SAUTO Practice Test 4 — 25 Questions

Question 1

You are automating Cisco Umbrella reporting using the Reporting API. You need to pull threat activity logs for a specific destination. Which request header is mandatory to include in your HTTP GET call to authorize the request?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization: Bearer <TOKEN>. Cisco Umbrella Reporting API uses a Bearer token in the Authorization header for API authentication.

Answer

X-API-KEY

Answer

Cookie: session_id

Answer

X-Auth-Token

Question 2

You are automating Cisco ASA firewall rule updates using the REST API. Which data format is required in the request body when pushing a new access control entry?

Accepted Answer

JSON. Cisco ASA REST API integrations typically require JSON as the payload format for defining network objects and access rules.

Answer

YAML

Answer

XML

Answer

CSV

Question 3

Which TWO of the following are components of a URL? (Choose two)

Accepted Answer

Protocol (e.g., https). A URL typically includes the protocol (e.g., HTTPS) and the host/domain name.

Answer

The local machine's IP address

Answer

The server's physical CPU type

Answer

The user's password

Question 4

You are automating the retrieval of security logs from Cisco Umbrella using the Reporting API. You need to pull logs for a specific time range. Which parameter must be included in the API request to ensure the response is correctly paginated and contains the requested data slice?

Accepted Answer

limit. The Cisco Umbrella Reporting API uses a 'limit' and 'offset' parameter for pagination to ensure large datasets are handled efficiently.

Answer

slice_id

Answer

page_token

Answer

session_id

Question 5

You are using the Cloudlock API to fetch 'Application' data. You receive a response with a 'next_page' token. What does this indicate about the API behavior?

Accepted Answer

The response is paginated and you must follow the link to get more records. The Cloudlock API utilizes cursor-based pagination for large data sets, where the 'next_page' token provides the reference to the subsequent result set.

Answer

The requested data format is invalid

Answer

The application data is currently being updated

Answer

The API request failed due to rate limiting

Question 6

When automating threat hunting using the Cisco Umbrella Reporting API, which THREE of the following request parameters are commonly used to filter DNS query logs?

Accepted Answer

from. The Umbrella Reporting API supports filtering by domain, time range, and query type to narrow down search results.

Answer

threat_score

Answer

source_ip

Question 7

You are configuring a SecureX workflow to notify a team. Which THREE notification methods are available via standard activities?

Accepted Answer

Webex. SecureX workflows support Webex, Email, and PagerDuty notifications out-of-the-box.

Answer

Voice call

Answer

SMS

Question 8

A network engineer is using the 'requests' library in Python to perform a POST operation to a Cisco FMC API. Which parameter is used to send data in the body of the HTTP request?

Accepted Answer

json. The 'json' parameter in the requests library automatically encodes a dictionary into a JSON string and sets the Content-Type header.

Answer

headers

Answer

params

Answer

data

Question 9

What is the significance of the 'Accept' header in a REST API request?

Accepted Answer

It specifies the expected response format.. The 'Accept' header tells the server which data format the client expects in the response body.

Answer

It defines the data format being sent.

Answer

It tells the server to accept the connection.

Answer

It performs authentication.

Question 10

Which statement best describes JSON?

Accepted Answer

It is a lightweight, language-independent data format.. JSON is a text-based format for data interchange that is independent of any programming language.

Answer

It is specific to JavaScript and cannot be used in Python.

Answer

It is a binary format for faster processing.

Answer

It is a schema language for XML.

Question 11

You are configuring a Cisco ISE external RESTful service (ERS) integration. You need to update the status of a guest user. Which HTTP method and resource URI structure is correct?

Accepted Answer

PUT /ers/config/guestuser/{id}. The Cisco ISE ERS API uses PUT for updates. For guest users, the correct path is /ers/config/guestuser/{id}.

Answer

POST /ers/config/guestuser/update

Answer

UPDATE /ers/config/guestuser/{id}

Answer

PATCH /ers/config/guestuser/{id}

Question 12

Which TWO of the following are valid HTTP methods supported by the Cisco Umbrella Management API?

Accepted Answer

POST. The Umbrella Management API follows REST principles, and POST (create) and DELETE (remove) are standard methods for managing destination lists and policies.

Answer

CONNECT

Answer

HEAD

Answer

TRACE

Question 13

You are automating the addition of an IP blocklist in Umbrella. You have the IP address and the list ID. Which HTTP method and path is correct?

Accepted Answer

POST /v1/destinationlists/{listId}/destinations. Adding an entry to a destination list uses the POST method on the specific list resource.

Answer

GET /v1/destinationlists/{listId}

Answer

PUT /v1/destinationlists/{listId}/destinations

Answer

PATCH /v1/destinationlists/{listId}

Question 14

You are integrating Cisco SecureX with a third-party SIEM. When configuring a webhook for event notifications, which authentication method is natively supported by the SecureX webhook integration for secure delivery?

Accepted Answer

HMAC-SHA256 signature verification. SecureX webhooks support HMAC-SHA256 signature verification to ensure the integrity and authenticity of the payload.

Answer

OAuth 2.0 Client Credentials flow

Answer

Mutual TLS (mTLS) certificate exchange

Answer

Basic Authentication with fixed credentials

Question 15

You are writing a Python script to interact with the Cisco Secure Web Appliance (WSA) REST API to pull 'Access Logs'. When parsing the response, you notice the data is chunked. What is the most appropriate way to handle large log datasets when using the REST API?

Accepted Answer

Use the 'limit' and 'offset' query parameters to paginate through the log data. The WSA REST API handles large datasets through pagination (offset and limit parameters) to prevent memory exhaustion on the client and server.

Answer

Increase the timeout on the HTTP request

Answer

Request the data in XML format instead of JSON

Answer

Switch to the SSH-based CLI API to download the logs

Question 16

Which Cisco security product uses the 'AsyncOS' platform, and for which automation tasks is its API most commonly used?

Accepted Answer

Cisco Secure Email and Web Appliances; configuration and monitoring. Cisco Secure Email and Secure Web appliances run on AsyncOS and use the AsyncOS API for reporting, configuration, and monitoring.

Answer

Cisco Cloudlock; SaaS file inspection

Answer

Cisco Umbrella; DNS filtering policies

Answer

Cisco Firepower; firewall rule orchestration

Question 17

You are writing a script to update Cisco Secure Email (ESA) configuration. You need to push a new 'Content Filter' rule. Why is it recommended to perform a 'Get' request before the 'Put' request?

Accepted Answer

To preserve existing configuration attributes not being modified. Performing a GET before a PUT allows the script to preserve existing configuration attributes that are not being modified, preventing accidental erasure of other fields.

Answer

To lock the configuration database

Answer

To verify the user has write permissions

Answer

To check if the API is responsive

Question 18

You are automating threat hunting in Cisco SecureX. You want to execute a workflow that pivots from an IP address to associated domains. Which SecureX API component allows you to perform these relationship lookups?

Accepted Answer

Threat Intelligence API. The SecureX Threat Intelligence API provides relationship lookups between observables.

Answer

Pivot API

Answer

Orchestration Query API

Answer

Relationship Discovery Service

Question 19

You are using the Cisco Umbrella API to pull blocked DNS requests. Which resource provides this data?

Accepted Answer

/reports/dns_query_log. The /reports/dns_query_log endpoint provides the history of DNS requests.

Answer

/logs/blocked

Answer

/dns/activity

Answer

/security/dns

Question 20

You are automating threat hunting using the Cisco Umbrella Investigate API. Which TWO parameters are required to perform a standard DNS lookup for a specific domain? (Choose two)

Accepted Answer

The domain name string. The Investigate API requires the domain name and the specific endpoint path to retrieve DNS data.

Answer

The threat category ID

Answer

The global user ID

Answer

The IP address of the local DNS recursive resolver