SAUTO Practice Test 3 — 25 Questions

Question 1

A network security engineer is writing a Python script to interact with the Cisco Identity Services Engine (ISE) External RESTful Services (ERS) API. The script must create a new endpoint and then retrieve its details. Which HTTP status code should the script expect upon successful creation of the endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

201 Created. The ISE ERS API follows REST conventions and returns HTTP 201 Created when a new resource is successfully created via a POST request. This status confirms the creation and often includes a Location header pointing to the new resource. A 200 OK is used for successful GET or PUT, but not for creation.

Answer

302 Found

Answer

200 OK

Answer

204 No Content

Question 2

You are developing a Python script to automate Cisco Umbrella enforcement of security policies. The script must retrieve the list of identities and then apply a block action to a specific domain. Which API endpoint and method should you use to apply the block action?

Accepted Answer

POST to /policies/{policyId}/blocklist with a JSON body containing the domain to block.. To block a domain in Cisco Umbrella, you add it to a policy's block list. The API endpoint /policies/{policyId}/blocklist supports POST to add a domain. This is the correct method to apply a block action programmatically. Using POST ensures the domain is appended to the existing block list.

Answer

POST to /policies/{policyId}/block with a JSON body containing the domain.

Answer

GET to /policies/{policyId}/blocklist?domain=example.com to add the domain to the block list.

Answer

PUT to /policies/{policyId}/blocklist with a JSON body containing the domain to block.

Question 3

You are writing a script to update Cisco Secure Email (ESA) configuration. You need to push a new 'Content Filter' rule. Why is it recommended to perform a 'Get' request before the 'Put' request?

Accepted Answer

To preserve existing configuration attributes not being modified. Performing a 'Get' request before a 'Put' request is recommended to preserve existing configuration attributes that are not being modified. The 'Put' request typically replaces the entire resource, so if you omit fields, they may be reset to defaults. By retrieving the current configuration first, you can modify only the desired fields and send back the complete object.

Answer

To lock the configuration database

Answer

To verify the user has write permissions

Answer

To check if the API is responsive

Question 4

A security automation engineer is designing a Python script that interacts with multiple Cisco security appliances' REST APIs. The script must handle HTTP errors gracefully and implement retry logic for transient failures. Which two practices should be followed to ensure robust error handling? (Choose two.)

Accepted Answer

Use the raise_for_status() method on the response object to automatically raise an exception for HTTP error codes.. Using raise_for_status() and catching RequestException are two best practices for robust error handling with the requests library. raise_for_status() triggers exceptions on HTTP errors, and catching RequestException handles all request-related exceptions. These practices ensure that errors are detected and managed, allowing for retries or graceful degradation.

Answer

Use the Response.status_code attribute to manually check for specific error codes and implement custom retry logic.

Answer

Ignore HTTP 500 errors because they are server-side issues and will resolve on their own.

Answer

Set a very high timeout value to avoid timeouts and ensure requests always complete.

Question 5

Which programming language is most commonly used for Cisco Security automation tasks?

Accepted Answer

Python. Python is the industry standard for network and security automation due to its extensive library support and readability.

Answer

Java

Answer

C++

Answer

PHP

Question 6

You are writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of all endpoints in your organization. After authenticating with OAuth 2.0, you need to handle pagination because the API returns a limited number of results per page. Which HTTP response header should your script inspect to obtain the URL for the next page of results?

Accepted Answer

Link. The Cisco Secure Endpoint API implements pagination using the Link header, which contains URLs for the next, previous, first, and last pages. By parsing this header, your script can reliably navigate through large result sets. This approach is consistent with RESTful best practices and ensures that automated workflows, such as endpoint inventory or threat hunting, retrieve complete data without manual intervention.

Answer

Location

Answer

X-Next-Page

Answer

X-Total-Count

Question 7

You are automating the deployment of Cisco Umbrella Roaming Client to a large number of remote Windows endpoints using a configuration management tool. To ensure the client registers correctly and enforces policies, you need to provide the necessary parameters during silent installation. Which two parameters are required for a successful silent installation of the Cisco Umbrella Roaming Client? (Choose two.)

Accepted Answer

Organization ID. For a successful silent installation of the Cisco Umbrella Roaming Client, you must provide the Organization ID and the registration token. These parameters allow the client to authenticate and register with your Umbrella organization, enabling policy enforcement. Other settings, such as proxy configuration or user email, are optional and can be managed post-installation or via other means.

Answer

Proxy Server Address

Answer

User Email Address

Answer

DNS Server IP

Question 8

A security automation engineer is writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of computers. The script must handle pagination because the environment has thousands of endpoints. Which HTTP response header should the script inspect to determine the URL for the next page of results?

Accepted Answer

Link. The Cisco Secure Endpoint API implements pagination using the Link header as defined in RFC 5988. When a response contains more results, the Link header includes a URL with rel="next". The automation script must parse this header and follow the URL to retrieve subsequent pages. This ensures complete data retrieval across large environments without missing endpoints.

Answer

X-Next-Page

Answer

Location

Answer

Retry-After

Question 9

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

Accepted Answer

X-RateLimit-Remaining. SecureX (and most REST APIs following the IETF draft rate-limit header convention) returns the X-RateLimit-Remaining header to indicate how many requests the client can still make in the current window before being throttled. This header is paired with X-RateLimit-Limit (total allowed) and X-RateLimit-Reset (epoch time when the window resets), allowing scripts to pace API calls proactively.

Answer

Retry-After

Answer

X-Request-Limit

Answer

Status-Remaining

Question 10

An engineer is automating a Cisco Identity Services Engine (ISE) deployment using the ERS API. The API requires a secure transport and the engineer wants to verify the server's certificate against a corporate CA bundle in a Python script. The script uses the requests library. Which code snippet correctly performs the GET request to retrieve all network devices while ensuring certificate validation?

Accepted Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), verify='/path/to/ca_bundle.pem'). The correct approach is to pass the path to the corporate CA bundle via the verify parameter. This ensures the requests library validates the ISE server's certificate against the trusted corporate root, preventing man-in-the-middle attacks. Using verify=False disables validation, while cert is for client certificates, and verify=True uses the default bundle, which may not include the corporate CA.

Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), verify=False)

Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), verify=True)

Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), cert='/path/to/ca_bundle.pem')

Question 11

A network automation engineer is writing a Python script to interact with a Cisco Firepower Management Center (FMC) REST API. The script must authenticate and obtain a token for subsequent requests. Which HTTP header is used to pass the authentication token in subsequent API calls?

Accepted Answer

X-auth-access-token. The Cisco FMC REST API requires the authentication token to be included in the X-auth-access-token header for all subsequent requests after initial authentication. This is a custom header specific to FMC, not the standard Authorization header or other token headers used by different APIs. Using the correct header ensures successful API calls.

Answer

Cookie: token=...

Answer

Authorization: Bearer

Answer

X-Auth-Token

Question 12

When using the FMC API, what is the purpose of the 'X-Auth-Access-Token' header?

Accepted Answer

To carry the session token for authentication.. The FMC REST API uses a token-based authentication model: after POSTing credentials to /api/fmc_platform/v1/auth/generatetoken, the response includes X-auth-access-token (and a refresh token). Every subsequent API call must include that token in the X-Auth-Access-Token header so FMC can associate the request with the authenticated session. It is purely an authentication artifact, not a routing or versioning parameter.

Answer

To specify the target device IP address.

Answer

To define the API version.

Answer

To enable debugging mode.

Question 13

When automating Cisco Security solutions, what is the primary benefit of using a 'Service Account' instead of a personal user account for API authentication?

Accepted Answer

Decoupling script execution from individual employee identity.. Service accounts provide non-expiring credentials that are not tied to an individual's lifecycle, ensuring script continuity.

Answer

Improved performance of API calls.

Answer

Automatic elevation of privilege.

Answer

Ability to bypass firewall rules.

Question 14

A network security engineer is automating the deployment of Cisco Umbrella policies using the Umbrella API. The engineer needs to create a new destination list that blocks access to known malicious domains. Which HTTP method and endpoint should be used to create this list?

Accepted Answer

POST to /v1/destinationlists. To create a new destination list in Cisco Umbrella via the API, a POST request to /v1/destinationlists is required. The request body includes the list name and destinations. This is the standard RESTful approach for creating a resource in a collection.

Answer

GET to /v1/destinationlists

Answer

PUT to /v1/destinationlists/{id}

Answer

PATCH to /v1/destinationlists/{id}

Question 15

You are writing a script to monitor 'Cloudlock' alerts. Which API endpoint provides the most relevant data for SOC integration?

Accepted Answer

Incidents endpoint. The Incidents endpoint is the correct choice because Cloudlock incidents represent actual policy violations and security events, which is exactly the data a SOC needs for triage and response. Alerts generated by Cloudlock policies surface as incidents, making this endpoint the primary integration point for SIEM/SOAR platforms.

Answer

Policies endpoint

Answer

Users endpoint

Answer

App Firewall endpoint

Question 16

In the context of the Cisco Cloudlock API, what is the significance of the 'app_id' field?

Accepted Answer

It is the unique identifier for an OAuth application. In the Cisco Cloudlock API, the 'app_id' field is the unique identifier for an OAuth application. Cloudlock monitors and secures cloud applications, and each OAuth application (e.g., a third-party app accessing Google Workspace or Microsoft 365) is assigned a distinct 'app_id'. This allows the API to reference and manage specific applications for policy enforcement, risk assessment, and reporting.

Answer

It is the serial number of the appliance

Answer

It is the identifier for the Cloudlock tenant

Answer

It represents the user's role

Question 17

You are managing Cisco Cloudlock settings via the API. You need to ensure that specific SaaS file-sharing events are flagged. Which API object must you target to define a new policy violation trigger?

Accepted Answer

Policies API. The Cisco Cloudlock Policies API is the object used to create, retrieve, update, and delete policy definitions and their violation triggers. Policy violations in Cloudlock are defined as policy objects with matching criteria (e.g., file-sharing events, DLP patterns, user activity), so a new violation trigger must be created through the Policies API endpoint. The other APIs manage configuration, audit retrieval, application inventory, or user data — none of them define violation logic.

Answer

Configuration API

Answer

Audit API

Answer

Applications API

Answer

Users API

Question 18

You are configuring an Umbrella API callback. What happens if the callback URL is unreachable?

Accepted Answer

The notification is dropped. When an Umbrella API callback URL is unreachable, the notification is simply dropped. Umbrella does not retry indefinitely, revert policies, shut down the API service, or fall back to email. The callback mechanism is fire-and-forget; if the endpoint cannot be reached, the event notification is lost.

Answer

The policy is reverted

Answer

The API service shuts down

Answer

The alert is sent via email

Question 19

When using the 'ncclient' library in Python, what is the primary purpose of the 'manager.connect()' method?

Accepted Answer

To open an SSH-based NETCONF session.. In ncclient, manager.connect() establishes a NETCONF session over SSH (or another transport) to the target device, returning a manager object used for subsequent RPCs like get_config or edit_config. It handles the SSH transport, capability exchange, and session setup. It does not parse YANG, convert XML to JSON, or validate syntax.

Answer

To parse the YANG model.

Answer

To convert XML to JSON.

Answer

To validate the configuration syntax.

Question 20

You are parsing a complex JSON response from a Cisco ISE API. You need to extract the value of the 'macAddress' field nested inside an object named 'endpoint'. Which Python library is best suited for handling this data structure?

Accepted Answer

json. The json library is purpose-built for parsing and manipulating JSON data in Python, making it the correct choice for extracting a nested field like 'macAddress' inside an 'endpoint' object from a Cisco ISE API response. It converts JSON into native Python dictionaries and lists, allowing straightforward key access.

Answer

configparser

Answer

xml.etree.ElementTree

Answer

pickle