SAUTO Practice Exam 4 — 20 Questions

Question 1

A network automation engineer is writing a Python script to interact with a Cisco Firepower Management Center (FMC) REST API. The script must authenticate and obtain a token for subsequent requests. Which HTTP header is used to pass the authentication token in subsequent API calls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

X-auth-access-token. The Cisco FMC REST API requires the authentication token to be included in the X-auth-access-token header for all subsequent requests after initial authentication. This is a custom header specific to FMC, not the standard Authorization header or other token headers used by different APIs. Using the correct header ensures successful API calls.

Answer

Cookie: token=...

Answer

Authorization: Bearer

Answer

X-Auth-Token

Question 2

When using the FMC API, what is the purpose of the 'X-Auth-Access-Token' header?

Accepted Answer

To carry the session token for authentication.. The FMC REST API uses a token-based authentication model: after POSTing credentials to /api/fmc_platform/v1/auth/generatetoken, the response includes X-auth-access-token (and a refresh token). Every subsequent API call must include that token in the X-Auth-Access-Token header so FMC can associate the request with the authenticated session. It is purely an authentication artifact, not a routing or versioning parameter.

Answer

To specify the target device IP address.

Answer

To define the API version.

Answer

To enable debugging mode.

Question 3

When automating Cisco Security solutions, what is the primary benefit of using a 'Service Account' instead of a personal user account for API authentication?

Accepted Answer

Decoupling script execution from individual employee identity.. Service accounts provide non-expiring credentials that are not tied to an individual's lifecycle, ensuring script continuity.

Answer

Improved performance of API calls.

Answer

Automatic elevation of privilege.

Answer

Ability to bypass firewall rules.

Question 4

A network security engineer is automating the deployment of Cisco Umbrella policies using the Umbrella API. The engineer needs to create a new destination list that blocks access to known malicious domains. Which HTTP method and endpoint should be used to create this list?

Accepted Answer

POST to /v1/destinationlists. To create a new destination list in Cisco Umbrella via the API, a POST request to /v1/destinationlists is required. The request body includes the list name and destinations. This is the standard RESTful approach for creating a resource in a collection.

Answer

GET to /v1/destinationlists

Answer

PUT to /v1/destinationlists/{id}

Answer

PATCH to /v1/destinationlists/{id}

Question 5

You are writing a script to monitor 'Cloudlock' alerts. Which API endpoint provides the most relevant data for SOC integration?

Accepted Answer

Incidents endpoint. The Incidents endpoint is the correct choice because Cloudlock incidents represent actual policy violations and security events, which is exactly the data a SOC needs for triage and response. Alerts generated by Cloudlock policies surface as incidents, making this endpoint the primary integration point for SIEM/SOAR platforms.

Answer

Policies endpoint

Answer

Users endpoint

Answer

App Firewall endpoint

Question 6

In the context of the Cisco Cloudlock API, what is the significance of the 'app_id' field?

Accepted Answer

It is the unique identifier for an OAuth application. In the Cisco Cloudlock API, the 'app_id' field is the unique identifier for an OAuth application. Cloudlock monitors and secures cloud applications, and each OAuth application (e.g., a third-party app accessing Google Workspace or Microsoft 365) is assigned a distinct 'app_id'. This allows the API to reference and manage specific applications for policy enforcement, risk assessment, and reporting.

Answer

It is the serial number of the appliance

Answer

It is the identifier for the Cloudlock tenant

Answer

It represents the user's role

Question 7

You are managing Cisco Cloudlock settings via the API. You need to ensure that specific SaaS file-sharing events are flagged. Which API object must you target to define a new policy violation trigger?

Accepted Answer

Policies API. The Cisco Cloudlock Policies API is the object used to create, retrieve, update, and delete policy definitions and their violation triggers. Policy violations in Cloudlock are defined as policy objects with matching criteria (e.g., file-sharing events, DLP patterns, user activity), so a new violation trigger must be created through the Policies API endpoint. The other APIs manage configuration, audit retrieval, application inventory, or user data — none of them define violation logic.

Answer

Configuration API

Answer

Audit API

Answer

Applications API

Answer

Users API

Question 8

You are configuring an Umbrella API callback. What happens if the callback URL is unreachable?

Accepted Answer

The notification is dropped. When an Umbrella API callback URL is unreachable, the notification is simply dropped. Umbrella does not retry indefinitely, revert policies, shut down the API service, or fall back to email. The callback mechanism is fire-and-forget; if the endpoint cannot be reached, the event notification is lost.

Answer

The policy is reverted

Answer

The API service shuts down

Answer

The alert is sent via email

Question 9

When using the 'ncclient' library in Python, what is the primary purpose of the 'manager.connect()' method?

Accepted Answer

To open an SSH-based NETCONF session.. In ncclient, manager.connect() establishes a NETCONF session over SSH (or another transport) to the target device, returning a manager object used for subsequent RPCs like get_config or edit_config. It handles the SSH transport, capability exchange, and session setup. It does not parse YANG, convert XML to JSON, or validate syntax.

Answer

To parse the YANG model.

Answer

To convert XML to JSON.

Answer

To validate the configuration syntax.

Question 10

You are parsing a complex JSON response from a Cisco ISE API. You need to extract the value of the 'macAddress' field nested inside an object named 'endpoint'. Which Python library is best suited for handling this data structure?

Accepted Answer

json. The json library is purpose-built for parsing and manipulating JSON data in Python, making it the correct choice for extracting a nested field like 'macAddress' inside an 'endpoint' object from a Cisco ISE API response. It converts JSON into native Python dictionaries and lists, allowing straightforward key access.

Answer

configparser

Answer

xml.etree.ElementTree

Answer

pickle

Question 11

You are automating the retrieval of threat intelligence logs from Cisco Secure Email Cloud Gateway. Which API interface provides the most efficient way to fetch historical message tracking logs for automated analysis?

Accepted Answer

Reporting API. The Reporting API on Cisco Secure Email Cloud Gateway is purpose-built for retrieving historical message tracking data, including delivered, bounced, and quarantined messages over a time range. It exposes endpoints that query the message tracking database efficiently, making it the correct choice for automated historical log analysis. Other APIs serve different functions such as threat feeds or web security.

Answer

AsyncOS API

Answer

External Threat Feeds API

Answer

Web Security Appliance API

Question 12

Which Cisco security product should you use if your main goal is to automate the blocking of malicious DNS queries?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the industry-standard cloud solution for DNS-layer security and policy automation.

Answer

Cisco Secure Web Appliance

Answer

Cisco Cloudlock

Answer

Cisco Secure Email

Question 13

A script interacting with Cisco Cloudlock is receiving a 429 Too Many Requests error. What should the automation script implement to handle this gracefully?

Accepted Answer

Exponential backoff. Rate limiting (429) requires the implementation of an exponential backoff strategy.

Answer

Increase the timeout duration

Answer

Retry immediately

Answer

Switch to a different API key

Question 14

In the context of the Cisco Firepower API, what does a 'GET' request to '/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies' return?

Accepted Answer

A list of all access control policies.. This path is the standard RESTful endpoint for listing all access control policies within a specific domain on the FMC.

Answer

The current system configuration backup.

Answer

A list of connected users.

Answer

A list of all device status events.

Question 15

Which element in an API request is most often used to filter the amount of data returned?

Accepted Answer

Query Parameters. Query parameters (e.g., ?limit=10 or ?offset=5) are the standard way to filter and paginate API responses.

Answer

HTTP Header

Answer

URL Path

Answer

Request Body

Question 16

What is the primary function of a 'Bearer Token' in an API request?

Accepted Answer

To authenticate the API request.. A Bearer Token is a credential that allows the holder (the bearer) to access the protected resource.

Answer

To define the API schema.

Answer

To compress the response.

Answer

To encrypt the payload.

Question 17

You are writing a script to parse FMC API response data. The response is a nested JSON object. Which Python library is standard for handling this task?

Accepted Answer

json. The 'json' module is the built-in Python library for encoding and decoding JSON objects.

Answer

requests

Answer

xml.etree

Answer

pandas

Question 18

In the context of the Cisco ASA REST API, what is the role of the 'ETag' header in an API response?

Accepted Answer

To provide concurrency control for updates. The ETag (Entity Tag) is used for concurrency control. It ensures that when you update a resource, you are modifying the version you expect, preventing 'lost updates'.

Answer

To cache the response

Answer

To identify the user session

Answer

To encrypt the payload

Question 19

When working with YANG data models in Cisco security automation, which TWO statements accurately describe the role of the 'leaf' and 'leaf-list' nodes?

Accepted Answer

A 'leaf-list' node allows for multiple instances of a specific value type.. A 'leaf' contains a single value, while a 'leaf-list' contains a sequence of values of a specific type.

Answer

A 'leaf' node can contain child nodes.

Answer

Both 'leaf' and 'leaf-list' support default values.

Answer

A 'leaf-list' node is used for hierarchical grouping.

Question 20

What does the 'Authorization' header in a REST API call carry?

Accepted Answer

The authentication token or credentials.. The 'Authorization' header in a REST API call is used to transmit credentials that authenticate the client to the server. This typically includes a token (e.g., Bearer token, API key) or other authentication scheme (e.g., Basic auth with base64-encoded username:password). It does not carry the server's public key, content type, or URL.

Answer

The server's public key.

Answer

The content type of the body.

Answer

The URL of the API.