SAUTO Practice Questions 1 — 50 Questions

Question 1

What is the primary function of an API 'sandbox' in Cisco DevNet?

Accepted Answer

To provide a safe environment for development and testing.. Sandboxes provide a pre-configured environment for developers to test and validate their API calls without affecting production networks.

Answer

To train end-users.

Answer

To store production backups.

Answer

To bypass security compliance requirements.

Question 2

Which TWO components are required when configuring the Cisco Secure Web Appliance (SWA) to allow API access?

Accepted Answer

Enable 'REST API' in the 'Feature Key' or 'System' settings. Option A is correct because the Cisco Secure Web Appliance (SWA) requires the REST API feature to be enabled in the Feature Key or System settings before any API access is possible; without this license/feature activation, the API endpoints are unavailable. Option B is correct because API access must be authenticated with a dedicated API user account that has the appropriate administrative roles (for example, an admin or operator role with API permissions), since the SWA validates credentials and role-based permissions for every API request. Option C is not required because API access does not depend on configuring a local DNS server; DNS is only needed for name resolution of external services, not for enabling the API itself. Option D is not required because SNMP v3 credentials are used for monitoring via SNMP, not for REST API authentication or access. Option E is not required because IPsec VPN tunneling is a network transport feature and is unrelated to enabling or authenticating API access on the SWA.

Answer

Configure a local DNS server

Answer

SNMP v3 credentials

Answer

Enable IPsec VPN tunneling

Question 3

Which component in the Cisco security portfolio is most effectively automated using the 'AsyncOS' Reporting API?

Accepted Answer

Secure Email Gateway. AsyncOS is the operating system used by Cisco Secure Email Gateway (formerly Email Security Appliance), and its Reporting API is specifically designed to extract reporting and message-tracking data from that platform. Therefore, the Secure Email Gateway is the component most effectively automated via the AsyncOS Reporting API.

Answer

Cisco Duo

Answer

Cisco ISE

Answer

Cisco Meraki

Question 4

What is the significance of the 'Accept' header in a REST API request?

Accepted Answer

It specifies the expected response format.. The Accept header in a REST API request tells the server what media type the client expects in the response, such as application/json or application/xml. It is a content negotiation mechanism defined in HTTP specifications.

Answer

It defines the data format being sent.

Answer

It tells the server to accept the connection.

Answer

It performs authentication.

Question 5

You are automating Cisco Secure Email Gateway (AsyncOS) quarantine management. After authenticating and obtaining a session token, your script must release a message from quarantine. Which HTTP request should the script issue?

Accepted Answer

POST to the quarantine messages endpoint with a JSON body specifying action=release and the message ID.. Quarantine release is a state-changing operation, so it uses HTTP POST to the quarantine messages endpoint with a JSON body containing the action and target message ID, authenticated by the session token header. Read-only GET, resource-deleting DELETE, and replacement-oriented PUT do not perform a release.

Answer

GET to the quarantine messages endpoint with the message ID as a query parameter.

Answer

PUT to the quarantine messages endpoint with action=release in the URL query string.

Answer

DELETE to the quarantine messages endpoint with the message ID in the URL path.

Question 6

You are writing a script that interacts with Cisco DNA Center. You need to keep the session alive after authentication. Which token is commonly used for subsequent API calls?

Accepted Answer

X-Auth-Token. Cisco DNA Center's REST API uses a token-based authentication scheme where the client first authenticates via POST to /dna/system/api/v1/auth/token with Basic Auth credentials, and the response contains a token. Subsequent API calls must include this token in the X-Auth-Token HTTP header to maintain the session. This is the standard mechanism documented by Cisco for DNA Center automation.

Answer

OAuth Refresh Token

Answer

Session ID

Answer

Basic Auth Header

Question 7

You are writing a Python script to interact with the Cisco Firepower Management Center (FMC) API. You need to authenticate to obtain an authentication token. Which HTTP method and endpoint must your script utilize to initiate this process?

Accepted Answer

POST /api/fmc_platform/v1/auth/generatetoken. The FMC API authentication flow requires a POST request to /api/fmc_platform/v1/auth/generatetoken with the username and password (typically Basic auth) to obtain an access token and refresh token. The token is then used in the X-auth-access-token header for subsequent API calls. POST is correct because the operation creates a new session token.

Answer

PUT /api/fmc_platform/v1/auth/generatetoken

Answer

GET /api/fmc_platform/v1/auth/generatetoken

Answer

POST /api/fmc_platform/v1/auth/login

Question 8

Which TWO statements accurately describe the behavior of the NETCONF 'candidate' data store?

Accepted Answer

The candidate store can be discarded if the proposed changes are incorrect.. Option A is correct because the NETCONF candidate datastore is a scratchpad where configuration changes can be staged and then thrown away with the operation if the proposed edits are wrong, leaving the running configuration untouched. Option E is correct because the candidate datastore is not active until the client issues a operation, which copies the candidate configuration into the running datastore so it takes effect on the device. Option B is wrong because NETCONF candidate edits are serialized under a lock (candidate lock or partial lock); concurrent edits are not automatically merged, and a second user must wait or use separate candidate instances. Option C is wrong because changes in the candidate store are not immediately active — they only become active after a successful commit to the running store. Option D is wrong because XML encoding is the standard NETCONF encoding for all datastores (running, candidate, startup), not a feature unique to the candidate store.

Answer

The candidate store supports multiple users making concurrent edits that are merged.

Answer

Changes applied to the candidate store are immediately active on the device.

Answer

The candidate store is the only store that supports XML encoding.

Question 9

Which TWO of the following are types of Cisco Security API documentation? (Choose two)

Accepted Answer

Swagger/OpenAPI specifications. Option A (Swagger/OpenAPI specifications) is correct because Cisco Security APIs publish machine-readable interface definitions in Swagger 2.0 or OpenAPI 3.0 format, which document endpoints, HTTP methods, parameters, authentication schemes, and response schemas for programmatic consumption. Option B (Developer portal HTML/web docs) is correct because Cisco hosts human-readable API reference documentation on developer portals such as developer.cisco.com, providing guides, endpoint descriptions, and code samples in HTML/web form. Option C is incorrect because physical paper manuals are not a recognized API documentation type for Cisco Security APIs. Option D is incorrect because Cisco does not distribute API source code as a documentation format. Option E is incorrect because voice-recorded tutorials are not a standard API documentation type.

Answer

Physical manuals printed on paper

Answer

Direct source code distribution

Answer

Voice-recorded tutorials

Question 10

In Threat Grid, what is the purpose of the 'Tags' field in an analysis report submission?

Accepted Answer

To label and categorize reports. The 'Tags' field in a Threat Grid analysis report submission is used to label and categorize reports. Tags allow analysts to organize, search, and filter submissions based on custom keywords or categories, facilitating threat intelligence management and correlation.

Answer

To set the infection vector

Answer

To specify the sandbox OS

Answer

To define the analysis priority

Question 11

In the context of the Cisco Adaptive Security Appliance (ASA) REST API, what does a 'PATCH' method perform compared to a 'PUT' method?

Accepted Answer

PATCH updates only the specified fields, while PUT replaces the entire resource.. In REST APIs, PATCH is used for partial updates, modifying only the specified fields of a resource. PUT replaces the entire resource with the provided representation. The Cisco ASA REST API follows this standard, so PATCH updates only the given attributes, while PUT overwrites the whole object.

Answer

There is no difference; they are interchangeable.

Answer

PATCH creates a new resource, while PUT updates an existing one.

Answer

PATCH deletes the resource, while PUT updates it.

Question 12

Which Python library is the standard for performing HTTP requests in an automation script?

Accepted Answer

requests. The 'requests' library is the de facto standard for making HTTP requests in Python automation scripts because it provides a simple, human-friendly API that handles sessions, headers, authentication, JSON parsing, and connection pooling out of the box. It abstracts away the low-level complexity that the standard library requires.

Answer

http.client

Answer

socket

Answer

urllib

Question 13

You are automating the deletion of a sandbox report in Threat Grid. Which HTTP method should you use?

Accepted Answer

DELETE. The HTTP DELETE method is used to delete a specified resource. In the context of Threat Grid, deleting a sandbox report is a deletion operation, so the DELETE method is appropriate. The API endpoint for deleting a report would be called with DELETE.

Answer

GET

Answer

POST

Answer

PUT

Question 14

Which THREE of the following are true about the Cisco Umbrella API?

Accepted Answer

It requires an API Key and Secret. Option A is correct because the Cisco Umbrella API authenticates requests using an API Key and Secret, which are generated in the Umbrella dashboard and used to obtain an OAuth 2.0 token for API calls. Option B is correct because the Umbrella API follows REST principles, using standard HTTP methods (GET, POST, PUT, DELETE) and JSON-formatted requests and responses over HTTPS. Option E is correct because the Umbrella API provides both management capabilities (such as configuring policies, networks, and identities) and reporting capabilities (such as retrieving security activity and traffic reports). Option C is incorrect because the Umbrella API is available across multiple Umbrella packages and account types, not exclusively Enterprise accounts. Option D is incorrect because the Umbrella API is REST-based, not SOAP-based.

Answer

It is only available for Enterprise accounts

Answer

It is SOAP-based

Question 15

You are writing a Python script to retrieve interface statistics from a Cisco Firepower Management Center (FMC) using the REST API. When making the GET request, which header must be included to ensure the server understands the client prefers JSON format?

Accepted Answer

Accept: application/json. The Accept header is used by the client to specify the media types it is willing to receive in the response. By setting Accept: application/json, the client tells the FMC REST API that it prefers JSON-formatted data. This ensures the server returns JSON rather than XML or another format. The other headers serve different purposes: Content-Type describes the request body, X-Auth-Token is for authentication, and Authorization is for credentials.

Answer

Content-Type: application/json

Answer

X-Auth-Token: JSON

Answer

Authorization: Bearer

Question 16

You are automating Cisco ASA firewall rule updates using the REST API. Which data format is required in the request body when pushing a new access control entry?

Accepted Answer

JSON. The Cisco ASA REST API requires request bodies to be formatted in JSON (JavaScript Object Notation). When pushing a new access control entry (ACE), you must send a JSON payload that defines the ACE parameters, such as source, destination, and action. This is specified in Cisco's ASA REST API documentation, which mandates JSON for all API interactions.

Answer

YAML

Answer

XML

Answer

CSV

Question 17

You are automating the blocking of a specific URL on a Cisco WSA. You have verified the API reachability, but the rule is not being applied. What is the most common reason?

Accepted Answer

The configuration change was not committed. On Cisco WSA, API-driven configuration changes are staged and do not take effect until a commit is performed. If the API call succeeds but the change is not committed, the rule will not be applied to live traffic — this is the most common reason for 'API reachable but rule not applied' scenarios.

Answer

The URL is already in the global whitelist

Answer

The WSA needs a reboot

Answer

The API user does not have 'Admin' privileges

Question 18

Which THREE components are required to configure an API client for Cisco SecureX?

Accepted Answer

API Scope. To configure an API client for Cisco SecureX, you must supply the OAuth 2.0 credentials that SecureX generates when the client is created: the Client ID (E), which uniquely identifies the API client, the Client Secret (D), which authenticates that client, and the API Scope (C), which defines the specific permissions or resources the client may access. These three values are used together in the token request to obtain an access token for calling SecureX APIs. A Device Serial Number (A) is not part of API client authentication; it is hardware-identifying information used for device licensing and support, not for OAuth client credentials. A User Password (B) is likewise not required, because SecureX API clients authenticate with the generated client credentials rather than a user's account password.

Answer

Device Serial Number

Answer

User Password

Question 19

When using the Umbrella API to create a new 'Domain' block rule, you need to specify the 'type'. Which of the following is a valid type?

Accepted Answer

domain. In the Umbrella API, when creating a block rule for a domain, the 'type' field must be set to 'domain'. This indicates that the rule applies to a specific domain name, such as 'example.com'. Other types like 'url' or 'ip_address' are not valid for domain-based rules; they would be used for different rule categories. The 'category' type is used for content category rules, not for individual domain blocks.

Answer

url

Answer