SAUTO Practice Test 3 — 10 Questions

Question 1

What is the function of the Cisco SecureX 'Threat Response' module?

Accepted Answer

Investigating threats across integrated products. The Cisco SecureX 'Threat Response' module is the investigation and response orchestration component of the SecureX platform. It aggregates observables (IPs, hashes, domains, URLs) from integrated Cisco security products such as Umbrella, AMP for Endpoints, Firepower, and Email Security, and lets analysts pivot across them in a single console. Its core function is threat investigation and response across the integrated product ecosystem, not device management or file hosting.

Answer

Managing network switch configurations

Answer

Hosting endpoint agent files

Answer

Automating software updates

Question 2

You are automating the retrieval of blocked file hashes from Cisco Secure Email (ESA). Which API object provides the most granular view of file-based security events?

Accepted Answer

Message Tracking API. The Message Tracking API in Cisco Secure Email (ESA) provides the most granular, per-message view of mail flow and security events, including details about attachments and file hashes associated with blocked messages. When you need to retrieve blocked file hashes, Message Tracking exposes the message-level metadata (sender, recipient, verdict, attachment SHA-256) that Reporting and System Health APIs do not. This makes it the correct object for file-based security event granularity.

Answer

System Health API

Answer

Reporting API

Answer

Configuration API

Question 3

You are automating Firepower Management Center (FMC) object creation using the REST API. You send a POST request to /api/fmc_config/v1/domain/{domainUUID}/object/networkaddresses with a body containing a name and type. The request returns a 400 Bad Request error. What is the most likely cause?

Accepted Answer

The mandatory 'value' attribute is missing from the JSON payload.. The FMC network address object schema requires both a 'name' and a 'value' field; 'value' holds the actual IP address or network (e.g., '10.0.0.0/24'). Omitting it produces a 400 Bad Request because the JSON payload fails schema validation, even though the name and type are present.

Answer

The domainUUID is incorrect.

Answer

The Content-Type header is missing.

Answer

The API user lacks the 'Network Admin' role.

Question 4

When automating Cisco Stealthwatch (Secure Network Analytics) alerts, which API endpoint is used to query flow data?

Accepted Answer

/sw-reporting/v1/flows. The Stealthwatch API provides specific endpoints under '/sw-reporting/v1/' for flow data retrieval.

Answer

/inventory/v1/devices

Answer

/api/v1/firewall

Answer

/analytics/v1/alerts

Question 5

When parsing a complex JSON response from a Cisco Stealthwatch API call, you need to extract the value associated with a key nested deep within the hierarchy. Which Python approach is most idiomatic and robust for this task?

Accepted Answer

Load the response into a dictionary using json.loads() and access the keys using a chain of square brackets.. The most idiomatic and robust way to extract a nested value from a JSON response in Python is to parse it with json.loads() into a dictionary and then navigate using a chain of square brackets (e.g., data['a']['b']['c']). This leverages Python's native dictionary access and is clear, efficient, and standard practice. It also allows for error handling with try/except or using .get() for safer access.

Answer

Convert the JSON to XML and use XPath to navigate the structure.

Answer

Use string slicing with find() to locate the key.

Answer

Use regex patterns to extract the value directly from the raw string.

Question 6

Which THREE of the following are essential components of a REST API request for a Cisco security product?

Accepted Answer

HTTP Method (e.g., GET, POST, PUT, DELETE).. Option B is correct because every REST API request must specify an HTTP method such as GET, POST, PUT, or DELETE, which defines the action to perform on the target resource. Option D is correct because the URI (Uniform Resource Identifier) is required to identify the specific resource being accessed, such as an endpoint on a Cisco Firepower or ISE API. Option E is correct because REST requests typically require headers to carry authentication credentials (e.g., an API token or Basic Auth) and to specify the data format via Content-Type or Accept headers. Option A is incorrect because REST APIs use dynamically constructed JSON or XML payloads sent in the request body, not a predefined XML file saved on the desktop. Option C is incorrect because REST APIs operate over HTTP/HTTPS network connections, not through a physical serial console cable.

Answer

A predefined XML configuration file saved on the desktop.

Answer

A physical serial console cable connection.

Question 7

Which THREE features are provided by the Cisco SecureX API documentation?

Accepted Answer

Request examples. The Cisco SecureX API documentation is designed to let developers integrate with SecureX services, so it includes request examples (A) that show exactly how to format calls to the API, including HTTP methods, URLs, headers, and sample payloads. It also provides schema definitions (B), which describe the data models and structures of request and response bodies so developers know the expected fields and types. Endpoint definitions (D) are likewise included, listing the available API endpoints and their operations so consumers know which URLs to call for each function. Pricing information (C) is a commercial/billing matter and is not part of API reference documentation, and hardware installation guides (E) are physical deployment documents unrelated to the SecureX API documentation.

Answer

Pricing information

Answer

Hardware installation guides

Question 8

When working with NETCONF, what is the role of the <edit-config> operation?

Accepted Answer

It changes the running configuration of the device.. The NETCONF operation is used to modify the configuration datastore on a device — it can create, merge, replace, or delete configuration nodes within a target datastore such as . It is the standard way to push configuration changes via NETCONF, as defined in RFC 6241.

Answer

It retrieves the entire configuration from the device.

Answer

It deletes the entire configuration.

Answer

It creates a new session on the device.

Question 9

You are automating threat response using Cisco Threat Response. You want to retrieve a list of verdicts for a specific observable (e.g., an IP address). Which API provides this capability?

Accepted Answer

Cisco Threat Response (CTR) API. The Cisco Threat Response API (often integrated via the 'private cloud' or 'public cloud' API endpoints) allows querying indicators and verdicts for specific observables.

Answer

Cisco Security Services Exchange (SSE) API

Answer

Cisco Firepower Management Center API

Answer

Cisco ISE pxGrid API

Question 10

You are writing a Python script to automate management of destination lists in Cisco Umbrella. The script must retrieve the current contents of a specific destination list before adding new domains. Which HTTP request should the script make to obtain the list details?

Accepted Answer

GET https://management.api.umbrella.com/v1/organizations/{organizationId}/destinationlists/{destinationListId}. The Umbrella Management API exposes destination lists under the organizations path, and reading a specific list requires a GET to the destinationlists resource with both the organization ID and destination list ID. This returns the list and its entries, enabling the script to inspect existing domains before adding new ones. The Reporting API and write methods do not serve this read-before-write requirement.

Answer

GET https://reports.api.umbrella.com/v2/organizations/{organizationId}/destinationlists/{destinationListId}

Answer

PUT https://management.api.umbrella.com/v1/organizations/{organizationId}/destinationlists/{destinationListId}

Answer

POST https://management.api.umbrella.com/v1/organizations/{organizationId}/destinationlists/{destinationListId}/destinations