SAUTO Practice Test 21 — 15 Questions

Question 1

Which authentication method is most commonly used by Cisco SecureX for API access?

Accepted Answer

OAuth 2.0. SecureX uses OAuth 2.0 with Client Credentials for machine-to-machine authentication.

Answer

API Key (Static)

Answer

Kerberos

Answer

Basic Auth

Question 2

You are building a Python automation that creates a new destination list in Cisco Umbrella and then adds 500 domains to it. After authenticating with OAuth 2.0, your script must create the list before adding entries. Which HTTP method and endpoint should the script use to create the destination list?

Accepted Answer

POST to https://api.umbrella.com/policies/v2/destinationlists. Creating a destination list is a collection-level create operation on the Umbrella Policies API, which lives under /policies/v2. The correct call is an HTTP POST to that collection endpoint with a JSON body describing the list. Read-only reporting endpoints and resource-specific PUT or GET calls cannot satisfy the create requirement.

Answer

POST to https://api.umbrella.com/reports/v2/destinationlists

Answer

GET to https://api.umbrella.com/policies/v2/destinationlists?name=blocklist

Answer

PUT to https://api.umbrella.com/policies/v2/destinationlists/{listId}

Question 3

Which Cisco technology allows you to automate the distribution of Indicators of Compromise (IoCs) across the security stack?

Accepted Answer

Cisco Threat Intelligence Director (TID). Cisco Threat Intelligence Director (TID), integrated into Firepower, automates the intake and distribution of IoCs to various sensors and devices.

Answer

Cisco ISE SGTs

Answer

Cisco Umbrella Investigate

Answer

Cisco ASA Access Lists

Question 4

When automating Cisco Stealthwatch, which authentication type is utilized for the API?

Accepted Answer

Username and Password (or API Key). The Cisco Stealthwatch (now Secure Network Analytics) API authenticates using a username and password (or an API key/token derived from credentials) via Basic authentication to obtain a bearer token. Automation scripts POST credentials to the token endpoint and then use the returned JWT for subsequent calls. This is the documented authentication model for the Stealthwatch Management Console (SMC) API.

Answer

X.509 Certificate

Answer

TACACS+ shared secret

Answer

OAuth 2.0 Client Credentials

Question 5

In Cisco SecureX Orchestration, you are building an atomic workflow to isolate an endpoint. Which input parameter is required to identify the target host in the Secure Endpoint 'Isolate Host' activity?

Accepted Answer

connector_guid. In Cisco SecureX Orchestration, the Secure Endpoint 'Isolate Host' activity requires the connector_guid input parameter to uniquely identify the target endpoint. The connector_guid is the unique identifier assigned to each Secure Endpoint connector when it registers with the cloud, and it is the authoritative key used by the Secure Endpoint API to address a specific host. Other identifiers like IP address, MAC address, or hostname are not guaranteed to be unique or stable and are not accepted by the isolation activity.

Answer

ipv4_address

Answer

mac_address

Answer

hostname

Question 6

Which Python library is the industry standard for handling REST API requests when automating Cisco security solutions?

Accepted Answer

requests. The requests library is the de facto industry standard for making REST API calls in Python, offering a simple, human-friendly API for HTTP methods, headers, authentication, and JSON handling. It is widely used in Cisco security automation scripts for interacting with platforms like Cisco DNA Center, ISE, and Firepower REST APIs.

Answer

http.client

Answer

cisco-sdk

Answer

urllib2

Question 7

Which of the following is a core benefit of using APIs for Cisco Security?

Accepted Answer

Reduced manual task complexity. APIs let security teams replace repetitive manual console or CLI work with programmatic calls, which reduces manual task complexity and human error. This is the core operational benefit Cisco emphasizes for its Security APIs: automation, consistency, and scale. The other options describe outcomes APIs do not deliver — APIs do not remove the need for firewalls, increase human intervention, or replace security staff.

Answer

Elimination of firewalls

Answer

Increased human intervention

Answer

Replacement of all security admins

Question 8

You are using the Cisco Secure Endpoint API to query file trajectory data. The API returns a 429 status code. What is the most appropriate programmatic response?

Accepted Answer

Implement an exponential backoff algorithm before retrying. HTTP 429 means 'Too Many Requests' — the client has exceeded the API rate limit. The correct programmatic response is to back off and retry, ideally using exponential backoff (with jitter) to avoid hammering the endpoint and to respect the server's Retry-After header when present. This is the standard, RFC-aligned way to handle rate limiting gracefully.

Answer

Immediately retry the request with the same parameters

Answer

Update the API key to a higher privilege level

Answer

Switch to the secondary API endpoint URL

Question 9

When automating the integration between Cisco Cloudlock and a third-party platform, which TWO data types are typically fetched via the Cloudlock API?

Accepted Answer

Incident details. Option A (Incident details) is correct because the Cisco Cloudlock API exposes incident endpoints that let third-party platforms retrieve security incidents (e.g., DLP, account compromise, and policy-related incidents) for ticketing, SIEM ingestion, or automated response workflows. Option D (Policy violation metadata) is correct because Cloudlock's API provides policy and violation data—such as which policy was triggered, the affected user or file, and the violation context—so external systems can correlate and act on Cloudlock findings. Option B (User password hashes) is not applicable, as Cloudlock does not expose credential secrets or password hashes through its API. Option C (Appliance firmware images) is not applicable, since Cloudlock is a cloud-native CASB service and does not distribute hardware firmware via its API. Option E (Network interface statistics) is not applicable, as Cloudlock's API is focused on security incidents and policy data rather than low-level network interface telemetry.

Answer

User password hashes

Answer

Appliance firmware images

Answer

Network interface statistics

Question 10

A security automation engineer is writing a Python script that uses the Cisco Firepower Management Center (FMC) REST API to modify an existing access control policy. The script must first obtain the current policy object, change its default action, and then submit the update. Which HTTP method and endpoint pattern should the script use to apply the change to the existing policy?

Accepted Answer

PUT to /api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies/{objectId}. To modify an existing access control policy in FMC, the REST API requires a PUT request to the specific policy resource, identified by its objectId in the URL. The request body must contain the complete policy object with the desired changes. POST is for creation, and PATCH is not supported for this resource, so those methods would not achieve the required update.

Answer

POST to /api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies

Answer

PUT to /api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies

Answer

PATCH to /api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies/{objectId}

Question 11

You are automating Cisco Umbrella policy enforcement through the Umbrella Management API. A Python script must periodically retrieve the list of identities (networks) that are currently associated with a specific destination list so the script can compute a delta and push updates. Which HTTP method and endpoint pattern should the script use to read the current members of a destination list?

Accepted Answer

GET /policies/v2/destinationlists/{destinationListId}/destinations. Reading destination list membership requires an idempotent GET against the destinations sub-resource of the destination list. This returns the member set with pagination, allowing the automation to diff current versus desired state before issuing any write. Write methods such as POST or PUT mutate membership and belong in the update phase, not the discovery phase, so only the GET pattern fits the scenario.

Answer

GET /policies/v2/destinationlists/{destinationListId}

Answer

POST /policies/v2/destinationlists/{destinationListId}/destinations

Answer

PUT /policies/v2/destinationlists/{destinationListId}/destinations

Question 12

A security engineer is automating Cisco Identity Services Engine (ISE) using the REST API. The script must retrieve a list of all network devices configured in ISE. Which API endpoint should the engineer use?

Accepted Answer

GET /api/v1/network-device. The Cisco ISE REST API provides a dedicated resource for network devices at /api/v1/network-device. A GET request to this endpoint returns all network devices. Other endpoints deal with device groups, identity groups, or administrative settings, none of which return the list of network devices.

Answer

GET /api/v1/device-administration

Answer

GET /api/v1/network-device-group

Answer

GET /api/v1/identity-group

Question 13

An engineer runs a Python script that calls the Cisco Firepower Management Center (FMC) REST API to list all access control policies. The script uses the requests library and the response object r. Which attribute of r gives the HTTP status code so the script can branch on success versus failure?

Accepted Answer

r.status_code. The requests library stores the numeric HTTP result on the Response object as status_code. Checking that attribute lets the script confirm a 200 before parsing the FMC JSON payload, and lets it detect 401 or 429 conditions and react appropriately. The other attributes either are not part of the HTTP status or return non-numeric data unsuitable for exact comparisons.

Answer

r.ok

Answer

r.reason

Answer

r.headers['Status']

Question 14

You are building a SOAR playbook that ingests observables from Cisco Threat Response and needs to automatically create a case in Cisco Threat Response for every observable that has a verdict of 'malicious'. After authenticating with the Cisco Threat Response API, which HTTP method and endpoint should your playbook use to create a new case?

Accepted Answer

POST to /iroh/iroh-case/case. Cisco Threat Response exposes a case management API under /iroh/iroh-case/case. To create a new case programmatically, the correct HTTP method is POST, and the request body should contain the case details. The other endpoints listed serve different purposes: inspect and enrich are for observable analysis, and PUT is for updating existing cases. Understanding the correct endpoint and verb is essential for automating incident creation.

Answer

POST to /iroh/iroh-enrich/observe/observables

Answer

PUT to /iroh/iroh-case/case

Answer

POST to /iroh/iroh-inspect/inspect

Question 15

You are building a Python automation that rotates the API key used by a Cisco Umbrella Reporting API integration every 30 days. The script authenticates with the Umbrella Management API to create a new key and then deletes the old key. Which HTTP header must every Management API request include to prove the caller is authorized?

Accepted Answer

Authorization: Bearer <API key>. The Umbrella Management API authenticates machine callers with the API key supplied in the Authorization header using the Bearer scheme. A rotation script must send that header on every request, then switch to the newly created key before revoking the old one. Custom headers, Basic credentials, and session cookies are not accepted on these endpoints, so a script relying on them receives 401 responses.

Answer

X-Umbrella-Key: <API key>

Answer

Authorization: Basic <base64(user:pass)>

Answer

Cookie: session=<token>