api/v2.0/message-tracking/messages. The API returns HTTP 404 for every query even though messages exist. Which configuration issue is the most likely cause?

Accepted Answer

The ESA API feature is disabled or the wrong API version is enabled in the gateway configuration.. HTTP 404 from an AsyncOS API endpoint usually means the requested path is not exposed. The API feature must be enabled on the gateway, and the endpoint version in the URL must match the enabled version. Authentication failures produce 401, and empty data produces 200 with an empty result, so those do not fit the symptom.

Answer

The OAuth 2.0 token has expired and must be refreshed before retrying.

Answer

The message tracking database has been purged and no messages remain to query.

Answer

The API account lacks the Administrator or Operator role required for message tracking.

Question 3

When using the Cisco Umbrella Reporting API, which format is the default output for retrieving threat activity logs to ensure compatibility with most data analysis tools?

Accepted Answer

JSON. The Cisco Umbrella Reporting API returns JSON by default, which is the native format for most modern data analysis tools, SIEMs, and scripting languages. JSON's structure maps cleanly to Python dictionaries and JavaScript objects, making it the standard interchange format for API-driven log retrieval. XML, CSV, and binary are not the default output for Umbrella Reporting API responses.

Answer

XML

Answer

Binary

Answer

CSV

Question 4

Which THREE of the following are best practices for managing API keys? (Choose three)

Accepted Answer

Rotate keys regularly. Option A (Rotate keys regularly) is correct because periodic rotation limits the window of exposure if a key is leaked or compromised, and it supports compliance requirements such as those in PCI DSS and NIST guidelines. Option B (Use least privilege access for keys) is correct because scoping each key to only the permissions and resources it needs reduces the blast radius of a compromised key, following the principle of least privilege. Option C (Never hardcode keys in scripts) is correct because hardcoded keys end up in source control, logs, and build artifacts, where they are easily exposed; instead, keys should be stored in a secrets manager or injected via environment variables at runtime. Option D is wrong because reusing one key across every project violates least privilege and isolation, so a single leak compromises all projects and makes auditing impossible. Option E is wrong because email is unencrypted in transit and at rest on many servers, so sharing keys that way exposes them to interception and unauthorized access; keys should be distributed through a secure secrets management system.

Answer

Use the same key for every project

Answer

Share keys via email with the team

Question 5

You are configuring a CI/CD pipeline to deploy Cisco ASA firewall rules. Which step is essential to ensure the changes are correct before applying them to production?

Accepted Answer

Deploy to a sandbox or staging environment for validation.. Validating changes in a staging or pre-production environment is critical to ensure logic and syntax correctness.

Answer

Rely on automated rollback without testing.

Answer

Directly apply to production to save time.

Answer

Only test the API connectivity.

Question 6

Which TWO of the following are true regarding the use of the Python 'requests' library?

Accepted Answer

It can automatically serialize dictionaries to JSON via the json parameter.. Option B is correct because requests accepts a json= keyword argument on methods such as post(), put(), and patch(), which serializes a Python dictionary to a JSON body and automatically sets the Content-Type header to application/json. Option C is correct because the library's core purpose is to provide a high-level, human-friendly API for HTTP, exposing convenience methods like requests.get(), requests.post(), requests.put(), and requests.delete() that wrap urllib3 under the hood. Option A is not correct because requests is built on urllib3 and supports connection pooling and keep-alive, and while the base API is synchronous, it is not limited to a single execution model in the sense implied. Option D is not correct because requests manages connection pooling automatically via HTTPAdapter and urllib3's PoolManager, so manual pool management is not required. Option E is not correct because requests supports Python 3.x (and historically 2.7), not exclusively Python 2.7.

Answer

It only supports the synchronous execution model.

Answer

It requires manual management of connection pools.

Answer

It is only compatible with Python 2.7.

Question 7

Which Cisco security product uses the pxGrid framework to share contextual information with other network devices?

Accepted Answer

Cisco ISE. Cisco ISE (Identity Services Engine) is the primary platform that utilizes pxGrid to share identity and policy context across the network ecosystem.

Answer

Cisco Firepower

Answer

Cisco ASA

Answer

Cisco Umbrella

Question 8

When writing a Python request to the SecureX API, which Content-Type header is required for POST requests?

Accepted Answer

application/json. For POST requests to the SecureX API, the required Content-Type header is application/json. The SecureX API expects JSON-formatted request bodies, so the Content-Type must be set accordingly to ensure the server parses the payload correctly.

Answer

application/xml

Answer

application/x-www-form-urlencoded

Answer

text/plain

Question 9

An engineer is using NETCONF to retrieve configuration data from a Cisco IOS XE device. The engineer wants to filter the response to only include interface configuration for GigabitEthernet1. Which YANG filter correctly achieves this using the subtree filter?

Accepted Answer

GigabitEthernet1. The correct subtree filter includes the proper namespace for the ietf-interfaces module and follows the hierarchy: interfaces > interface > name. This ensures the NETCONF server correctly interprets the filter and returns only the configuration for GigabitEthernet1. Omitting the namespace or parent container leads to invalid filters and incorrect results.

Answer

GigabitEthernet1

Answer

GigabitEthernet1

Answer

Question 10

You are utilizing the Cisco ISE ERS API to provision a guest account. If the API returns a '409 Conflict', what is the most likely cause?

Accepted Answer

The account already exists.. In the Cisco ISE External RESTful Services (ERS) API, HTTP 409 Conflict indicates a resource conflict — most commonly that the object you are trying to create (e.g., a guest account with a given username) already exists in ISE. The correct handling is to detect the existing object, update it via PUT, or choose a unique identifier. This is standard REST semantics and ISE follows it for duplicate guest, endpoint, and identity-group creations.

Answer

The credentials provided are invalid.

Answer

The request body is malformed.

Answer

The API rate limit has been exceeded.

Question 11

A network security engineer is writing a Python script to interact with the Cisco Identity Services Engine (ISE) External RESTful Services (ERS) API. The script must create a new endpoint and then retrieve its details. Which HTTP status code should the script expect upon successful creation of the endpoint?

Accepted Answer

201 Created. The ISE ERS API follows REST conventions and returns HTTP 201 Created when a new resource is successfully created via a POST request. This status confirms the creation and often includes a Location header pointing to the new resource. A 200 OK is used for successful GET or PUT, but not for creation.

Answer

302 Found

Answer

200 OK

Answer

204 No Content

Question 12

You are developing a Python script to automate Cisco Umbrella enforcement of security policies. The script must retrieve the list of identities and then apply a block action to a specific domain. Which API endpoint and method should you use to apply the block action?

Accepted Answer

POST to /policies/{policyId}/blocklist with a JSON body containing the domain to block.. To block a domain in Cisco Umbrella, you add it to a policy's block list. The API endpoint /policies/{policyId}/blocklist supports POST to add a domain. This is the correct method to apply a block action programmatically. Using POST ensures the domain is appended to the existing block list.

Answer

POST to /policies/{policyId}/block with a JSON body containing the domain.

Answer

GET to /policies/{policyId}/blocklist?domain=example.com to add the domain to the block list.

Answer

PUT to /policies/{policyId}/blocklist with a JSON body containing the domain to block.

Question 13

You are writing a script to update Cisco Secure Email (ESA) configuration. You need to push a new 'Content Filter' rule. Why is it recommended to perform a 'Get' request before the 'Put' request?

Accepted Answer

To preserve existing configuration attributes not being modified. Performing a 'Get' request before a 'Put' request is recommended to preserve existing configuration attributes that are not being modified. The 'Put' request typically replaces the entire resource, so if you omit fields, they may be reset to defaults. By retrieving the current configuration first, you can modify only the desired fields and send back the complete object.

Answer

To lock the configuration database

Answer

To verify the user has write permissions

Answer

To check if the API is responsive

Question 14

A security automation engineer is designing a Python script that interacts with multiple Cisco security appliances' REST APIs. The script must handle HTTP errors gracefully and implement retry logic for transient failures. Which two practices should be followed to ensure robust error handling? (Choose two.)

Accepted Answer

Use the raise_for_status() method on the response object to automatically raise an exception for HTTP error codes.. Using raise_for_status() and catching RequestException are two best practices for robust error handling with the requests library. raise_for_status() triggers exceptions on HTTP errors, and catching RequestException handles all request-related exceptions. These practices ensure that errors are detected and managed, allowing for retries or graceful degradation.

Answer

Use the Response.status_code attribute to manually check for specific error codes and implement custom retry logic.

Answer

Ignore HTTP 500 errors because they are server-side issues and will resolve on their own.

Answer

Set a very high timeout value to avoid timeouts and ensure requests always complete.

Question 15

Which programming language is most commonly used for Cisco Security automation tasks?

Accepted Answer

Python. Python is the industry standard for network and security automation due to its extensive library support and readability.

Answer

Java

Answer

C++

Answer

PHP

Question 16

You are writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of all endpoints in your organization. After authenticating with OAuth 2.0, you need to handle pagination because the API returns a limited number of results per page. Which HTTP response header should your script inspect to obtain the URL for the next page of results?

Accepted Answer

Link. The Cisco Secure Endpoint API implements pagination using the Link header, which contains URLs for the next, previous, first, and last pages. By parsing this header, your script can reliably navigate through large result sets. This approach is consistent with RESTful best practices and ensures that automated workflows, such as endpoint inventory or threat hunting, retrieve complete data without manual intervention.

Answer

Location

Answer

X-Next-Page

Answer

X-Total-Count

Question 17

You are automating the deployment of Cisco Umbrella Roaming Client to a large number of remote Windows endpoints using a configuration management tool. To ensure the client registers correctly and enforces policies, you need to provide the necessary parameters during silent installation. Which two parameters are required for a successful silent installation of the Cisco Umbrella Roaming Client? (Choose two.)

Accepted Answer

Organization ID. For a successful silent installation of the Cisco Umbrella Roaming Client, you must provide the Organization ID and the registration token. These parameters allow the client to authenticate and register with your Umbrella organization, enabling policy enforcement. Other settings, such as proxy configuration or user email, are optional and can be managed post-installation or via other means.

Answer

Proxy Server Address

Answer

User Email Address

Answer

DNS Server IP

Question 18

A security automation engineer is writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of computers. The script must handle pagination because the environment has thousands of endpoints. Which HTTP response header should the script inspect to determine the URL for the next page of results?

Accepted Answer

Link. The Cisco Secure Endpoint API implements pagination using the Link header as defined in RFC 5988. When a response contains more results, the Link header includes a URL with rel="next". The automation script must parse this header and follow the URL to retrieve subsequent pages. This ensures complete data retrieval across large environments without missing endpoints.

Answer

X-Next-Page

Answer

Location

Answer

Retry-After

Question 19

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

Accepted Answer

X-RateLimit-Remaining. SecureX (and most REST APIs following the IETF draft rate-limit header convention) returns the X-RateLimit-Remaining header to indicate how many requests the client can still make in the current window before being throttled. This header is paired with X-RateLimit-Limit (total allowed) and X-RateLimit-Reset (epoch time when the window resets), allowing scripts to pace API calls proactively.

Answer

Retry-After

Answer

X-Request-Limit

Answer

Status-Remaining

Question 20

An engineer is automating a Cisco Identity Services Engine (ISE) deployment using the ERS API. The API requires a secure transport and the engineer wants to verify the server's certificate against a corporate CA bundle in a Python script. The script uses the requests library. Which code snippet correctly performs the GET request to retrieve all network devices while ensuring certificate validation?

Accepted Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), verify='/path/to/ca_bundle.pem'). The correct approach is to pass the path to the corporate CA bundle via the verify parameter. This ensures the requests library validates the ISE server's certificate against the trusted corporate root, preventing man-in-the-middle attacks. Using verify=False disables validation, while cert is for client certificates, and verify=True uses the default bundle, which may not include the corporate CA.

Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), verify=False)

Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), verify=True)

Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), cert='/path/to/ca_bundle.pem')