SAUTO Practice Test 6 — 10 Questions

Question 1

A network security engineer is writing a Python script to interact with the Cisco Identity Services Engine (ISE) External RESTful Services (ERS) API. The script must create a new endpoint and then retrieve its details. Which HTTP status code should the script expect upon successful creation of the endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

201 Created. The ISE ERS API follows REST conventions and returns HTTP 201 Created when a new resource is successfully created via a POST request. This status confirms the creation and often includes a Location header pointing to the new resource. A 200 OK is used for successful GET or PUT, but not for creation.

Answer

302 Found

Answer

200 OK

Answer

204 No Content

Question 2

You are developing a Python script to automate Cisco Umbrella enforcement of security policies. The script must retrieve the list of identities and then apply a block action to a specific domain. Which API endpoint and method should you use to apply the block action?

Accepted Answer

POST to /policies/{policyId}/blocklist with a JSON body containing the domain to block.. To block a domain in Cisco Umbrella, you add it to a policy's block list. The API endpoint /policies/{policyId}/blocklist supports POST to add a domain. This is the correct method to apply a block action programmatically. Using POST ensures the domain is appended to the existing block list.

Answer

POST to /policies/{policyId}/block with a JSON body containing the domain.

Answer

GET to /policies/{policyId}/blocklist?domain=example.com to add the domain to the block list.

Answer

PUT to /policies/{policyId}/blocklist with a JSON body containing the domain to block.

Question 3

You are writing a script to update Cisco Secure Email (ESA) configuration. You need to push a new 'Content Filter' rule. Why is it recommended to perform a 'Get' request before the 'Put' request?

Accepted Answer

To preserve existing configuration attributes not being modified. Performing a 'Get' request before a 'Put' request is recommended to preserve existing configuration attributes that are not being modified. The 'Put' request typically replaces the entire resource, so if you omit fields, they may be reset to defaults. By retrieving the current configuration first, you can modify only the desired fields and send back the complete object.

Answer

To lock the configuration database

Answer

To verify the user has write permissions

Answer

To check if the API is responsive

Question 4

A security automation engineer is designing a Python script that interacts with multiple Cisco security appliances' REST APIs. The script must handle HTTP errors gracefully and implement retry logic for transient failures. Which two practices should be followed to ensure robust error handling? (Choose two.)

Accepted Answer

Use the raise_for_status() method on the response object to automatically raise an exception for HTTP error codes.. Using raise_for_status() and catching RequestException are two best practices for robust error handling with the requests library. raise_for_status() triggers exceptions on HTTP errors, and catching RequestException handles all request-related exceptions. These practices ensure that errors are detected and managed, allowing for retries or graceful degradation.

Answer

Use the Response.status_code attribute to manually check for specific error codes and implement custom retry logic.

Answer

Ignore HTTP 500 errors because they are server-side issues and will resolve on their own.

Answer

Set a very high timeout value to avoid timeouts and ensure requests always complete.

Question 5

Which programming language is most commonly used for Cisco Security automation tasks?

Accepted Answer

Python. Python is the industry standard for network and security automation due to its extensive library support and readability.

Answer

Java

Answer

C++

Answer

PHP

Question 6

You are writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of all endpoints in your organization. After authenticating with OAuth 2.0, you need to handle pagination because the API returns a limited number of results per page. Which HTTP response header should your script inspect to obtain the URL for the next page of results?

Accepted Answer

Link. The Cisco Secure Endpoint API implements pagination using the Link header, which contains URLs for the next, previous, first, and last pages. By parsing this header, your script can reliably navigate through large result sets. This approach is consistent with RESTful best practices and ensures that automated workflows, such as endpoint inventory or threat hunting, retrieve complete data without manual intervention.

Answer

Location

Answer

X-Next-Page

Answer

X-Total-Count

Question 7

You are automating the deployment of Cisco Umbrella Roaming Client to a large number of remote Windows endpoints using a configuration management tool. To ensure the client registers correctly and enforces policies, you need to provide the necessary parameters during silent installation. Which two parameters are required for a successful silent installation of the Cisco Umbrella Roaming Client? (Choose two.)

Accepted Answer

Organization ID. For a successful silent installation of the Cisco Umbrella Roaming Client, you must provide the Organization ID and the registration token. These parameters allow the client to authenticate and register with your Umbrella organization, enabling policy enforcement. Other settings, such as proxy configuration or user email, are optional and can be managed post-installation or via other means.

Answer

Proxy Server Address

Answer

User Email Address

Answer

DNS Server IP

Question 8

A security automation engineer is writing a Python script that uses the Cisco Secure Endpoint (formerly AMP for Endpoints) API to retrieve a list of computers. The script must handle pagination because the environment has thousands of endpoints. Which HTTP response header should the script inspect to determine the URL for the next page of results?

Accepted Answer

Link. The Cisco Secure Endpoint API implements pagination using the Link header as defined in RFC 5988. When a response contains more results, the Link header includes a URL with rel="next". The automation script must parse this header and follow the URL to retrieve subsequent pages. This ensures complete data retrieval across large environments without missing endpoints.

Answer

X-Next-Page

Answer

Location

Answer

Retry-After

Question 9

You are writing a script to monitor SecureX API rate limits. Which HTTP response header contains the remaining requests available?

Accepted Answer

X-RateLimit-Remaining. SecureX (and most REST APIs following the IETF draft rate-limit header convention) returns the X-RateLimit-Remaining header to indicate how many requests the client can still make in the current window before being throttled. This header is paired with X-RateLimit-Limit (total allowed) and X-RateLimit-Reset (epoch time when the window resets), allowing scripts to pace API calls proactively.

Answer

Retry-After

Answer

X-Request-Limit

Answer

Status-Remaining

Question 10

An engineer is automating a Cisco Identity Services Engine (ISE) deployment using the ERS API. The API requires a secure transport and the engineer wants to verify the server's certificate against a corporate CA bundle in a Python script. The script uses the requests library. Which code snippet correctly performs the GET request to retrieve all network devices while ensuring certificate validation?

Accepted Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), verify='/path/to/ca_bundle.pem'). The correct approach is to pass the path to the corporate CA bundle via the verify parameter. This ensures the requests library validates the ISE server's certificate against the trusted corporate root, preventing man-in-the-middle attacks. Using verify=False disables validation, while cert is for client certificates, and verify=True uses the default bundle, which may not include the corporate CA.

Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), verify=False)

Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), verify=True)

Answer

requests.get('https://ise.example.com/ers/config/networkdevice', auth=('user','pass'), cert='/path/to/ca_bundle.pem')