SAUTO Practice Test 5 — 25 Questions

Question 1

Which Cisco security product API supports 'Bulk' operations to improve efficiency when modifying large numbers of objects?

Accepted Answer

Cisco Firepower Management Center API. The FMC API includes 'bulk' endpoints to allow creating or updating multiple objects in a single API call.

Answer

Cisco ASA REST API

Answer

Cisco AnyConnect API

Answer

Cisco ISE ERS API

Question 2

Which HTTP method is most appropriate for retrieving information from a Cisco Security API?

Accepted Answer

GET. The GET method is defined by HTTP as the standard for retrieving resource information without modifying it.

Answer

PUT

Answer

POST

Answer

DELETE

Question 3

When parsing a JSON response from a Cisco Adaptive Security Appliance (ASA) REST API call using the Python requests library, you notice the data structure contains a list of objects under the key 'items'. Which Python expression correctly accesses the 'name' field of the first object in that list?

Accepted Answer

response.json()['items'][0]['name']. The correct expression is response.json()['items'][0]['name']. The .json() method deserializes the HTTP response body into Python objects — here a dict containing the key 'items', whose value is a list of dicts. Python lists are zero-indexed, so [0] retrieves the first element, and ['name'] then extracts the 'name' key from that dict. This matches the documented structure of Cisco ASA REST API responses, which wrap collections in an 'items' array.

Answer

response.json()['items'][1]['name']

Answer

response.json().items[0].name

Answer

response.json()['items'].get('name')[0]

Question 4

You are configuring a Webex CASB integration. To automate the reporting of anomalous file sharing events from a third-party cloud storage service, which API mechanism should you configure to receive real-time updates?

Accepted Answer

Registering a Webhook endpoint. Webhooks are the standard push-based mechanism for receiving real-time event notifications from cloud services. By registering a Webhook endpoint with the third-party cloud storage provider, the service will HTTP POST event payloads (such as anomalous file sharing events) to your listener as they occur, enabling near-instantaneous CASB reporting without polling overhead.

Answer

Direct database query access

Answer

SNMP Traps

Answer

Using an SSH tunnel to the cloud provider

Answer

Polling the REST API every 60 seconds

Question 5

You are developing a script to automate the creation of a new destination list in Cisco Umbrella using the Umbrella Enforcement API. The script must ensure that the list is created only if it does not already exist. Which HTTP status code should your script check for after attempting to create the list to determine if it already exists?

Accepted Answer

409 Conflict. When creating a destination list via the Cisco Umbrella Enforcement API, a 409 Conflict response indicates that a list with the same name already exists. Your automation should check for this status code to avoid creating duplicates. Handling 409 appropriately ensures idempotency and prevents errors in workflows that manage destination lists.

Answer

200 OK

Answer

201 Created

Answer

400 Bad Request

Question 6

In a Cisco Threat Grid API workflow, what does the 'state' field in the analysis report indicate?

Accepted Answer

The analysis status. In Cisco Threat Grid, the 'state' field in an analysis report indicates the current status of the analysis process. It reflects whether the sample is still being analyzed, has completed successfully, or encountered an error. This field is crucial for tracking the progress of a submission and determining when results are available.

Answer

The file reputation score

Answer

The connection health

Answer

The threat actor's location

Question 7

When using the Cisco Secure Email (formerly ESA) AsyncOS API to fetch message tracking data, what is the mandatory header required for authentication?

Accepted Answer

Authorization. The Cisco Secure Email AsyncOS API requires the Authorization header for authentication when fetching message tracking data. This header must contain a valid API token or credentials, typically in the format 'Authorization: Basic ' or 'Authorization: Bearer '. The API uses this header to authenticate and authorize the request, ensuring that only authorized users can access sensitive message tracking information.

Answer

Cookie: session_id

Answer

Bearer-Token

Answer

X-API-Key

Question 8

Which Cisco security product provides an API to automate the management of web proxy policies and access logs?

Accepted Answer

Cisco Secure Web Appliance (WSA). Cisco Secure Web Appliance (WSA) is the secure web gateway that enforces web proxy policies and generates access logs, and it exposes a REST API that allows administrators to automate policy management and retrieve access log data. This makes it the correct product for automating web proxy policy and log operations.

Answer

Cisco Tetration

Answer

Cisco Duo

Answer

Cisco Secure Endpoint

Question 9

When automating the deletion of Cisco Umbrella 'Destination Lists' via API, what happens to the policies currently associated with that list?

Accepted Answer

Policies referencing the list will lose the associated rule. When a Destination List is deleted via the Umbrella API, any policies that referenced that list lose the associated rule — the policy itself remains, but the rule pointing to the deleted list is removed. This means the policy may become empty or fall back to its default behavior, but the policy object is not deleted.

Answer

The policies will automatically default to 'Allow All'

Answer

The policies are automatically deleted to maintain integrity

Answer

The API will return an error and prevent deletion

Question 10

What is the purpose of the 'Client ID' and 'Client Secret' when authenticating with the Cisco Secure Email Gateway API?

Accepted Answer

To obtain an OAuth 2.0 access token. The Cisco Secure Email Gateway API uses OAuth 2.0 for authentication, and the Client ID and Client Secret are the credentials the client presents to the authorization server's token endpoint to obtain an access token. That access token is then included as a Bearer token in subsequent API calls. The Client ID identifies the registered API client, and the Client Secret proves its identity.

Answer

To directly access the email logs

Answer

To encrypt the email traffic

Answer

To unlock the appliance for SSH access

Question 11

When utilizing the Cisco Secure Email Reporting API, which format is best for programmatic data processing?

Accepted Answer

JSON. JSON is the best format for programmatic data processing because it is structured, machine-parseable, and natively supported by virtually every programming language and automation framework. The Cisco Secure Email Reporting API returns JSON responses that can be directly consumed by scripts, SIEM integrations, or orchestration tools without parsing overhead.

Answer

HTML

Answer

PDF

Answer

Raw binary logs

Question 12

You are using the Cisco Firepower Management Center (FMC) API to retrieve a list of Access Control Policies. Which URL endpoint is correct?

Accepted Answer

/api/fmc_config/v1/domain/{uuid}/policy/accesspolicies. The correct FMC REST API endpoint for Access Control Policies is /api/fmc_config/v1/domain/{uuid}/policy/accesspolicies, where {uuid} is the domain UUID obtained from the platform info endpoint. This follows FMC's standard config API URL structure.

Answer

/api/fmc_config/v1/policy/access

Answer

/api/v1/fmc/acp

Answer

/api/fmc_config/v1/domain/policy/accesspolicies

Question 13

Which protocol is primarily used for the transport of API calls in the Cisco security portfolio?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS) is the standard transport for REST API calls across the Cisco security portfolio, including Secure Endpoint, Umbrella, SecureX, and Firepower. It provides encryption, authentication, and integrity for API requests and responses, and all Cisco APIs expose HTTPS endpoints.

Answer

SNMP

Answer

SSH

Answer

TFTP

Question 14

You are using the Cisco Umbrella Investigate API to check if a specific IP address is associated with a known threat. Which domain of the API should you query?

Accepted Answer

/ips/. The Umbrella Investigate API organizes its data by object type, and IP address intelligence is exposed under the /ips/ domain. Querying /ips/{ip} returns reputation, ASN, geolocation, and associated threat indicators for that IP. To check whether a specific IP is tied to a known threat, /ips/ is the correct endpoint.

Answer

/files/

Answer

/domains/

Answer

/security/

Question 15

You are developing an integration for the Cisco Secure Endpoint API. What is the result of using a pagination parameter?

Accepted Answer

Retrieves results in chunks. A pagination parameter in the Cisco Secure Endpoint API controls how results are split into manageable chunks, allowing the client to retrieve large result sets incrementally rather than all at once. This is essential for performance and to avoid timeouts or truncated responses.

Answer

Authenticates the request

Answer

Encrypts the data stream

Answer

Reduces the API call limit

Question 16

Which THREE of the following are common issues encountered when automating Cisco Security APIs? (Choose three)

Accepted Answer

Incorrect URL endpoints or API versioning. Option B is correct because Cisco Security APIs (e.g., Cisco Firepower, Umbrella, ISE, and SecureX) expose versioned REST endpoints, and automation scripts frequently fail when they hard-code an outdated path such as /v1/ instead of the current /v2/ or when they target the wrong base URL for a given tenant or region. Option C is correct because Cisco Security API gateways enforce rate limits (for example, Umbrella enforces per-organization request quotas and Firepower Management Center enforces concurrent API call limits), so automation that polls too aggressively receives HTTP 429 Too Many Requests responses and must implement backoff/retry logic. Option D is correct because Cisco Security APIs rely on OAuth 2.0 bearer tokens or API keys that expire after a set lifetime, so long-running automation fails with HTTP 401 Unauthorized unless it refreshes tokens or rotates credentials. Option A is not a software/API automation concern at all, since power supply compatibility is a hardware issue unrelated to REST calls. Option E is likewise irrelevant, as Ethernet cable color has no bearing on API authentication, endpoint routing, or rate limiting.

Answer

Incompatible physical power supply

Answer

Wrong color of Ethernet cables

Question 17

Which TWO of the following are components of a URL? (Choose two)

Accepted Answer

Protocol (e.g., https). A URL's structure begins with the scheme, so option A (Protocol, e.g., https) is correct because it specifies how the resource is accessed, such as http, https, or ftp, and appears before the '://' delimiter. Option D (Host/Domain name) is also correct because it identifies the server hosting the resource, e.g., www.example.com, and is a required authority component of a URL. Option B is incorrect because a URL contains a hostname or domain name, not the local machine's IP address, which is the client's own address. Option C is incorrect because a URL never includes the server's physical CPU type, as that is hardware information unrelated to addressing. Option E is incorrect because credentials such as a password are not part of a standard URL structure and would be a serious security risk if embedded there.

Answer

The local machine's IP address

Answer

The server's physical CPU type

Answer

The user's password

Question 18

Which THREE components are typically involved in a SecureX orchestration workflow that automates the isolation of a host based on an Umbrella alert?

Accepted Answer

Event trigger. In a SecureX orchestration workflow, an Event trigger (A) is the component that starts the workflow automatically when a signal such as an Umbrella alert is received, making it essential for alert-driven automation. An Activity block (C) performs the actual work in the workflow, such as calling the Umbrella or Cisco ISE/Firepower APIs to isolate the host, so it is required to execute the isolation action. A Target appliance configuration (D) defines the connection and credentials for the device or service (e.g., firewall, ISE, Umbrella) that the workflow will act upon, which is necessary for the activity to reach and isolate the host. A Local SQL database server (B) is not a standard component of SecureX orchestration workflows, as data handling is done through activities and variables rather than a dedicated local SQL server. A Physical hardware switch console (E) is also not part of the orchestration workflow; isolation is performed via API-driven network/security appliances, not manual console access.

Answer

Local SQL database server

Answer

Physical hardware switch console

Question 19

In a Cisco security automation environment, what does the 'API Rate Limit' represent?

Accepted Answer

The number of requests allowed per time unit.. Rate limits restrict the number of requests a client can make in a specified time window to protect API availability.

Answer

The speed of the network connection.

Answer

The timeout value for an API request.

Answer

The maximum size of an API payload.

Question 20

Which THREE steps are required to automate the update of an Umbrella policy using the Umbrella Management API?

Accepted Answer

Perform a GET request to fetch the current policy configuration. To automate an Umbrella policy update via the Umbrella Management API, you must first perform a GET request to retrieve the current policy configuration (option B), because the API requires the existing policy object and its identifiers to build a valid update payload. Next, you modify the JSON structure to reflect the desired policy changes (option E), adjusting the relevant fields in the retrieved JSON so it represents the new intended state. Finally, you send a PUT request with the updated JSON payload (option C), which replaces the existing policy resource with the modified configuration. A DELETE request before the PUT (option A) is not required and would remove the policy rather than update it, converting the policy to binary (option D) is unnecessary since the API uses JSON, and no other steps beyond GET, modify, and PUT are needed for this automation.

Answer

Send a DELETE request before the PUT request

Answer

Convert the policy into a binary format