SAUTO Practice Test 2 — 30 Questions

Question 1

You are developing a Python script that uses the ncclient library to configure a Cisco IOS-XE device via NETCONF. You need to send a <edit-config> operation that merges a new interface configuration. Which NETCONF operation and default-operation value should you use to ensure that only the specified configuration is merged without affecting other interfaces?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use with default-operation='merge'.. The operation with default-operation='merge' is the standard way to merge configuration changes without affecting other parts of the configuration. It modifies only the specified nodes. The 'replace' option would overwrite the entire configuration, while 'none' requires explicit operation attributes. is for full datastore replacement.

Answer

Use <edit-config> with default-operation='replace'.

Answer

Use <copy-config> with the running configuration as the target.

Answer

Use <edit-config> with default-operation='none'.

Question 2

You are automating the addition of an IP blocklist in Umbrella. You have the IP address and the list ID. Which HTTP method and path is correct?

Accepted Answer

POST /v1/destinationlists/{listId}/destinations. The Umbrella API uses POST to add destinations to an existing destination list. The correct endpoint is /v1/destinationlists/{listId}/destinations, where {listId} is the ID of the target list. POST is the standard HTTP method for creating or appending resources, which matches the action of adding IPs to a blocklist.

Answer

GET /v1/destinationlists/{listId}

Answer

PUT /v1/destinationlists/{listId}/destinations

Answer

PATCH /v1/destinationlists/{listId}

Question 3

Which YANG node type is used specifically to group reusable definitions that can be imported by other modules?

Accepted Answer

grouping. A grouping in YANG is a reusable collection of nodes (leaves, containers, lists) that can be referenced with the uses statement, either within the same module or imported from another module. It exists specifically to avoid duplicating common configuration structures across multiple parts of a model.

Answer

typedef

Answer

leaf

Answer

container

Question 4

Which of the following is a key requirement for using the Cisco Umbrella API successfully?

Accepted Answer

API Key and Secret generated in the dashboard. The Cisco Umbrella API requires an API Key and Secret generated from the Umbrella dashboard to authenticate requests. These credentials are used to obtain tokens for programmatic access to Umbrella's reporting, enforcement, and management endpoints. Without them, API calls cannot be authenticated.

Answer

Root access to the DNS server

Answer

A valid SNMP community string

Answer

A physical connection to the Cisco cloud data center

Question 5

You are integrating Cisco Umbrella with your SIEM using the Umbrella Reporting API. Which authentication mechanism is required to access the Reporting API endpoints?

Accepted Answer

API Key and Secret to obtain a Bearer Token. The Umbrella Reporting API requires an API Key and Secret, which are exchanged for a Bearer Token used to authenticate subsequent requests. This OAuth-style flow is documented by Cisco for programmatic access to reporting endpoints. The token is then passed in the Authorization header.

Answer

Username and password in the HTTP header

Answer

Shared pre-shared key (PSK)

Answer

Client certificate-based authentication only

Question 6

You are automating Cisco Identity Services Engine (ISE) using the External RESTful Services (ERS) API. Your Python script needs to query all network devices and then update a specific device group. After authenticating with HTTPS Basic Authentication, you receive an HTTP 401 response when attempting to retrieve devices. Which action should you take to resolve this?

Accepted Answer

Include the 'ERS-Read-Only' or 'ERS-Admin' role in the API user's admin group and ensure the account is not disabled.. A 401 Unauthorized response from the Cisco ISE ERS API indicates that the provided credentials are not accepted or the account lacks necessary permissions. The ERS API requires the API user to be assigned to an admin group with ERS-Admin or ERS-Read-Only roles. Ensuring the account is active and has the correct role resolves the authentication failure.

Answer

Disable SSL certificate verification in your Python script to allow the connection to proceed.

Answer

Change the HTTP method from GET to POST and include a JSON body with the device details.

Answer

Add the 'Accept: application/json' header to the request to ensure the server returns JSON instead of XML.

Question 7

You are writing a script to automate firewall rules. When using the 'pyang' tool, what is the primary purpose of the '--format' option?

Accepted Answer

To translate the YANG model into a specific output format.. The --format option in pyang is used to specify the output format, such as tree, json, or xsd, for a given YANG model.

Answer

To set the recursion depth of the model tree.

Answer

To define the input file encoding.

Answer

To specify the YANG module version.

Question 8

When using NETCONF to manage a Cisco device, which message type is used to establish the initial session and exchange capability information?

Accepted Answer

. NETCONF sessions begin with a message exchanged by both the client and the server. The contains the session ID and a element listing supported YANG modules and protocol features, allowing both sides to negotiate what operations and data models are available before any configuration is attempted.

Answer

<rpc>

Answer

<ok>

Answer

<rpc-reply>

Question 9

In a Cisco REST API implementation using Python, you receive a '429 Too Many Requests' error. What is the appropriate programmatic response?

Accepted Answer

Implement an exponential backoff strategy.. A 429 Too Many Requests status code indicates that the client has exceeded the rate limit imposed by the API server. The correct programmatic response is to implement an exponential backoff strategy, where the client waits progressively longer intervals between retries (e.g., 1s, 2s, 4s, 8s) to reduce the request rate and avoid overwhelming the server. This approach is a standard best practice for handling rate limiting in REST APIs, including Cisco's, and is often recommended in Cisco DevNet and automation certifications.

Answer

Switch the request method from GET to POST.

Answer

Disable SSL verification for subsequent calls.

Answer

Increase the timeout duration of the request.

Question 10

Which Cisco tool is best suited for centralizing the management of security APIs across multiple platforms?

Accepted Answer

Cisco SecureX Orchestration. Cisco SecureX Orchestration is the platform designed to centralize, build, and run workflows that call security APIs across multiple Cisco and third-party products. It provides a visual workflow editor, prebuilt activities, and connectors so teams can orchestrate responses across FMC, Umbrella, Secure Endpoint, ISE, and more from a single place.

Answer

Cisco FMC

Answer

Cisco ISE

Answer

Cisco Umbrella

Question 11

Which THREE of the following are common JSON data types?

Accepted Answer

number. JSON (JavaScript Object Notation, defined by RFC 8259) supports a fixed set of value types, and option A (number) is one of them: JSON numbers are written as decimal literals such as 42, -3.14, or 1.5e10, with no distinction between integers and floats. Option B (string) is correct because JSON strings are sequences of Unicode characters enclosed in double quotes, using backslash escapes like 
 and \uXXXX. Option D (boolean) is correct because JSON defines the literal values true and false as a native boolean type. The unmarked options do not belong: option C (class) is an object-oriented construct, not a JSON type — JSON only has objects (unordered key/value collections), not classes — and option E (pointer) is a memory-address concept from languages like C/C++, with no representation in the JSON specification.

Answer

class

Answer

pointer

Question 12

Your team runs a Cisco Secure Email Gateway (AsyncOS) and wants to automate message tracking lookups for incident response. A script authenticates with a valid session and queries /esa/api/v2.0/message-tracking/messages. The API returns HTTP 404 for every query even though messages exist. Which configuration issue is the most likely cause?

Accepted Answer

The ESA API feature is disabled or the wrong API version is enabled in the gateway configuration.. HTTP 404 from an AsyncOS API endpoint usually means the requested path is not exposed. The API feature must be enabled on the gateway, and the endpoint version in the URL must match the enabled version. Authentication failures produce 401, and empty data produces 200 with an empty result, so those do not fit the symptom.

Answer

The OAuth 2.0 token has expired and must be refreshed before retrying.

Answer

The message tracking database has been purged and no messages remain to query.

Answer

The API account lacks the Administrator or Operator role required for message tracking.

Question 13

When using the Cisco Umbrella Reporting API, which format is the default output for retrieving threat activity logs to ensure compatibility with most data analysis tools?

Accepted Answer

JSON. The Cisco Umbrella Reporting API returns JSON by default, which is the native format for most modern data analysis tools, SIEMs, and scripting languages. JSON's structure maps cleanly to Python dictionaries and JavaScript objects, making it the standard interchange format for API-driven log retrieval. XML, CSV, and binary are not the default output for Umbrella Reporting API responses.

Answer

XML

Answer

Binary

Answer

CSV

Question 14

Which THREE of the following are best practices for managing API keys? (Choose three)

Accepted Answer

Rotate keys regularly. Option A (Rotate keys regularly) is correct because periodic rotation limits the window of exposure if a key is leaked or compromised, and it supports compliance requirements such as those in PCI DSS and NIST guidelines. Option B (Use least privilege access for keys) is correct because scoping each key to only the permissions and resources it needs reduces the blast radius of a compromised key, following the principle of least privilege. Option C (Never hardcode keys in scripts) is correct because hardcoded keys end up in source control, logs, and build artifacts, where they are easily exposed; instead, keys should be stored in a secrets manager or injected via environment variables at runtime. Option D is wrong because reusing one key across every project violates least privilege and isolation, so a single leak compromises all projects and makes auditing impossible. Option E is wrong because email is unencrypted in transit and at rest on many servers, so sharing keys that way exposes them to interception and unauthorized access; keys should be distributed through a secure secrets management system.

Answer

Use the same key for every project

Answer

Share keys via email with the team

Question 15

You are configuring a CI/CD pipeline to deploy Cisco ASA firewall rules. Which step is essential to ensure the changes are correct before applying them to production?

Accepted Answer

Deploy to a sandbox or staging environment for validation.. Validating changes in a staging or pre-production environment is critical to ensure logic and syntax correctness.

Answer

Rely on automated rollback without testing.

Answer

Directly apply to production to save time.

Answer

Only test the API connectivity.

Question 16

Which TWO of the following are true regarding the use of the Python 'requests' library?

Accepted Answer

It can automatically serialize dictionaries to JSON via the json parameter.. Option B is correct because requests accepts a json= keyword argument on methods such as post(), put(), and patch(), which serializes a Python dictionary to a JSON body and automatically sets the Content-Type header to application/json. Option C is correct because the library's core purpose is to provide a high-level, human-friendly API for HTTP, exposing convenience methods like requests.get(), requests.post(), requests.put(), and requests.delete() that wrap urllib3 under the hood. Option A is not correct because requests is built on urllib3 and supports connection pooling and keep-alive, and while the base API is synchronous, it is not limited to a single execution model in the sense implied. Option D is not correct because requests manages connection pooling automatically via HTTPAdapter and urllib3's PoolManager, so manual pool management is not required. Option E is not correct because requests supports Python 3.x (and historically 2.7), not exclusively Python 2.7.

Answer

It only supports the synchronous execution model.

Answer

It requires manual management of connection pools.

Answer

It is only compatible with Python 2.7.

Question 17

Which Cisco security product uses the pxGrid framework to share contextual information with other network devices?

Accepted Answer

Cisco ISE. Cisco ISE (Identity Services Engine) is the primary platform that utilizes pxGrid to share identity and policy context across the network ecosystem.

Answer

Cisco Firepower

Answer

Cisco ASA

Answer

Cisco Umbrella

Question 18

When writing a Python request to the SecureX API, which Content-Type header is required for POST requests?

Accepted Answer

application/json. For POST requests to the SecureX API, the required Content-Type header is application/json. The SecureX API expects JSON-formatted request bodies, so the Content-Type must be set accordingly to ensure the server parses the payload correctly.

Answer

application/xml

Answer

application/x-www-form-urlencoded

Answer

text/plain

Question 19

An engineer is using NETCONF to retrieve configuration data from a Cisco IOS XE device. The engineer wants to filter the response to only include interface configuration for GigabitEthernet1. Which YANG filter correctly achieves this using the subtree filter?

Accepted Answer

GigabitEthernet1. The correct subtree filter includes the proper namespace for the ietf-interfaces module and follows the hierarchy: interfaces > interface > name. This ensures the NETCONF server correctly interprets the filter and returns only the configuration for GigabitEthernet1. Omitting the namespace or parent container leads to invalid filters and incorrect results.

Answer

GigabitEthernet1

Answer

GigabitEthernet1

Answer

Question 20

You are utilizing the Cisco ISE ERS API to provision a guest account. If the API returns a '409 Conflict', what is the most likely cause?

Accepted Answer

The account already exists.. In the Cisco ISE External RESTful Services (ERS) API, HTTP 409 Conflict indicates a resource conflict — most commonly that the object you are trying to create (e.g., a guest account with a given username) already exists in ISE. The correct handling is to detect the existing object, update it via PUT, or choose a unique identifier. This is standard REST semantics and ISE follows it for duplicate guest, endpoint, and identity-group creations.

Answer

The credentials provided are invalid.

Answer

The request body is malformed.

Answer

The API rate limit has been exceeded.